no-jira: images: bump UPI image dependencies to 4.22

[patrickdillon]

Bump source image dependencies to 4.22. This is particularly important for the oc cli as the latest 4.22 version contains a bug fix for filtering tech preview manifests.

Summary by CodeRabbit

• Chores
  • CI testing environment updated to use OpenShift 4.22 base images and artifacts (replacing 4.17).
  • Runtime and build-stage images switched to the newer OpenShift 4.22 lineage.
  • No changes to build steps, installed tools, or copied artifacts; behavior of CI jobs remains unchanged.

[openshift-ci-robot]

@patrickdillon: This pull request explicitly references no jira issue.

Details

In response to this:

Bump source image dependencies to 4.22. This is particularly important for the oc cli as the latest 4.22 version contains a bug fix for filtering tech preview manifests.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 91b8f7dc-69e6-4a8b-9178-13fc8922daa1

📥 Commits

Reviewing files that changed from the base of the PR and between 23a323c and 77df4bd.

📒 Files selected for processing (1)

• images/installer/Dockerfile.upi.ci

🚧 Files skipped from review as they are similar to previous changes (1)

• images/installer/Dockerfile.upi.ci

---

Walkthrough

Updated the CI UPI installer test Dockerfile to switch OpenShift image references from 4.17 to 4.22 for artifact sources and the runtime build stage; no other build steps or installed tooling were modified.

Changes

Cohort / File(s)	Summary
Dockerfile: OpenShift base bump images/installer/Dockerfile.upi.ci	Replaced multi-stage artifact sources (kas-artifacts, etcd-artifacts) and runtime build images from ocp/4.17 to ocp/4.22:base-rhel9. No changes to installed tools or other build steps.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~2 minutes

🚥 Pre-merge checks | ✅ 12

✅ Passed checks (12 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main change: bumping UPI image dependencies to OpenShift 4.22, which is the primary focus of the pull request.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	PR only modifies Dockerfile.upi.ci (infrastructure config). No Ginkgo test files or test names are changed. Custom check for stable test names is not applicable.
Test Structure And Quality	✅ Passed	The custom check applies only to Ginkgo test code, but this PR modifies only Dockerfile configuration (images/installer/Dockerfile.upi.ci), not any test code. Check is not applicable.
Microshift Test Compatibility	✅ Passed	No new Ginkgo e2e tests were added in this PR. The PR only modifies images/installer/Dockerfile.upi.ci to remove bind-utils and bump to OpenShift 4.22. The check is not applicable.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	Check is not applicable. This PR modifies Dockerfile configuration files (images/installer/Dockerfile.upi.ci) to bump OCP 4.22 dependencies and remove bind-utils. No new Ginkgo e2e tests are added.
Topology-Aware Scheduling Compatibility	✅ Passed	PR modifies only images/installer/Dockerfile.upi.ci, a build artifact with no scheduling constraints. Not a deployment manifest, operator code, or controller. Check not applicable.
Ote Binary Stdout Contract	✅ Passed	Custom check not applicable to PR. Check targets OTE Binary stdout violations in Go code (main, init, TestMain, suite setup). PR only modifies Dockerfile.upi.ci - no Go code changes.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	PR modifies only Dockerfile to update base images to 4.22. No new Ginkgo e2e tests are added, so the IPv6/disconnected network compatibility check is not applicable.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

Tip

💬 Introducing Slack Agent: The best way for teams to turn conversations into code.

Slack Agent is built on CodeRabbit's deep understanding of your code, so your team can collaborate across the entire SDLC without losing context.

• Generate code and open pull requests
• Plan features and break down work
• Investigate incidents and troubleshoot customer tickets together
• Automate recurring tasks and respond to alerts with triggers
• Summarize progress and report instantly

Built for teams:

• Shared memory across your entire org—no repeating context
• Per-thread sandboxes to safely plan and execute work
• Governance built-in—scoped access, auditability, and budget controls

One agent for your entire SDLC. Right inside Slack.

👉 Get started

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[tthvo]

/lgtm
/approve

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: tthvo

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [tthvo]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[tthvo]

/retest-required

[patrickdillon]

/retest

[patrickdillon]

/retest

[tthvo]

@coderabbitai analyze and summarize the failed job status. They all seem to fail at image build with a similar error, don't they?

[coderabbitai]

Tip

For best results, initiate chat on the files or code changes.

