Merge pull request #76 from NVIDIA/ubi9-base

use the ubi9 cuda base and drop the ubi tag suffix from generated images

.common-ci.yml

@@ -33,9 +33,9 @@ stages:
   - release
   - sign
 
-.dist-ubi8:
+.dist-ubi9:
   variables:
-    DIST: ubi8
+    DIST: ubi9
 
 # Define the platform targets
 .platform-amd64:
@@ -120,9 +120,9 @@ stages:
       variables:
         OUT_IMAGE_VERSION: "${CI_COMMIT_TAG}"
 
-release:staging-ubi8:
+release:staging-ubi9:
   extends:
     - .release:staging
-    - .dist-ubi8
+    - .dist-ubi9
   needs:
-    - image-ubi8
+    - image-ubi9

.github/workflows/images.yaml

@@ -33,7 +33,7 @@ jobs:
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        dist: [ubi8]
+        dist: [ubi9]
     steps:
       - uses: actions/checkout@v4
         name: Check out code

.gitlab-ci.yml

@@ -30,7 +30,7 @@ include:
   script:
     - make -f deployments/container/Makefile build-${DIST}
 
-image-ubi8:
+image-ubi9:
   extends:
     - .image-build
-    - .dist-ubi8
+    - .dist-ubi9

.nvidia-ci.yml

@@ -57,23 +57,23 @@ variables:
     - !reference [.regctl-setup, before_script]
     - apk add --no-cache make bash
     - >
-      regctl manifest get ${IN_REGISTRY}/${IN_IMAGE_NAME}:${IN_VERSION}-ubi8 --list > /dev/null && echo "${IN_REGISTRY}/${IN_IMAGE_NAME}:${IN_VERSION}-${DIST}" || ( echo "${IN_REGISTRY}/${IN_IMAGE_NAME}:${IN_VERSION}-${DIST} does not exist" && sleep infinity )
+      regctl manifest get ${IN_REGISTRY}/${IN_IMAGE_NAME}:${IN_VERSION} --list > /dev/null && echo "${IN_REGISTRY}/${IN_IMAGE_NAME}:${IN_VERSION}" || ( echo "${IN_REGISTRY}/${IN_IMAGE_NAME}:${IN_VERSION} does not exist" && sleep infinity )
   script:
     - regctl registry login "${OUT_REGISTRY}" -u "${OUT_REGISTRY_USER}" -p "${OUT_REGISTRY_TOKEN}"
-    - make -f deployments/container/Makefile IMAGE=${IN_REGISTRY}/${IN_IMAGE_NAME}:${IN_VERSION}-${DIST} OUT_IMAGE=${OUT_IMAGE_NAME}:${CI_COMMIT_SHORT_SHA}-${DIST} push-${DIST}
+    - make -f deployments/container/Makefile IMAGE=${IN_REGISTRY}/${IN_IMAGE_NAME}:${IN_VERSION} OUT_IMAGE=${OUT_IMAGE_NAME}:${CI_COMMIT_SHORT_SHA} push-${DIST}
 
-image-ubi8:
+image-ubi9:
   extends:
     - .image-pull
-    - .dist-ubi8
+    - .dist-ubi9
 
 # The .scan step forms the base of the image scan operation performed before releasing
 # images.
 .scan:
   stage: scan
   image: "${PULSE_IMAGE}"
   variables:
-    IMAGE: "${CI_REGISTRY_IMAGE}:${CI_COMMIT_SHORT_SHA}-${DIST}"
+    IMAGE: "${CI_REGISTRY_IMAGE}:${CI_COMMIT_SHORT_SHA}"
     IMAGE_ARCHIVE: "k8s-kata-manager.tar"
   except:
     variables:
@@ -102,13 +102,13 @@ image-ubi8:
 scan-amd64:
   extends:
     - .scan
-    - .dist-ubi8
+    - .dist-ubi9
     - .platform-amd64
 
 scan-arm64:
   extends:
     - .scan
-    - .dist-ubi8
+    - .dist-ubi9
     - .platform-arm64
 
 # Define the external release helpers
@@ -122,10 +122,10 @@ scan-arm64:
 
 # Define the external release targets
 # Release to NGC
-release:ngc-ubi8:
+release:ngc-ubi9:
   extends:
     - .release:ngc
-    - .dist-ubi8
+    - .dist-ubi9
 
