CM-1106: Add CI Dockerfiles for istio-csr and trust-manager operands

Adds istiocsr.Dockerfile and trustmanager.Dockerfile to images/ci/
for building operand images in OpenShift CI. These Dockerfiles follow
the same pattern as operand.Dockerfile, cloning from the openshift/
fork repos at the version currently shipped by master.

- istiocsr.Dockerfile: builds from openshift/cert-manager-istio-csr v0.16.0
- trustmanager.Dockerfile: builds from openshift/cert-manager-trust-manager v0.20.3

Required for the openshift/release master CI config to build and inject
these operand images in e2e tests.

Signed-off-by: Mytreya Kasturi <mykastur@redhat.com>
Co-authored-by: Cursor <cursoragent@cursor.com>

Author: mytreya-rh

images/ci/operand.Dockerfile images/ci/certmanager.Dockerfileimages/ci/operand.Dockerfile renamed to images/ci/certmanager.Dockerfile

@@ -33,7 +33,7 @@ RUN go mod vendor
 RUN go build -mod=vendor -tags $GO_BUILD_TAGS -o /app/_output/webhook main.go
 
 
-FROM registry.access.redhat.com/ubi9-minimal:9.4
+FROM registry.access.redhat.com/ubi9-minimal:latest
 
 COPY --from=builder /app/_output/acmesolver /app/cmd/acmesolver/acmesolver
 COPY --from=builder /app/_output/cainjector /app/cmd/cainjector/cainjector

images/ci/istiocsr.Dockerfile

@@ -0,0 +1,19 @@
+FROM registry.ci.openshift.org/ocp/builder:rhel-9-golang-1.25-openshift-4.21 AS builder
+
+ARG RELEASE_BRANCH=v0.16.0
+
+ARG GO_BUILD_TAGS=strictfipsruntime,openssl
+ENV GOEXPERIMENT strictfipsruntime
+ENV CGO_ENABLED 1
+
+RUN mkdir -p /go/src/github.com/cert-manager
+RUN git clone --depth 1 --branch $RELEASE_BRANCH https://github.com/openshift/cert-manager-istio-csr.git /go/src/github.com/cert-manager/istio-csr
+WORKDIR /go/src/github.com/cert-manager/istio-csr
+
+RUN go mod vendor
+RUN go build -mod=vendor -tags $GO_BUILD_TAGS -ldflags '-w -s' -o /app/cert-manager-istio-csr ./cmd
+
+FROM registry.access.redhat.com/ubi9-minimal:latest
+COPY --from=builder /app/cert-manager-istio-csr /usr/local/bin/cert-manager-istio-csr
+USER 65532:65532
+ENTRYPOINT ["/usr/local/bin/cert-manager-istio-csr"]

images/ci/trustmanager.Dockerfile

@@ -0,0 +1,19 @@
+FROM registry.ci.openshift.org/ocp/builder:rhel-9-golang-1.25-openshift-4.21 AS builder
+
+ARG RELEASE_BRANCH=v0.20.3
+
+ARG GO_BUILD_TAGS=strictfipsruntime,openssl
+ENV GOEXPERIMENT strictfipsruntime
+ENV CGO_ENABLED 1
+
+RUN mkdir -p /go/src/github.com/cert-manager
+RUN git clone --depth 1 --branch $RELEASE_BRANCH https://github.com/openshift/cert-manager-trust-manager.git /go/src/github.com/cert-manager/trust-manager
+WORKDIR /go/src/github.com/cert-manager/trust-manager
+
+RUN go mod vendor
+RUN go build -mod=vendor -tags $GO_BUILD_TAGS -ldflags '-w -s' -o /app/cert-manager-trust-manager ./cmd/trust-manager
+
+FROM registry.access.redhat.com/ubi9-minimal:latest
+COPY --from=builder /app/cert-manager-trust-manager /usr/local/bin/cert-manager-trust-manager
+USER 65532:65532
+ENTRYPOINT ["/usr/local/bin/cert-manager-trust-manager"]