HYPERFLEET-730 - fix: copy CA certificates from builder to ubi9-micro runtime

[xueli181114]

Summary

• Copy CA trust bundle from builder stage to ubi9-micro runtime image
• Fixes TLS failures (x509: certificate signed by unknown authority) when connecting to external services (e.g. Google Pub/Sub)
• ubi9-micro is extremely minimal and doesn't include CA certificates; Go static binaries (CGO_ENABLED=0) need system CA certs for TLS verification

Test plan

• CI passes

Fixes: HYPERFLEET-730

Summary by CodeRabbit

• Bug Fixes
  • Fixed missing TLS certificates in the runtime environment to enable secure connections for services requiring certificate validation.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: af9efa41-47eb-4c3e-9ed1-87efc33110ec

📥 Commits

Reviewing files that changed from the base of the PR and between 43a4f86 and d523134.

📒 Files selected for processing (1)

• Dockerfile

---

Walkthrough

The change modifies the Dockerfile to copy the CA bundle from the builder stage into the final runtime image. Specifically, it adds a COPY --from=builder instruction to transfer /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem from the builder stage to the same path in the final image. This ensures CA certificates are available in the ubi9-micro-based runtime environment, enabling TLS connectivity for services.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~8 minutes

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately describes the main change: copying CA certificates from builder to ubi9-micro runtime to fix TLS issues. It is specific, concise, and directly summarizes the primary changeset.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[ciaranRoche]

/lgtm

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: ciaranRoche

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [ciaranRoche]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment