From bbc74600bdfc13d1b810cb98fa2c94e5b755f044 Mon Sep 17 00:00:00 2001 From: Mladen Todorovic Date: Tue, 21 Jul 2026 18:01:30 +0200 Subject: [PATCH 1/6] Add labels --- konflux.Dockerfile | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/konflux.Dockerfile b/konflux.Dockerfile index 1bbbd65..19db7dc 100644 --- a/konflux.Dockerfile +++ b/konflux.Dockerfile @@ -58,6 +58,20 @@ RUN dnf install -y \ # Stage 4: Runtime - Minimal runtime image FROM ubi-micro-base +# Define labels +LABEL \ + com.redhat.component="agentic-cluster-security-suite-acs-mcp-server-container" \ + com.redhat.license_terms="https://www.redhat.com/agreements" \ + description="The ACS MCP Server" \ + io.k8s.description="The ACS MCP Server" \ + io.k8s.display-name="acs-mcp-server" \ + io.openshift.tags="acs-mcp-server" \ + maintainer="Red Hat, Inc." \ + name="agentic-cluster-security-suite-tech-preview/acs-mcp-server-rhel9" \ + source-location="https://github.com/stackrox/stackrox-mcp" \ + summary="The ACS MCP Server" \ + version="${VERSION}" + # Set default environment variables ENV LOG_LEVEL=INFO From cef568ae79989c21e395bd578e89160a563b4796 Mon Sep 17 00:00:00 2001 From: Mladen Todorovic Date: Wed, 22 Jul 2026 10:33:25 +0200 Subject: [PATCH 2/6] Fix version in Labels --- konflux.Dockerfile | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/konflux.Dockerfile b/konflux.Dockerfile index 19db7dc..34b6400 100644 --- a/konflux.Dockerfile +++ b/konflux.Dockerfile @@ -58,6 +58,9 @@ RUN dnf install -y \ # Stage 4: Runtime - Minimal runtime image FROM ubi-micro-base +# Build arguments for labels +ARG VERSION=dev + # Define labels LABEL \ com.redhat.component="agentic-cluster-security-suite-acs-mcp-server-container" \ @@ -69,8 +72,9 @@ LABEL \ maintainer="Red Hat, Inc." \ name="agentic-cluster-security-suite-tech-preview/acs-mcp-server-rhel9" \ source-location="https://github.com/stackrox/stackrox-mcp" \ - summary="The ACS MCP Server" \ - version="${VERSION}" + summary="The ACS MCP Server" \ + version="${VERSION}" \ + release="1" # Set default environment variables ENV LOG_LEVEL=INFO From 721ced831d274be9af01dafb79ba8d393a246b02 Mon Sep 17 00:00:00 2001 From: Mladen Todorovic Date: Wed, 22 Jul 2026 10:35:35 +0200 Subject: [PATCH 3/6] Add correct CPE --- .tekton/acs-mcp-server-pull-request.yaml | 4 ++++ .tekton/acs-mcp-server-push.yaml | 4 ++++ 2 files changed, 8 insertions(+) diff --git a/.tekton/acs-mcp-server-pull-request.yaml b/.tekton/acs-mcp-server-pull-request.yaml index 7b4771b..b557c33 100644 --- a/.tekton/acs-mcp-server-pull-request.yaml +++ b/.tekton/acs-mcp-server-pull-request.yaml @@ -54,6 +54,10 @@ spec: value: '0' - name: clone-fetch-tags value: 'true' + - name: extra-labels + value: + # X.Y in the cpe label must be adjusted for every version stream. + - "cpe=cpe:/a:redhat:agentic_cluster_security_suite:0.2::el9" pipelineRef: name: basic-component-pipeline diff --git a/.tekton/acs-mcp-server-push.yaml b/.tekton/acs-mcp-server-push.yaml index c60de21..381c030 100644 --- a/.tekton/acs-mcp-server-push.yaml +++ b/.tekton/acs-mcp-server-push.yaml @@ -68,6 +68,10 @@ spec: - linux/arm64 - linux/ppc64le - linux/s390x + - name: extra-labels + value: + # X.Y in the cpe label must be adjusted for every version stream. + - "cpe=cpe:/a:redhat:agentic_cluster_security_suite:0.2::el9" pipelineRef: name: basic-component-pipeline From 460cddd5863d423cafb3bd0e4a97b975e61520e7 Mon Sep 17 00:00:00 2001 From: Mladen Todorovic Date: Wed, 22 Jul 2026 12:40:31 +0200 Subject: [PATCH 4/6] Fix version --- .tekton/basic-component-pipeline.yaml | 40 +++++++++++++++++++++++++++ konflux.Dockerfile | 2 +- 2 files changed, 41 insertions(+), 1 deletion(-) diff --git a/.tekton/basic-component-pipeline.yaml b/.tekton/basic-component-pipeline.yaml index 0145162..7ffeb88 100644 --- a/.tekton/basic-component-pipeline.yaml +++ b/.tekton/basic-component-pipeline.yaml @@ -158,6 +158,44 @@ spec: workspaces: - name: basic-auth workspace: git-auth + + - name: determine-version + params: + - name: SOURCE_ARTIFACT + value: $(tasks.clone-repository.results.SOURCE_ARTIFACT) + runAfter: + - clone-repository + taskSpec: + params: + - name: SOURCE_ARTIFACT + type: string + results: + - name: VERSION + description: Version string derived from git tags. + volumes: + - name: workdir + emptyDir: {} + stepTemplate: + volumeMounts: + - mountPath: /var/workdir + name: workdir + steps: + - name: use-trusted-artifact + image: quay.io/redhat-appstudio/build-trusted-artifacts:latest@sha256:9b180776a41d9a22a1c51539f1647c60defbbd55b44bbebdd4130e33512d8b0d + args: + - use + - $(params.SOURCE_ARTIFACT)=/var/workdir/source + - name: determine-version + image: registry.access.redhat.com/ubi9/ubi-minimal:latest@sha256:2e8edce823a48e51858f1fad3ff4cbf6875ce8a3f86b9eecf298bc2050c8652a + workingDir: /var/workdir/source + script: | + #!/usr/bin/env bash + set -euo pipefail + microdnf install -y git-core + VERSION=$(git describe --tags --always 2>/dev/null || echo "dev") + echo "Determined version: ${VERSION}" >&2 + echo -n "${VERSION}" | tee "$(results.VERSION.path)" + - name: prefetch-dependencies params: - name: input @@ -210,6 +248,7 @@ spec: value: $(tasks.clone-repository.results.commit) - name: BUILD_ARGS value: + - VERSION=$(tasks.determine-version.results.VERSION) - $(params.build-args[*]) - name: BUILD_ARGS_FILE value: $(params.build-args-file) @@ -469,6 +508,7 @@ spec: value: $(tasks.clone-repository.results.commit) - name: BUILD_ARGS value: + - VERSION=$(tasks.determine-version.results.VERSION) - $(params.build-args[*]) - name: BUILD_ARGS_FILE value: $(params.build-args-file) diff --git a/konflux.Dockerfile b/konflux.Dockerfile index 34b6400..1af16c7 100644 --- a/konflux.Dockerfile +++ b/konflux.Dockerfile @@ -74,7 +74,7 @@ LABEL \ source-location="https://github.com/stackrox/stackrox-mcp" \ summary="The ACS MCP Server" \ version="${VERSION}" \ - release="1" + release="${VERSION}" # Set default environment variables ENV LOG_LEVEL=INFO From 876db120c7f7002b33fd7c09776c6b866729b282 Mon Sep 17 00:00:00 2001 From: Mladen Todorovic Date: Wed, 22 Jul 2026 15:06:44 +0200 Subject: [PATCH 5/6] Review comments --- .tekton/basic-component-pipeline.yaml | 22 +++++++++++++++++----- konflux.Dockerfile | 2 +- 2 files changed, 18 insertions(+), 6 deletions(-) diff --git a/.tekton/basic-component-pipeline.yaml b/.tekton/basic-component-pipeline.yaml index 7ffeb88..df3a9d5 100644 --- a/.tekton/basic-component-pipeline.yaml +++ b/.tekton/basic-component-pipeline.yaml @@ -169,6 +169,12 @@ spec: params: - name: SOURCE_ARTIFACT type: string + - name: TRUSTED_ARTIFACT_IMAGE + type: string + default: "quay.io/redhat-appstudio/build-trusted-artifacts:latest@sha256:9b180776a41d9a22a1c51539f1647c60defbbd55b44bbebdd4130e33512d8b0d" + - name: UBI_MINIMAL_IMAGE + type: string + default: "registry.access.redhat.com/ubi9/ubi-minimal:latest@sha256:2e8edce823a48e51858f1fad3ff4cbf6875ce8a3f86b9eecf298bc2050c8652a" results: - name: VERSION description: Version string derived from git tags. @@ -179,20 +185,26 @@ spec: volumeMounts: - mountPath: /var/workdir name: workdir + computeResources: + requests: + cpu: 100m + memory: 256Mi + limits: + memory: 512Mi steps: - name: use-trusted-artifact - image: quay.io/redhat-appstudio/build-trusted-artifacts:latest@sha256:9b180776a41d9a22a1c51539f1647c60defbbd55b44bbebdd4130e33512d8b0d + image: $(params.TRUSTED_ARTIFACT_IMAGE) args: - use - $(params.SOURCE_ARTIFACT)=/var/workdir/source - name: determine-version - image: registry.access.redhat.com/ubi9/ubi-minimal:latest@sha256:2e8edce823a48e51858f1fad3ff4cbf6875ce8a3f86b9eecf298bc2050c8652a + image: $(params.UBI_MINIMAL_IMAGE) workingDir: /var/workdir/source script: | #!