Konflux(ROX-22195): Install RHEL RPMs with subscription manager workaround

.tekton/collector-pull-request.yaml

@@ -238,14 +238,14 @@ spec:
         # TODO(ROX-20651): use content sets instead of subscription manager for access to RHEL RPMs once available.
         - name: smuggle-activation-key
           image: registry.access.redhat.com/ubi8/ubi:latest
-          script: exec /workspace/source/source/.konflux/scripts/subscription-manager-bro.sh smuggle
+          script: exec "$(workspaces.source.path)/source/.konflux/scripts/subscription-manager-bro.sh" smuggle
 
     - name: prefetch-dependencies
       params:
       - name: input
         value: $(params.prefetch-input)
       runAfter:
-      - prepare-rhel-rpm-subscriptions
+      - clone-repository
       taskRef:
         params:
         - name: name
@@ -261,7 +261,6 @@ spec:
 
     - name: fetch-support-package
       runAfter:
-      - init
       - clone-repository
       taskSpec:
         steps:
@@ -294,8 +293,9 @@ spec:
       - name: COMMIT_SHA
         value: $(tasks.clone-repository.results.commit)
       runAfter:
-      - prefetch-dependencies
       - fetch-support-package
+      - prefetch-dependencies
+      - prepare-rhel-rpm-subscriptions
       taskRef:
         params:
         - name: name

.tekton/collector-push.yaml

@@ -238,14 +238,14 @@ spec:
         # TODO(ROX-20651): use content sets instead of subscription manager for access to RHEL RPMs once available.
         - name: smuggle-activation-key
           image: registry.access.redhat.com/ubi8/ubi:latest
-          script: exec /workspace/source/source/.konflux/scripts/subscription-manager-bro.sh smuggle
+          script: exec "$(workspaces.source.path)/source/.konflux/scripts/subscription-manager-bro.sh" smuggle
 
     - name: prefetch-dependencies
       params:
       - name: input
         value: $(params.prefetch-input)
       runAfter:
-      - prepare-rhel-rpm-subscriptions
+      - clone-repository
       taskRef:
         params:
         - name: name
@@ -261,7 +261,6 @@ spec:
 
     - name: fetch-support-package
       runAfter:
-      - init
       - clone-repository
       taskSpec:
         steps:
@@ -294,8 +293,9 @@ spec:
       - name: COMMIT_SHA
         value: $(tasks.clone-repository.results.commit)
       runAfter:
-      - prefetch-dependencies
       - fetch-support-package
+      - prefetch-dependencies
+      - prepare-rhel-rpm-subscriptions
       taskRef:
         params:
         - name: name

collector/container/konflux-slim.Dockerfile

@@ -40,7 +40,9 @@ FROM scratch as builder
 
 COPY --from=rpm-implanter-builder /mnt /
 
-COPY . .
+ARG SOURCES_DIR=/staging
+
+COPY . ${SOURCES_DIR}
 
 ARG BUILD_DIR
 ARG SRC_ROOT_DIR=${BUILD_DIR}
@@ -57,12 +59,12 @@ ARG TRACE_SINSP_EVENTS=false
 WORKDIR ${BUILD_DIR}
 
 RUN mkdir kernel-modules \
-    && cp -a /builder builder \
-    && cp -a /collector collector \
-    && cp -a /falcosecurity-libs falcosecurity-libs \
-    && cp -a /builder/third_party third_party \
-    && cp -a /kernel-modules/MODULE_VERSION kernel-modules/MODULE_VERSION \
-    && cp -a /CMakeLists.txt CMakeLists.txt
+    && cp -a ${SOURCES_DIR}/builder builder \
+    && ln -s builder/third_party third_party \
+    && cp -a ${SOURCES_DIR}/collector collector \
+    && cp -a ${SOURCES_DIR}/falcosecurity-libs falcosecurity-libs \
+    && cp -a ${SOURCES_DIR}/kernel-modules/MODULE_VERSION kernel-modules/MODULE_VERSION \
+    && cp -a ${SOURCES_DIR}/CMakeLists.txt CMakeLists.txt
 
 # WITH_RHEL_RPMS controls for dependency installation, ie if they were already installed as RPMs.
 ENV WITH_RHEL_RPMS=true
@@ -87,8 +89,6 @@ RUN ./builder/install/install-dependencies.sh && \
 
 # Application
 FROM registry.access.redhat.com/ubi8/ubi-minimal:latest AS ubi-minimal
-# The installer must be ubi (not minimal) and must be 8.9 or later since the earlier versions complain:
-#  subscription-manager is disabled when running inside a container. Please refer to your host system for subscription management.
 FROM ubi-normal AS rpm-implanter-app
 
 COPY --from=ubi-minimal / /mnt

collector/container/konflux.Dockerfile

@@ -40,7 +40,9 @@ FROM scratch as builder
 
 COPY --from=rpm-implanter-builder /mnt /
 
-COPY . .
+ARG SOURCES_DIR=/staging
+
+COPY . ${SOURCES_DIR}
 
 ARG BUILD_DIR
 ARG SRC_ROOT_DIR=${BUILD_DIR}
@@ -57,12 +59,12 @@ ARG TRACE_SINSP_EVENTS=false
 WORKDIR ${BUILD_DIR}
 
 RUN mkdir kernel-modules \
-    && cp -a /builder builder \
-    && cp -a /collector collector \
-    && cp -a /falcosecurity-libs falcosecurity-libs \
-    && cp -a /builder/third_party third_party \
-    && cp -a /kernel-modules/MODULE_VERSION kernel-modules/MODULE_VERSION \
-    && cp -a /CMakeLists.txt CMakeLists.txt
+    && cp -a ${SOURCES_DIR}/builder builder \
+    && ln -s builder/third_party third_party \
+    && cp -a ${SOURCES_DIR}/collector collector \
+    && cp -a ${SOURCES_DIR}/falcosecurity-libs falcosecurity-libs \
+    && cp -a ${SOURCES_DIR}/kernel-modules/MODULE_VERSION kernel-modules/MODULE_VERSION \
+    && cp -a ${SOURCES_DIR}/CMakeLists.txt CMakeLists.txt
 
 # WITH_RHEL_RPMS controls for dependency installation, ie if they were already installed as RPMs.
 ENV WITH_RHEL_RPMS=true
@@ -125,8 +127,6 @@ RUN if [[ "$(ls -A /kernel-modules)" == "" ]]; then \
 
 # Application
 FROM registry.access.redhat.com/ubi8/ubi-minimal:latest AS ubi-minimal
-# The installer must be ubi (not minimal) and must be 8.9 or later since the earlier versions complain:
-#  subscription-manager is disabled when running inside a container. Please refer to your host system for subscription management.
 FROM ubi-normal AS rpm-implanter-app
 
 COPY --from=ubi-minimal / /mnt