Merge branch 'development' into 'master'

Development

See merge request !16

Dockerfile

+ARG BASE_REGISTRY=registry1.dso.mil
+ARG BASE_IMAGE=ironbank/opensource/fluentd/fluentd-elasticsearch
+ARG BASE_TAG=5.0.0
+
+FROM ${BASE_REGISTRY}/${BASE_IMAGE}:${BASE_TAG}
+
+
+ENV FLUENT_USER fluent
+
+USER 0
+
+RUN yum install -y make gcc gcc-c++
+
+COPY *.gem /tmp/
+COPY jq /usr/bin
+
+
+RUN chmod +x /usr/bin/jq
+
+RUN gem install --force --local -N /tmp/ffi.gem
+RUN gem install --force --local -N /tmp/*.gem
+
+RUN yum remove -y make gcc gcc-c++ && dnf clean all && rm /usr/local/bundle/gems/kubeclient-4.6.0/test/config/external-key.rsa
+
+USER 1000

Gemfile

+source 'https://rubygems.org'
+
+# This is separate gemfile for building docker image that has all plugins 
+# for kubernetes log collection agent
+# List all required gems here and install via bundler to resolve dependencies
+gem "fluentd", "=1.9.1" 
+gem "fluent-plugin-prometheus", "=1.7.0"
+gem "fluent-plugin-record-modifier", "=2.1.0"
+gem "fluent-plugin-elasticsearch", ">=4.1.1"
+
+gem "fluent-plugin-jq", "=0.5.1"
+gem "oj", "=3.10.2"
+gem 'multi_json', '=1.14.1'
+gem 'bigdecimal', '=2.0.0'
+gem 'kubeclient', '=4.6.0'
+gem 'http_parser.rb', '=0.5.3'
+
+gem 'fluent-plugin-dedot_filter', '>= 1.0.0'
+
+gem 'fluent-plugin-kubernetes-objects', ">=1.1.3"