/usr/bin/env bash set -euo pipefail microdnf install -y git-core - VERSION=$(git describe --tags --always 2>/dev/null || echo "dev") + VERSION=$(git describe --tags --always) echo "Determined version: ${VERSION}" >&2 echo -n "${VERSION}" | tee "$(results.VERSION.path)" @@ -248,8 +260,8 @@ spec: value: $(tasks.clone-repository.results.commit) - name: BUILD_ARGS value: - - VERSION=$(tasks.determine-version.results.VERSION) - $(params.build-args[*]) + - VERSION=$(tasks.determine-version.results.VERSION) - name: BUILD_ARGS_FILE value: $(params.build-args-file) - name: PRIVILEGED_NESTED @@ -508,8 +520,8 @@ spec: value: $(tasks.clone-repository.results.commit) - name: BUILD_ARGS value: - - VERSION=$(tasks.determine-version.results.VERSION) - $(params.build-args[*]) + - VERSION=$(tasks.determine-version.results.VERSION) - name: BUILD_ARGS_FILE value: $(params.build-args-file) - name: SOURCE_ARTIFACT diff --git a/konflux.Dockerfile b/konflux.Dockerfile index 1af16c7..a4aa7c7 100644 --- a/konflux.Dockerfile +++ b/konflux.Dockerfile @@ -72,7 +72,7 @@ LABEL \ maintainer="Red Hat, Inc." \ name="agentic-cluster-security-suite-tech-preview/acs-mcp-server-rhel9" \ source-location="https://github.com/stackrox/stackrox-mcp" \ - summary="The ACS MCP Server" \ + summary="The ACS MCP Server" \ version="${VERSION}" \ release="${VERSION}" From d078e6df848671654bc42082627efa04b24f3ee9 Mon Sep 17 00:00:00 2001 From: Mladen Todorovic Date: Wed, 22 Jul 2026 17:40:57 +0200 Subject: [PATCH 6/6] Fix release label --- .tekton/basic-component-pipeline.yaml | 21 ++++++++++++++++++++- konflux.Dockerfile | 2 +- 2 files changed, 21 insertions(+), 2 deletions(-) diff --git a/.tekton/basic-component-pipeline.yaml b/.tekton/basic-component-pipeline.yaml index df3a9d5..9a88520 100644 --- a/.tekton/basic-component-pipeline.yaml +++ b/.tekton/basic-component-pipeline.yaml @@ -208,6 +208,23 @@ spec: echo "Determined version: ${VERSION}" >&2 echo -n "${VERSION}" | tee "$(results.VERSION.path)" + - name: generate-labels + params: + - name: label-templates + value: + - release=$ACTUAL_DATE_EPOCH + runAfter: + - clone-repository + taskRef: + params: + - name: name + value: generate-labels + - name: bundle + value: quay.io/konflux-ci/tekton-catalog/task-generate-labels:0.1@sha256:d4ae1177fc2df0c07089bc30406ce75761cb7de21f361b254bf4dce8a5537e48 + - name: kind + value: task + resolver: bundles + - name: prefetch-dependencies params: - name: input @@ -271,7 +288,9 @@ spec: - name: BUILDAH_FORMAT value: $(params.buildah-format) - name: LABELS - value: ["$(params.extra-labels[*])"] + value: + - $(tasks.generate-labels.results.labels[*]) + - $(params.extra-labels[*]) - name: BUILD_TIMESTAMP value: "$(tasks.clone-repository.results.commit-timestamp)" - name: IMAGE_APPEND_PLATFORM diff --git a/konflux.Dockerfile b/konflux.Dockerfile index a4aa7c7..6502609 100644 --- a/konflux.Dockerfile +++ b/konflux.Dockerfile @@ -74,7 +74,7 @@ LABEL \ source-location="https://github.com/stackrox/stackrox-mcp" \ summary="The ACS MCP Server" \ version="${VERSION}" \ - release="${VERSION}" + release="1" # Set default environment variables ENV LOG_LEVEL=INFO