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Get check runs for PR `#10538`
gh pr checks 10538 --repo openshift/installer 2>&1 | head -100

Length of output: 5172

---

🏁 Script executed:

#!/bin/bash
# Fetch the build log for ci/prow/images job from GCS
curl -sL "https://storage.googleapis.com/test-platform-results/pr-logs/pull/openshift_installer/10538/pull-ci-openshift-installer-main-images/2053907070142386176/build-log.txt" 2>&1 | tail -80

echo "---E2E-AWS-OVN-UPI---"
curl -sL "https://storage.googleapis.com/test-platform-results/pr-logs/pull/openshift_installer/10538/pull-ci-openshift-installer-main-e2e-aws-ovn-upi/2053907069936865280/build-log.txt" 2>&1 | tail -50

Length of output: 10938

---

@tthvo Yes, your suspicion is correct — all failures share the same root cause: the upi-installer-amd64 image build failing due to an RPM package conflict. Here's the full breakdown:

---

🔴 Failed Jobs Summary

Job	Failure Stage
ci/prow/images	upi-installer-amd64 image build
ci/prow/e2e-aws-ovn	Same image build failure
ci/prow/e2e-aws-ovn-upi	Same image build failure
ci/prow/e2e-azure-ovn-upi	Same image build failure
ci/prow/e2e-gcp-ovn-upi	Same image build failure
ci/prow/e2e-vsphere-ovn-upi	Same image build failure
ci/prow/e2e-vsphere-ovn-upi-zones	Same image build failure

All 7 jobs failed at the same step, with the same error, in the same image build.

---

🐛 Root Cause: bind-utils vs bind9.18-utils Package Conflict

The Dockerfile (Dockerfile.upi.ci) runs yum update -y followed by yum install ... bind-utils .... The ocp/4.22:base-rhel9 base image (introduced by this PR) contains bind9.18-utils which conflicts with and obsoletes bind-utils:

error: Could not depsolve transaction; 1 problem detected:
 Problem: problem with installed package bind9.18-utils-32:9.18.29-14.el9_8.1.x86_64
  - package bind9.18-utils-32:9.18.29-14.el9_8.1.x86_64 from `@System` conflicts with bind-utils
    provided by bind-utils-32:9.16.23-40.el9_8.1.x86_64 from rhel-9-appstream

After yum update -y pulls in bind9.18-utils (the RHEL 9.8 replacement for bind-utils), the subsequent explicit yum install bind-utils fails because the two packages conflict.

---

✅ Suggested Fix

In images/installer/Dockerfile.upi.ci, replace bind-utils with bind9.18-utils in the yum install step (or simply remove it, since bind9.18-utils already provides dig, nslookup, etc.):

 RUN yum update -y && \
     yum install --setopt=tsflags=nodocs -y \
       ...
-      bind-utils \
+      bind9.18-utils \
       ...

This is a consequence of the base image bump from ocp/4.17 → ocp/4.22 where RHEL 9.8's bind9.18-utils has officially replaced the old bind-utils package.

[tthvo]

In images/installer/Dockerfile.upi.ci, replace bind-utils with bind9.18-utils in the yum install step (or simply remove it, since bind9.18-utils already provides dig, nslookup, etc.):

@patrickdillon CodeRabbit's reasoning seems right? I guess we can try removing that package because it is already available?

[patrickdillon]

@patrickdillon CodeRabbit's reasoning seems right? I guess we can try removing that package because it is already available?

Yeah! pushed a new commit

[tthvo]

/lgtm

Nice, images finish building XD

[patrickdillon]

/verified by ci/prow/images

[openshift-ci-robot]

@patrickdillon: This PR has been marked as verified by ci/prow/images.

Details

In response to this:

/verified by ci/prow/images

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[tthvo]

/retest-required
/tide refresh

[openshift-merge-bot]

/retest-required

Remaining retests: 0 against base HEAD 1fc515d and 2 for PR HEAD 77df4bd in total

[patrickdillon]

/override ci/prow/e2e-vsphere-ovn-upi ci/prow/e2e-gcp-ovn-upi

failures not related to image build

[openshift-ci]

@patrickdillon: Overrode contexts on behalf of patrickdillon: ci/prow/e2e-gcp-ovn-upi, ci/prow/e2e-vsphere-ovn-upi

Details

In response to this:

/override ci/prow/e2e-vsphere-ovn-upi ci/prow/e2e-gcp-ovn-upi

failures not related to image build

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[openshift-ci]

@patrickdillon: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-vsphere-ovn-upi-zones	77df4bd	link	false	/test e2e-vsphere-ovn-upi-zones
ci/prow/e2e-azure-ovn-upi	77df4bd	link	false	/test e2e-azure-ovn-upi

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[tthvo]

/override ci/prow/e2e-aws-ovn-upi

e2e test failure is not related either for this job.

[openshift-ci]

@tthvo: Overrode contexts on behalf of tthvo: ci/prow/e2e-aws-ovn-upi

Details

In response to this:

/override ci/prow/e2e-aws-ovn-upi

e2e test failure is not related either for this job.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[tthvo]

/cherry-pick release-4.22

[openshift-cherrypick-robot]

@tthvo: new pull request created: #10582

Details

In response to this:

/cherry-pick release-4.22

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.