Gemfile.lock

+GEM
+  remote: https://rubygems.org/
+  specs:
+    activemodel (5.2.4.3)
+      activesupport (= 5.2.4.3)
+    activesupport (5.2.4.3)
+      concurrent-ruby (~> 1.0, >= 1.0.2)
+      i18n (>= 0.7, < 2)
+      minitest (~> 5.1)
+      tzinfo (~> 1.1)
+    addressable (2.7.0)
+      public_suffix (>= 2.0.2, < 5.0)
+    aes_key_wrap (1.0.1)
+    attr_required (1.0.1)
+    bigdecimal (2.0.0)
+    bindata (2.4.4)
+    concurrent-ruby (1.1.6)
+    connection_pool (2.2.2)
+    cool.io (1.6.0)
+    domain_name (0.5.20190701)
+      unf (>= 0.0.5, < 1.0.0)
+    ffi (1.12.2)
+    ffi-compiler (1.0.1)
+      ffi (>= 1.0.0)
+      rake
+    fluent-plugin-jq (0.5.1)
+      fluentd (>= 0.14.10, < 2)
+      multi_json (~> 1.13)
+    fluent-plugin-kubernetes_metadata_filter (2.4.2)
+      fluentd (>= 0.14.0, < 2)
+      kubeclient (< 5)
+      lru_redux
+    fluent-plugin-prometheus (1.7.0)
+      fluentd (>= 0.14.20, < 2)
+      prometheus-client (< 0.10)
+    fluent-plugin-record-modifier (2.1.0)
+      fluentd (>= 1.0, < 2)
+    fluent-plugin-splunk-hec (1.2.1)
+      activesupport (~> 5.2)
+      fluent-plugin-kubernetes_metadata_filter (~> 2.4.2)
+      fluentd (>= 1.4)
+      http_parser.rb (= 0.5.3)
+      multi_json (~> 1.13)
+      net-http-persistent (~> 3.1)
+      openid_connect (~> 1.1.8)
+      prometheus-client (< 0.10.0)
+    fluentd (1.9.1)
+      cool.io (>= 1.4.5, < 2.0.0)
+      http_parser.rb (>= 0.5.1, < 0.7.0)
+      msgpack (>= 1.3.1, < 2.0.0)
+      serverengine (>= 2.0.4, < 3.0.0)
+      sigdump (~> 0.2.2)
+      strptime (>= 0.2.2, < 1.0.0)
+      tzinfo (>= 1.0, < 3.0)
+      tzinfo-data (~> 1.0)
+      yajl-ruby (~> 1.0)
+    http (4.3.0)
+      addressable (~> 2.3)
+      http-cookie (~> 1.0)
+      http-form_data (~> 2.2)
+      http-parser (~> 1.2.0)
+    http-accept (1.7.0)
+    http-cookie (1.0.3)
+      domain_name (~> 0.5)
+    http-form_data (2.2.0)
+    http-parser (1.2.1)
+      ffi-compiler (>= 1.0, < 2.0)
+    http_parser.rb (0.5.3)
+    httpclient (2.8.3)
+    i18n (1.8.2)
+      concurrent-ruby (~> 1.0)
+    json-jwt (1.11.0)
+      activesupport (>= 4.2)
+      aes_key_wrap
+      bindata
+    kubeclient (4.6.0)
+      http (>= 3.0, < 5.0)
+      recursive-open-struct (~> 1.0, >= 1.0.4)
+      rest-client (~> 2.0)
+    lru_redux (1.1.0)
+    mail (2.7.1)
+      mini_mime (>= 0.1.1)
+    mime-types (3.3.1)
+      mime-types-data (~> 3.2015)
+    mime-types-data (3.2019.1009)
+    mini_mime (1.0.2)
+    minitest (5.14.0)
+    msgpack (1.3.3)
+    multi_json (1.14.1)
+    net-http-persistent (3.1.0)
+      connection_pool (~> 2.2)
+    netrc (0.11.0)
+    oj (3.10.2)
+    openid_connect (1.1.8)
+      activemodel
+      attr_required (>= 1.0.0)
+      json-jwt (>= 1.5.0)
+      rack-oauth2 (>= 1.6.1)
+      swd (>= 1.0.0)
+      tzinfo
+      validate_email
+      validate_url
+      webfinger (>= 1.0.1)
+    prometheus-client (0.9.0)
+      quantile (~> 0.2.1)
+    public_suffix (4.0.3)
+    quantile (0.2.1)
+    rack (2.2.2)
+    rack-oauth2 (1.10.1)
+      activesupport
+      attr_required
+      httpclient
+      json-jwt (>= 1.11.0)
+      rack
+    rake (13.0.1)
+    recursive-open-struct (1.1.0)
+    rest-client (2.1.0)
+      http-accept (>= 1.7.0, < 2.0)
+      http-cookie (>= 1.0.2, < 2.0)
+      mime-types (>= 1.16, < 4.0)
+      netrc (~> 0.8)
+    serverengine (2.2.1)
+      sigdump (~> 0.2.2)
+    sigdump (0.2.4)
+    strptime (0.2.3)
+    swd (1.1.2)
+      activesupport (>= 3)
+      attr_required (>= 0.0.5)
+      httpclient (>= 2.4)
+    thread_safe (0.3.6)
+    tzinfo (1.2.6)
+      thread_safe (~> 0.1)
+    tzinfo-data (1.2019.3)
+      tzinfo (>= 1.0.0)
+    unf (0.1.4)
+      unf_ext
+    unf_ext (0.0.7.6)
+    validate_email (0.1.6)
+      activemodel (>= 3.0)
+      mail (>= 2.2.5)
+    validate_url (1.0.8)
+      activemodel (>= 3.0.0)
+      public_suffix
+    webfinger (1.1.0)
+      activesupport
+      httpclient (>= 2.4)
+    yajl-ruby (1.4.1)
+
+PLATFORMS
+  ruby
+
+DEPENDENCIES
+  bigdecimal (= 2.0.0)
+  fluent-plugin-jq (= 0.5.1)
+  fluent-plugin-prometheus (= 1.7.0)
+  fluent-plugin-record-modifier (= 2.1.0)
+  fluent-plugin-splunk-hec (= 1.2.1)
+  fluentd (= 1.9.1)
+  http_parser.rb (= 0.5.3)
+  kubeclient (= 4.6.0)
+  multi_json (= 1.14.1)
+  oj (= 3.10.2)
+
+BUNDLED WITH
+   2.1.4

