Make FIPS image locally buildable

fips.Dockerfile

@@ -1,6 +1,4 @@
-# check=skip=RedundantTargetPlatform
-# setup build image
-FROM --platform=$TARGETPLATFORM mcr.microsoft.com/oss/go/microsoft/golang:1.24.2-fips-bullseye@sha256:28ab4742d3b5feb0b3c7450629b4e105128d8709dd6ca22898472ab302140c37 AS operator-build
+FROM mcr.microsoft.com/oss/go/microsoft/golang:1.24.2-fips-bookworm@sha256:28ab4742d3b5feb0b3c7450629b4e105128d8709dd6ca22898472ab302140c37 AS operator-build
 
 ENV GOEXPERIMENT=systemcrypto
 
@@ -19,18 +17,15 @@ COPY cmd ./cmd
 
 ARG GO_LINKER_ARGS
 ARG GO_BUILD_TAGS
-ARG TARGETARCH
-ARG TARGETOS
 
 RUN --mount=type=cache,target="/root/.cache/go-build" \
-    --mount=type=cache,target="/go/pkg" \
-    CGO_ENABLED=1 GOFIPS=1 GOOS=$TARGETOS GOARCH=$TARGETARCH \
+    CGO_ENABLED=1 GOFIPS=1 \
     go build -tags "${GO_BUILD_TAGS}" -trimpath -ldflags="${GO_LINKER_ARGS}" \
     -o ./build/_output/bin/dynatrace-operator ./cmd/
 
 # platform is required, otherwise the copy command will copy the wrong architecture files, don't trust GitHub Actions linting warnings
-FROM --platform=$TARGETPLATFORM registry.access.redhat.com/ubi9-micro:9.5-1746002938@sha256:839f16991579b023d4452eadd0efa925e438f8b73063afe4f75bdc6cf7a09b12 AS base
-FROM --platform=$TARGETPLATFORM registry.access.redhat.com/ubi9:9.5-1745854298@sha256:f4ebd46d3ba96feb016d798009e1cc2404c3a4ebdac8b2479a2ac053e59f41b4 AS dependency
+FROM registry.access.redhat.com/ubi9-micro:9.5-1746002938@sha256:839f16991579b023d4452eadd0efa925e438f8b73063afe4f75bdc6cf7a09b12 AS base
+FROM registry.access.redhat.com/ubi9:9.5-1745854298@sha256:f4ebd46d3ba96feb016d798009e1cc2404c3a4ebdac8b2479a2ac053e59f41b4 AS dependency
 RUN mkdir -p /tmp/rootfs-dependency
 COPY --from=base / /tmp/rootfs-dependency
 RUN dnf install --installroot /tmp/rootfs-dependency \
@@ -71,7 +66,7 @@ RUN if [ "$TARGETPLATFORM" = "linux/amd64" ]; then \
 RUN make DESTDIR=/tmp/rootfs-dependency install_sw install_ssldirs install_fips
 
 # platform is required, otherwise the copy command will copy the wrong architecture files, don't trust GitHub Actions linting warnings
-FROM --platform=$TARGETPLATFORM base
+FROM base
 
 ARG TARGETPLATFORM
 

hack/build/build_image.sh

@@ -1,5 +1,7 @@
 #!/bin/bash
 
+set -x
+
 if [[ ! "${1}" ]]; then
   echo "first param is not set, should be the image without the tag"
   exit 1
@@ -12,6 +14,8 @@ fi
 image=${1}
 tag=${2}
 debug=${3:-false}
+dockerfile=${4:-Dockerfile}
+
 
 commit=$(git rev-parse HEAD)
 go_linker_args=$(hack/build/create_go_linker_args.sh "${tag}" "${commit}" "${debug}")
@@ -35,7 +39,7 @@ if [ -n "${OPERATOR_DEV_BUILD_PLATFORM}" ]; then
   OPERATOR_BUILD_PLATFORM="--platform=${OPERATOR_DEV_BUILD_PLATFORM}"
 fi
 
-${CONTAINER_CMD} build "${OPERATOR_BUILD_PLATFORM}" . -f ./Dockerfile -t "${out_image}" \
+${CONTAINER_CMD} build "${OPERATOR_BUILD_PLATFORM}" . -f ${dockerfile} -t "${out_image}" \
   --build-arg "GO_LINKER_ARGS=${go_linker_args}" \
   --build-arg "GO_BUILD_TAGS=${go_build_tags}" \
   --build-arg "DEBUG_TOOLS=${debug}" \

hack/make/images.mk

@@ -28,6 +28,12 @@ endif
 images/build: ensure-tag-not-snapshot
 	./hack/build/build_image.sh "${IMAGE}" "${TAG}" "${DEBUG}"
 
+## Build an Operator FIPS image with a give IMAGE and TAG
+# because cross-compile takes ~1h, we want to build fips locally only for local architecture
+# so that's why we run it with no_platform=true to build image without platform and fallback decision to podman
+images/build/fips: ensure-tag-not-snapshot
+	./hack/build/build_image.sh "${IMAGE}" "${TAG}-fips" "${DEBUG}" "fips.Dockerfile" "true"
+
 ## Pushes an ALREADY BUILT Operator image with a given IMAGE and TAG
 images/push: ensure-tag-not-snapshot
 	./hack/build/push_image.sh "${IMAGE}" "${TAG}"