 # Define the external image signing steps for NGC
 # Download the ngc cli binary for use in the sign steps
@@ -154,7 +154,7 @@ release:ngc-ubi8:
   variables:
     NGC_CLI_API_KEY: "${NGC_REGISTRY_TOKEN}"
     IMAGE_NAME: "${NGC_REGISTRY_IMAGE}"
-    IMAGE_TAG: "${CI_COMMIT_TAG}-${DIST}"
+    IMAGE_TAG: "${CI_COMMIT_TAG}"
   retry:
     max: 2
   before_script:
@@ -166,17 +166,9 @@ release:ngc-ubi8:
     - 'echo "Signing the image ${IMAGE_NAME}:${IMAGE_TAG}"'
     - ngc-cli/ngc registry image publish --source ${IMAGE_NAME}:${IMAGE_TAG} ${IMAGE_NAME}:${IMAGE_TAG} --public --discoverable --allow-guest --sign --org nvidia
 
-sign:ngc-short-tag:
-  extends:
-    - .sign:ngc
-  variables:
-    IMAGE_TAG: "${CI_COMMIT_TAG}"
-  needs:
-    - release:ngc-ubi8
-
-sign:ngc-ubi8:
+sign:ngc-ubi9:
   extends:
-    - .dist-ubi8
+    - .dist-ubi9
     - .sign:ngc
   needs:
-    - release:ngc-ubi8
+    - release:ngc-ubi9

deployments/container/Dockerfile.ubi8 → deployments/container/Dockerfile.ubi9

@@ -15,7 +15,7 @@
 ARG GOLANG_VERSION=x.x.x
 ARG VERSION="N/A"
 
-FROM nvcr.io/nvidia/cuda:12.6.2-base-ubi8 as build
+FROM nvcr.io/nvidia/cuda:12.6.2-base-ubi9 as build
 
 RUN yum install -y wget make git gcc
 
@@ -43,7 +43,7 @@ ARG VERSION="N/A"
 ARG GIT_COMMIT="unknown"
 RUN make PREFIX=/artifacts cmds
 
-FROM nvcr.io/nvidia/cuda:12.6.2-base-ubi8
+FROM nvcr.io/nvidia/cuda:12.6.2-base-ubi9
 
 COPY --from=build /artifacts/k8s-kata-manager /usr/bin/k8s-kata-manager
 

deployments/container/Makefile

@@ -27,18 +27,15 @@ ifeq ($(IMAGE_NAME),)
 IMAGE_NAME := $(REGISTRY)/$(NAME)
 endif
 
-IMAGE_VERSION := $(VERSION)
-
-IMAGE_TAG ?= $(IMAGE_VERSION)-$(DIST)
+IMAGE_TAG ?= $(VERSION)
 IMAGE = $(IMAGE_NAME):$(IMAGE_TAG)
 
 OUT_IMAGE_NAME ?= $(IMAGE_NAME)
-OUT_IMAGE_VERSION ?= $(IMAGE_VERSION)
-OUT_IMAGE_TAG = $(OUT_IMAGE_VERSION)-$(DIST)
-OUT_IMAGE = $(OUT_IMAGE_NAME):$(OUT_IMAGE_TAG)
+OUT_IMAGE_VERSION ?= $(VERSION)
+OUT_IMAGE = $(OUT_IMAGE_NAME):$(OUT_IMAGE_VERSION)
 
 ##### Public rules #####
-DEFAULT_PUSH_TARGET := ubi8
+DEFAULT_PUSH_TARGET := ubi9
 DISTRIBUTIONS = $(DEFAULT_PUSH_TARGET)
 
 IMAGE_TARGETS := $(patsubst %,image-%,$(DISTRIBUTIONS))
@@ -87,7 +84,7 @@ $(IMAGE_TARGETS): image-%:
 
 build-ubuntu%: DOCKERFILE_SUFFIX := ubuntu
 
-build-ubi8: DOCKERFILE_SUFFIX := ubi8
+build-ubi9: DOCKERFILE_SUFFIX := ubi9
 
 # Handle the default build target.
 .PHONY: build

deployments/container/native-only.mk

@@ -21,11 +21,3 @@ $(BUILD_TARGETS): build-%: image-%
 else
 $(BUILD_TARGETS): build-%: image-%
 endif
-
-# For the default distribution we also retag the image.
-# Note: This needs to be updated for multi-arch images.
-ifeq ($(IMAGE_TAG),$(VERSION)-$(DIST))
-$(DEFAULT_PUSH_TARGET):
-	$(DOCKER) image inspect $(IMAGE) > /dev/null || $(DOCKER) pull $(IMAGE)
-	$(DOCKER) tag $(IMAGE) $(subst :$(IMAGE_TAG),:$(VERSION),$(IMAGE))
-endif