feat(cd): build rhel-9 RPM packages and Docker images (Kong#11190)

KAG-1969

.github/matrix-full.yml

@@ -56,6 +56,12 @@ build-packages:
   package: rpm
   package-type: el8
   check-manifest-suite: el8-amd64
+- label: rhel-9
+  os: ubuntu-22.04
+  image: rockylinux:9
+  package: rpm
+  package-type: el9
+  check-manifest-suite: el9-amd64
 
 # Amazon Linux
 - label: amazonlinux-2
@@ -97,9 +103,10 @@ build-images:
 
 # RHEL
 - label: rhel
-  base-image: registry.access.redhat.com/ubi8
+  base-image: registry.access.redhat.com/ubi9
   package: rpm
-  artifact-from: rhel-8
+  rpm_platform: el9
+  artifact-from: rhel-9
 
 smoke-tests:
 - label: ubuntu
@@ -167,6 +174,12 @@ release-packages:
   artifact-version: 8
   artifact-type: rhel
   artifact: kong.el8.amd64.rpm
+- label: rhel-9
+  package: rpm
+  artifact-from: rhel-9
+  artifact-version: 9
+  artifact-type: rhel
+  artifact: kong.el9.amd64.rpm
 
 # Amazon Linux
 - label: amazonlinux-2

.github/workflows/release.yml

@@ -208,6 +208,7 @@ jobs:
       run: |
         yum groupinstall -y 'Development Tools'
         dnf config-manager --set-enabled powertools || true # enable devel packages on rockylinux:8
+        dnf config-manager --set-enabled crb || true # enable devel packages on rockylinux:9
         yum install -y libyaml-devel
         yum install -y cpanminus || (yum install -y perl && curl -L https://raw.githubusercontent.com/miyagawa/cpanminus/master/cpanm | perl - App::cpanminus) # amazonlinux2023 removed cpanminus
         # required for openssl 3.x config
@@ -349,7 +350,7 @@ jobs:
       run: |
         rpm_platform="${{ matrix.rpm_platform }}"
         if [[ -z "$rpm_platform" ]]; then
-          rpm_platform="el8"
+          rpm_platform="el9"
         fi
 
         echo "rpm_platform=$rpm_platform"

BUILD.bazel

@@ -49,6 +49,15 @@ nfpm_pkg(
     visibility = ["//visibility:public"],
 )
 
+nfpm_pkg(
+    name = "kong_el9",
+    config = "//build:package/nfpm.yaml",
+    env = nfpm_env,
+    packager = "rpm",
+    pkg_name = "kong.el9",
+    visibility = ["//visibility:public"],
+)
+
 nfpm_pkg(
     name = "kong_el8",
     config = "//build:package/nfpm.yaml",

scripts/explain_manifest/config.py

@@ -77,6 +77,15 @@ def transform(f: FileInfo):
         libcxx_max_version="3.4.25",
         cxxabi_max_version="1.3.11",
     ),
+    "el9-amd64": ExpectSuite(
+        name="Redhat 9 (amd64)",
+        manifest="fixtures/el9-amd64.txt",
+        use_rpath=True,
+        libc_max_version="2.34",
+        # gcc 11.3.1
+        libcxx_max_version="3.4.29",
+        cxxabi_max_version="1.3.13",
+    ),
     "ubuntu-20.04-amd64": ExpectSuite(
         name="Ubuntu 20.04 (amd64)",
         manifest="fixtures/ubuntu-20.04-amd64.txt",

scripts/explain_manifest/fixtures/el9-amd64.txt

@@ -0,0 +1,166 @@
+- Path      : /usr/local/kong/include/google
+  Type      : directory
+
+- Path      : /usr/local/kong/include/kong
+  Type      : directory
+
+- Path      : /usr/local/kong/lib/engines-3/afalg.so
+  Needed    :
+  - libstdc++.so.6
+  - libm.so.6
+  - libcrypto.so.3
+  - libc.so.6
+  Runpath   : /usr/local/kong/lib
+
+- Path      : /usr/local/kong/lib/engines-3/capi.so
+  Needed    :
+  - libstdc++.so.6
+  - libm.so.6
+  - libcrypto.so.3
+  - libc.so.6
+  Runpath   : /usr/local/kong/lib
+
+- Path      : /usr/local/kong/lib/engines-3/loader_attic.so
+  Needed    :
+  - libstdc++.so.6
+  - libm.so.6
+  - libcrypto.so.3
+  - libc.so.6
+  Runpath   : /usr/local/kong/lib
+
+- Path      : /usr/local/kong/lib/engines-3/padlock.so
+  Needed    :
+  - libstdc++.so.6
+  - libm.so.6
+  - libcrypto.so.3
+  - libc.so.6
+  Runpath   : /usr/local/kong/lib
+
+- Path      : /usr/local/kong/lib/libcrypto.so.3
+  Needed    :
+  - libstdc++.so.6
+  - libm.so.6
+  - libc.so.6
+  Runpath   : /usr/local/kong/lib
+
+- Path      : /usr/local/kong/lib/libssl.so.3
+  Needed    :
+  - libstdc++.so.6
+  - libm.so.6
+  - libcrypto.so.3
+  - libc.so.6
+  Runpath   : /usr/local/kong/lib
+
+- Path      : /usr/local/kong/lib/ossl-modules/legacy.so
+  Needed    :
+  - libstdc++.so.6
+  - libm.so.6
+  - libcrypto.so.3
+  - libc.so.6
+  Runpath   : /usr/local/kong/lib
+
+- Path      : /usr/local/lib/lua/5.1/lfs.so
+  Needed    :
+  - libc.so.6
+  Rpath     : /usr/local/kong/lib
+
+- Path      : /usr/local/lib/lua/5.1/lpeg.so
+  Needed    :
+  - libc.so.6
+  Rpath     : /usr/local/kong/lib
+
+- Path      : /usr/local/lib/lua/5.1/lsyslog.so
+  Needed    :
+  - libc.so.6
+  Rpath     : /usr/local/kong/lib
+
+- Path      : /usr/local/lib/lua/5.1/lua_pack.so
+  Needed    :
+  - libc.so.6
+  Rpath     : /usr/local/kong/lib
+
+- Path      : /usr/local/lib/lua/5.1/lua_system_constants.so
+  Needed    :
+  - libc.so.6
+  Rpath     : /usr/local/kong/lib
+
+- Path      : /usr/local/lib/lua/5.1/mime/core.so
+  Needed    :
+  - libc.so.6
+  Rpath     : /usr/local/kong/lib
+
+- Path      : /usr/local/lib/lua/5.1/pb.so
+  Needed    :
+  - libc.so.6
+  Rpath     : /usr/local/kong/lib
+
+- Path      : /usr/local/lib/lua/5.1/socket/core.so
+  Needed    :
+  - libc.so.6
+  Rpath     : /usr/local/kong/lib
+
+- Path      : /usr/local/lib/lua/5.1/socket/serial.so
+  Needed    :
+  - libc.so.6
+  Rpath     : /usr/local/kong/lib
+
+- Path      : /usr/local/lib/lua/5.1/socket/unix.so
+  Needed    :
+  - libc.so.6
+  Rpath     : /usr/local/kong/lib
+
+- Path      : /usr/local/lib/lua/5.1/ssl.so
+  Needed    :
+  - libssl.so.3
+  - libcrypto.so.3
+  - libc.so.6
+  Rpath     : /usr/local/kong/lib
+
+- Path      : /usr/local/lib/lua/5.1/yaml.so
+  Needed    :
+  - libyaml-0.so.2
+  - libc.so.6
+
+- Path      : /usr/local/openresty/lualib/cjson.so
+  Needed    :
+  - libc.so.6
+
+- Path      : /usr/local/openresty/lualib/libatc_router.so
+  Needed    :
+  - libgcc_s.so.1
+  - libm.so.6
+  - libc.so.6
+  - ld-linux-x86-64.so.2
+  - libstdc++.so.6
+
+- Path      : /usr/local/openresty/lualib/librestysignal.so
+  Needed    :
+  - libc.so.6
+
+- Path      : /usr/local/openresty/lualib/rds/parser.so
+  Needed    :
+  - libc.so.6
+
+- Path      : /usr/local/openresty/lualib/redis/parser.so
+  Needed    :
+  - libc.so.6
+
+- Path      : /usr/local/openresty/nginx/sbin/nginx
+  Needed    :
+  - libcrypt.so.2
+  - libluajit-5.1.so.2
+  - libm.so.6
+  - libssl.so.3
+  - libcrypto.so.3
+  - libz.so.1
+  - libc.so.6
+  Rpath     : /usr/local/openresty/luajit/lib:/usr/local/kong/lib
+  Modules   :
+  - lua-kong-nginx-module
+  - lua-kong-nginx-module/stream
+  - lua-resty-events
+  - lua-resty-lmdb
+  OpenSSL   : OpenSSL 3.1.1 30 May 2023
+  DWARF     : True
+  DWARF - ngx_http_request_t related DWARF DIEs: True
+