feat(operator): migrate operator container build to UBI10/RHEL10 (RHIDP-14882)

[polasudo]

Summary

• Migrate builder/runtime base images from UBI9 to UBI10
• Update RPM lockfile for el10 openssl
• Point bundle/CSV/kustomize image refs to quay.io/rhdh/rhdh-rhel10-operator
• Update tekton plugin-deps helper images to ubi10-minimal
• Migrate Konflux downstream .rhdh/docker/bundle.Dockerfile to UBI10

Jira

• RHIDP-14882
• Epic: RHIDP-8114

Test plan

• Konflux/container CI green
• make bundle validates
• Operator install smoke on OCP test cluster (documented in PR comments)
• Rebased on latest main (Aug 25, 2026)

[polasudo]

Pushed a follow-up commit: .rhdh/docker/Dockerfile (the file Konflux/Cachi2 builds actually use, per its own header comment) and .rhdh/docker/bundle.Dockerfile were still pinned to UBI9 — only the root Dockerfile had been migrated. Both now point at the same UBI10 digests as root Dockerfile; validated with hack/validate-image-digests.sh (both are proper multi-arch manifest lists).

Two things worth double-checking before merge, outside what I can validate locally:

• rpms.lock.yaml I do have a mac and I dont know if it was generated correctly

[polasudo]

Cluster smoke test (RHIDP-14882)

Tested on OCP

Image build (local)

• make image-build with UBI10 Dockerfile succeeded (linux/amd64)
• Runtime base: RHEL 10.2 (Coughlan) — verified via /etc/os-release
• openssl installs cleanly on ubi10-minimal runtime stage

Cluster deploy

• Built image pushed to cluster registry
• make install deploy (PROFILE=rhdh, OPERATOR_DP_PROCESSING=false)
• Operator pod Running — manager acquired leader lease, controllers started

Reconciliation

• Applied minimal Backstage CR (smoke-test in rhdh-operator ns)
• Operator created Deployment, StatefulSet (PostgreSQL), Services, Route, ConfigMaps, Secrets
• PostgreSQL pod Running; Backstage deployment progressing (image pull in progress)

Notes

• Direct deploy used for smoke test validates operator on UBI10/RHEL10 runtime.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 65.31%. Comparing base (22ee1d4) to head (7b74512).
⚠️ Report is 3 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #3368      +/-   ##
==========================================
+ Coverage   63.97%   65.31%   +1.33%     
==========================================
  Files          38       38              
  Lines        2365     2465     +100     
==========================================
+ Hits         1513     1610      +97     
- Misses        702      705       +3     
  Partials      150      150              

Flag	Coverage Δ
nightly	?
unittests	65.31% <ø> (+1.33%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.
see 1 file with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.