Unable to create derived image from Gateway image 11.1.1_20240806

Products

• CA API Gateway

Issue/Introduction

The creating of a custom dirived image from the latest gateway  11.1.1_20240806 image fails with 

Downloading metadata...
error: cannot update repo 'ubi-9-baseos-rpms': Cannot download repomd.xml: Cannot download repodata/repomd.xml: All mirrors were tried; Last error: Status code: 403 for https://<Broadcom internal repository >/gateway-redhat-ubi-rpm/dist/ubi9/9/x86_64/baseos/os/repodata/repomd.xml (IP:xxx.xxx.xxx.xxx)
The command '/bin/sh -c microdnf install -y findutils' returned a non-zero code: 1

Cause

Starting with this  release the image was build pointing only to the Broadcom internal repository used to create the image for security reasons.

Customers adding any extra packages to the OVA/Container , bring security issues and customers themselves are liable for legal and security aspects of it.

Resolution

When customers wants to build their own images despite the security risk on top of the default gateway image, they can prepare a repo with public accessed urls and copy it the target using COPY command in the Dockerfile. After that, yum installation should be picking up the repo details from the installed file .

Customers can maintain their own public repo and get access to the public urls or use the public resources below 

The following is a sample Dockerfile file & repo files for reference:

FROM caapim/gateway:11.1.00_20240730

WORKDIR /R_setup

USER root

COPY ubi.repo /etc/yum.repos.d/ubi.repo

RUN microdnf --disablerepo=* --enablerepo=ubi-9-appstream-rpms --enablerepo=ubi-9-baseos-rpms -y install yum

CMD ["bash"]

Contents for the used repo file ubi.repo pointing to public repo for UBI

[ubi-9-baseos-rpms]
name = Red Hat Universal Base Image 9 (RPMs) - BaseOS
baseurl = https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/$basearch/baseos/os
enabled = 1
gpgkey = file:///etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release
gpgcheck = 1

[ubi-9-baseos-debug-rpms]
name = Red Hat Universal Base Image 9 (Debug RPMs) - BaseOS
baseurl = https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/$basearch/baseos/debug
enabled = 0
gpgkey = file:///etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release
gpgcheck = 1

[ubi-9-baseos-source]
name = Red Hat Universal Base Image 9 (Source RPMs) - BaseOS
baseurl = https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/$basearch/baseos/source/SRPMS
enabled = 0
gpgkey = file:///etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release
gpgcheck = 1

[ubi-9-appstream-rpms]
name = Red Hat Universal Base Image 9 (RPMs) - AppStream
baseurl = https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/$basearch/appstream/os
enabled = 1
gpgkey = file:///etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release
gpgcheck = 1

[ubi-9-appstream-debug-rpms]
name = Red Hat Universal Base Image 9 (Debug RPMs) - AppStream
baseurl = https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/$basearch/appstream/debug
enabled = 0
gpgkey = file:///etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release
gpgcheck = 1

[ubi-9-appstream-source]
name = Red Hat Universal Base Image 9 (Source RPMs) - AppStream
baseurl = https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/$basearch/appstream/source/SRPMS
enabled = 0
gpgkey = file:///etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release
gpgcheck = 1

[ubi-9-codeready-builder-rpms]
name = Red Hat Universal Base Image 9 (RPMs) - CodeReady Builder
baseurl = https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/$basearch/codeready-builder/os
enabled = 0
gpgkey = file:///etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release
gpgcheck = 1

[ubi-9-codeready-builder]
name = Red Hat Universal Base Image 9 (RPMs) - CodeReady Builder
baseurl = https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/$basearch/codeready-builder/os
enabled = 1
gpgkey = file:///etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release
gpgcheck = 1

[ubi-9-codeready-builder-debug-rpms]
name = Red Hat Universal Base Image 9 (Debug RPMs) - CodeReady Builder
baseurl = https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/$basearch/codeready-builder/debug
enabled = 0
gpgkey = file:///etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release
gpgcheck = 1

[ubi-9-codeready-builder-source]
name = Red Hat Universal Base Image 9 (Source RPMs) - CodeReady Builder
baseurl = https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/$basearch/codeready-builder/source/SRPMS
enabled = 0
gpgkey = file:///etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release
gpgcheck = 1