To answer # 1, see : #8357 (i.e. we will move off of ubi9/openssl next release)

To answer # 2: There are two types of Kiali releases that are published on quay.io/kiali/kiali. One is "distro" and the other "distroless" (both support multiple architectures). The images you see in quay with the -distro suffix are "distro" images (NOT distroless; I think that is part of your misunderstanding).

The 2.8.0 release images on quay look like this:

In short, users rarely, if ever, care about or use the distro image. The distroless image is usually the image you want to deploy in production.

The difference is "distro" is based on "UBI minimal" (which has a few more tools that you can use for debugging certain issues) and "distroless" is based on "UBI micro" (which has minimal tools but also has a smaller image footprint and minimizes the attack surface).

The distroless is the one that is deployed by default. The user would have to explicitly ask to deploy the "distro" image should they want that. You only want the "distro" image when you want certain command line tools (like curl) to assist in debugging certain deployment or configuration issues within the Kiali pod. For example, say you are having connectivity issues with things like Kiali failing to connect to Prometheus. Having the curl utility is sometimes useful so you can run curl within the Kiali pod itself to see if connectivity between the pod and Prometheus is possible.

curl is not available in the default (aka "distroless") image, but is in the "distro" image.

distro image:

$ podman run -it --rm --entrypoint '' quay.io/kiali/kiali:v2.8-distro curl --version
curl 7.76.1 (x86_64-redhat-linux-gnu) libcurl/7.76.1 OpenSSL/3.2.2 zlib/1.2.11 nghttp2/1.43.0
Release-Date: 2021-04-14
Protocols: file ftp ftps http https 
Features: alt-svc AsynchDNS GSS-API HTTP2 HTTPS-proxy IPv6 Kerberos Largefile libz NTLM SPNEGO SSL UnixSockets

distroless image:

$ podman run -it --rm --entrypoint '' quay.io/kiali/kiali:v2.8 curl --version
Error: crun: executable file `curl` not found in $PATH: No such file or directory: OCI runtime attempted to invoke a command that was not found