With OCPSTRAT-2553, Red Hat OpenShift 4.21 aims to reduce the number of CVEs reported in Red Hat operator and layered product container images by lowering the package count shipping in the base image.

Maintainers must update Dockerfile/Containerfile to switch to UBI 9.7 minimal (or newer) as the base image - registry.redhat.io/ubi9/ubi-minimal. The support for versionmed UBI base image support ends when there is a new minor version (e.g. 9.8) available, so teams are also responsible for keeping up with base image updates and should preferably consume the ubi9-minimal:latest tag.

As part of switching to UBI minimal base images, teams will need to switch from installing any RPM content with dnf to microdnf, which should provide similar features. Teams will also need to ensure that all runtime dependencies, if any, are met if they were previously implicitly installed in the base image.

For the multi-arch compute team, we are maintainers of:

1. ibm-powervs-block-csi-driver
2. ibm-powervs-block-csi-driver-operator
3. cloud-provider-powervs
4. machine-api-provider-powervs
5. cluster-api-provider-ibmcloud
6. machine-api-provider-ibmcloud

Tasks for Each Operator

1. Switch Base Image
2. Replace Package Manager
3. Enable Repositories (If Needed)

References

1. faq: https://docs.google.com/document/d/1pihblJ5ZLmVov6Pu0pf3sIymllJG-yCnjR2CY6tqz_0/edit?tab=t.0
2. slack conversation: https://redhat-internal.slack.com/archives/CFFJUNP6C/p1762445057875959
3. example: https://github.com/openshift/cluster-kube-descheduler-operator/pull/894/files