UPSTREAM: <carry>: Update release/helm and e2e-helm to use UBI10/RHEL10

- release/helm/Dockerfile: replace OCP CI RHEL9 builder and base-rhel9
  runtime with registry.redhat.io/ubi10/go-toolset:10.1 (builder) and
  registry.redhat.io/ubi10:10.1 (runtime)
- ci/tests/e2e-helm.sh: update metrics curl pod image from
  ubi9/ubi-minimal:latest to ubi10/ubi-minimal:latest

Made-with: Cursor

Author: PillaiManish

.work/compliance/rhcos10/PR2-ubi10-migration.md

@@ -44,17 +44,40 @@ registry.access.redhat.com  →  registry.redhat.io
 | `ci/dockerfiles/go-e2e.Dockerfile` | `registry.access.redhat.com/ubi9/ubi-minimal:latest` | `registry.redhat.io/ubi10/ubi-minimal:latest` |
 | `ci/dockerfiles/scorecard-proxy.Dockerfile` | `registry.access.redhat.com/ubi9/ubi-minimal:latest` | `registry.redhat.io/ubi10/ubi-minimal:latest` |
 
+### OCP product image (release/helm/Dockerfile)
+
+Previously used OCP CI registry images pinned to RHEL9. Replaced with publicly available Red Hat registry images:
+
+| Stage | Before | After |
+|---|---|---|
+| Builder | `registry.ci.openshift.org/ocp/builder:rhel-9-golang-1.24-openshift-4.22` | `registry.redhat.io/ubi10/go-toolset:10.1` |
+| Runtime | `registry.ci.openshift.org/ocp/4.22:base-rhel9` | `registry.redhat.io/ubi10:10.1` |
+
+### E2E test curl pod (ci/tests/e2e-helm.sh)
+
+The metrics verification step spins up a temporary `kubectl run` pod using a UBI image to curl the metrics endpoint. Updated from UBI9 to UBI10:
+
+```
+registry.access.redhat.com/ubi9/ubi-minimal:latest
+→
+registry.redhat.io/ubi10/ubi-minimal:latest
+```
+
 ## Files NOT Changed
 
-| Dockerfile | Reason |
+| File | Reason |
 |---|---|
 | `release/helm/upstream.Dockerfile` | Uses `ubi8/ubi-minimal` — separate RHEL8 lineage, unrelated to this migration |
+| `ci/dockerfiles/builder.Dockerfile` | Uses `openshift/origin-release:golang-1.13` — legacy, not RHEL9-specific |
+| `.ci-operator.yaml` | Build root (`rhel-9-release-golang-1.24-openshift-4.22`) is managed by OCP CI team in `openshift/release` |
 
 ## Test Plan
 
 - [ ] All images build successfully against `ubi10` base
+- [ ] `release/helm/Dockerfile` builds successfully with `go-toolset:10.1` as builder
 - [ ] CI jobs pass on RHCOS10 cluster nodes with UBI10 base images
 - [ ] `microdnf` commands in `images/operator-sdk/Dockerfile` work under UBI10
+- [ ] E2e metrics check passes with UBI10 curl pod (`ci/tests/e2e-helm.sh`)
 - [ ] No regressions observed compared to UBI9 baseline (PR1)
 
 ## References

ci/tests/e2e-helm.sh

@@ -71,7 +71,7 @@ EOF
     token=$(kubectl get secret service-account-secret -o jsonpath={.data.token} | base64 -d)
 
     # verify that the metrics endpoint exists
-    if ! timeout 1m bash -c -- "until kubectl run --attach --rm --restart=Never test-metrics --image=registry.access.redhat.com/ubi9/ubi-minimal:latest -n memcached-operator-system --overrides='{\"spec\":{\"securityContext\":{\"runAsNonRoot\": true, \"capabilities\": {\"drop\": [\"ALL\"]}, \"allowPrivelegeEscalation\": false, \"seccompProfile\": {\"type\": \"RuntimeDefault\"}}}}' -- curl -sfkH \"Authorization: Bearer ${token}\" https://memcached-operator-controller-manager-metrics-service:8443/metrics; do sleep 1; done";
+    if ! timeout 1m bash -c -- "until kubectl run --attach --rm --restart=Never test-metrics --image=registry.redhat.io/ubi10/ubi-minimal:latest -n memcached-operator-system --overrides='{\"spec\":{\"securityContext\":{\"runAsNonRoot\": true, \"capabilities\": {\"drop\": [\"ALL\"]}, \"allowPrivelegeEscalation\": false, \"seccompProfile\": {\"type\": \"RuntimeDefault\"}}}}' -- curl -sfkH \"Authorization: Bearer ${token}\" https://memcached-operator-controller-manager-metrics-service:8443/metrics; do sleep 1; done";
     then
         echo "Failed to verify that metrics endpoint exists"
         kubectl describe pods

release/helm/Dockerfile

@@ -1,4 +1,4 @@
-FROM registry.ci.openshift.org/ocp/builder:rhel-9-golang-1.24-openshift-4.22 AS builder
+FROM registry.redhat.io/ubi10/go-toolset:10.1 AS builder
 
 ENV GO111MODULE=on \
     GOFLAGS=-mod=vendor
@@ -8,7 +8,7 @@ COPY . /go/src/github.com/operator-framework/operator-sdk
 RUN cd /go/src/github.com/operator-framework/operator-sdk \
  && make -f ci/prow.Makefile patch build
 
-FROM registry.ci.openshift.org/ocp/4.22:base-rhel9
+FROM registry.redhat.io/ubi10:10.1
 
 ENV HOME=/opt/helm \
     USER_NAME=helm \