LICENSE

+MIT License
+
+Copyright (c) 2020 Platform One / Big Bang / Cluster Auditor
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

hardening_manifest.yaml

+---
+apiVersion: v1
+
+# The repository name in registry1, excluding /ironbank/
+name: "cluster-auditor/opa-collector"
+
+# List of tags to push for the repository in registry1
+# The most specific version should be the first tag and will be shown
+# on ironbank.dsop.io
+tags:
+  - "0.3.2"
+  - "latest"
+
+# Build args passed to Dockerfile ARGs
+args:
+  BASE_IMAGE: "opensource/fluentd/fluentd-elasticsearch"
+  BASE_TAG: "5.0.0"
+
+# Docker image labels
+labels:
+  org.opencontainers.image.title: "opa-collector"
+  ## Human-readable description of the software packaged in the image
+  org.opencontainers.image.description: "Collector of opa policies into elasticsearch"
+  ## License(s) under which contained software is distributed
+  org.opencontainers.image.licenses: "MIT"
+  ## URL to find more information on the image
+  org.opencontainers.image.url: "https://www.openpolicyagent.org/docs/latest/"
+  ## Name of the distributing entity, organization or individual
+  org.opencontainers.image.vendor: "Big Bang"
+  org.opencontainers.image.version: "0.3.2"
+  ## Keywords to help with search (ex. "cicd,gitops,golang")
+  mil.dso.ironbank.image.keywords: "bigbang,opa"
+  ## This value can be "opensource" or "commercial"
+  mil.dso.ironbank.image.type: "opensource"
+  ## Product the image belongs to for grouping multiple images
+  mil.dso.ironbank.product.name: "bigbang"
+
+# List of resources to make available to the offline build context
+resources:
+  - url: https://rubygems.org/downloads/ffi-1.13.1.gem
+    filename: ffi.gem
+    validation:
+      type: sha256
+      value: 4e15f52ee45af7c5674d656041855448adbb5022618be252cd602d81b8e2978a
+  - url: https://rubygems.org/downloads/ffi-compiler-1.0.1.gem
+    filename: ffi-compiler.gem
+    validation:
+      type: sha256
+      value: 019f389b078a2fec9de7f4f65771095f80a447e34436b4588bcb629e2a564c30
+  - url: https://rubygems.org/downloads/fluent-plugin-dedot_filter-1.0.0.gem
+    filename: fluent-plugin-dedot_filter.gem
+    validation:
+      type: sha256
+      value: ace64a11b989e822404dbd375d5b5b07e49f40b7a2461c33e6539e1def8f646b
+  - url: https://rubygems.org/downloads/fluent-plugin-kubernetes-objects-1.1.4.gem
+    filename: fluent-plugin-kubernetes-objects.gem
+    validation:
+      type: sha256
+      value: 9d43373f185b607f03b9a7206e02fa7c018278d5047849ffe927173b17822387
+  - url: https://rubygems.org/downloads/http_parser.rb-0.5.3.gem
+    filename: http_parser.rb.gem
+    validation:
+      type: sha256
+      value: d64f525eb1c580598d5bdef4fad98e948b6e016fa7803f45e13ac8714a2b8e3b
+  - url: https://rubygems.org/downloads/kubeclient-4.6.0.gem
+    filename: kubeclient.gem
+    validation:
+      type: sha256
+      value: 862f1d173befab10c73958617ec289797102ca4e9393c7cfe6992a41e9274eb6
+  - url: https://rubygems.org/downloads/http-4.3.0.gem
+    filename: http.gem
+    validation:
+      type: sha256
+      value: f1e9c846b71515b67b4d1ed570cac0e90588c23313cae860ef88e4a0210add69
+  - url: https://rubygems.org/downloads/addressable-2.7.0.gem
+    filename: addressable.gem
+    validation:
+      type: sha256
+      value: 5e9b62fe1239091ea9b2893cd00ffe1bcbdd9371f4e1d35fac595c98c5856cbb
+  - url: https://rubygems.org/downloads/http-cookie-1.0.3.gem
+    filename: http-cookie.gem
+    validation:
+      type: sha256
+      value: 2f11269d817bc52ab2af2721e89a377660a961078de2a3a55fc696d7897e8c00
+  - url: https://rubygems.org/downloads/http-form_data-2.3.0.gem
+    filename: http-form_data.gem
+    validation:
+      type: sha256
+      value: cc4eeb1361d9876821e31d7b1cf0b68f1cf874b201d27903480479d86448a5f3
+  - url: https://rubygems.org/downloads/http-parser-1.2.1.gem
+    filename: http-parser.gem
+    validation:
+      type: sha256
+      value: 1277ce987082736efa787dc0578fdef8872fd73dce034ad9fc05b71351409f83
+  - url: https://rubygems.org/downloads/recursive-open-struct-1.1.0.gem
+    filename: recursive-open-struct.gem
+    validation:
+      type: sha256
+      value: 6c5029e9d7d8b2b295bce33089b4530992d534890b5c737ccfbc16575ff4cc71
+  - url: https://rubygems.org/downloads/to_regexp-0.2.1.gem
+    filename: to_regexp.gem
+    validation:
+      type: sha256
+      value: 3b458ccd12e850816ca54b38fc592422a9bf412bb2d604ba23d4506ca15beae5
+  - url: https://rubygems.org/downloads/rest-client-2.1.0.gem
+    filename: rest-client.gem
+    validation:
+      type: sha256
+      value: 35a6400bdb14fae28596618e312776c158f7ebbb0ccad752ff4fa142bf2747e3
+  - url: https://rubygems.org/downloads/fluent-plugin-jq-0.5.1.gem
+    filename: fluent-plugin-jq.gem
+    validation:
+      type: sha256
+      value: 82fc36334f460854bd6cace3d8ec39def3e773c0e60871457c7a69ae6bb23aa8
+  - url: https://github.com/stedolan/jq/releases/download/jq-1.6/jq-linux64
+    filename: jq
+    validation:
+      type: sha256
+      value: af986793a515d500ab2d35f8d2aecd656e764504b789b66d7e1a0b727a124c44
+  - url: https://rubygems.org/downloads/fluent-plugin-record-modifier-2.1.0.gem
+    filename: fluent-plugin-record-modifier.gem
+    validation:
+      type: sha256
+      value: c7c945836b47a2e0885202d14e96f190f2411a532741c2ec925e05689d5d42a1
+  - url: https://rubygems.org/downloads/multipart-post-2.1.1.gem
+    filename: multipart-post.gem
+    validation:
+      type: sha256
+      value: d2dd7aa957650e0d99e0513cd388401b069f09528441b87d884609c8e94ffcfd
+  - url: https://rubygems.org/downloads/http-accept-1.7.0.gem
+    filename: http-accept.gem
+    validation:
+      type: sha256
+      value: c626860682bfbb3b46462f8c39cd470fd7b0584f61b3cc9df5b2e9eb9972a126
+  - url: https://rubygems.org/downloads/domain_name-0.5.20190701.gem
+    filename: domain_name.gem
+    validation:
+      type: sha256
+      value: 000a600454cb4a344769b2f10b531765ea7bd3a304fe47ed12e5ca1eab969851
+  - url: https://rubygems.org/downloads/unf-0.1.4.gem
+    filename: unf.gem
+    validation:
+      type: sha256
+      value: 4999517a531f2a955750f8831941891f6158498ec9b6cb1c81ce89388e63022e
+  - url: https://rubygems.org/downloads/unf_ext-0.0.7.7.gem
+    filename: unf_ext.gem
+    validation:
+      type: sha256
+      value: e4e9b1f0c48467fa271d53b180f4ace4c0ff88f01a69ae3da2c30038443e8471
+  - url: https://rubygems.org/downloads/mime-types-3.3.1.gem
+    filename: mime-types.gem
+    validation:
+      type: sha256
+      value: 708f737e28ceef48b9a1bc041aa9eec46fa36eb36acb95e6b64a9889131541fe
+  - url: https://rubygems.org/downloads/mime-types-data-3.2020.0512.gem
+    filename: mime-types-data.gem
+    validation:
+      type: sha256
+      value: a31c1705fec7fc775749742c52964a0e012968b43939e141a74f43ffecd6e5fc
+  - url: https://rubygems.org/downloads/netrc-0.8.0.gem
+    filename: netrc.gem
+    validation:
+      type: sha256
+      value: 6bb6b2011b1f069600cc10f9a968f6dcb3cac9c23e741c3b1978a6d0765b92c8
+  - url: https://rubygems.org/downloads/public_suffix-4.0.6.gem
+    filename: public_suffix.gem
+    validation:
+      type: sha256
+      value: a99967c7b2d1d2eb00e1142e60de06a1a6471e82af574b330e9af375e87c0cf7
+  - url: https://rubygems.org/downloads/faraday-net_http-1.0.1.gem
+    filename: faraday-net_http.gem
+    validation:
+      type: sha256
+      value: 3245ce406ebb77b40e17a77bfa66191dda04be2fd4e13a78d8a4305854d328ba
+  - filename: faraday-1.3.0.gem
+    url: https://rubygems.org/downloads/faraday-1.3.0.gem
+    validation:
+      type: sha256
+      value: 7f06817ba823ddeabf4dd85ca5e0f63e234527f564a03f09f6c7127951d3bac2
+  
+  - filename: ruby2_keywords.gem
+    url: https://rubygems.org/downloads/ruby2_keywords-0.0.4.gem
+    validation:
+      type: sha256
+      value: 3ae3189c2e1d2f60204dcceedf890ff49dd28979771e2576016a3ee73b668e97
+
+
+  - filename: elasticsearch-7.12.0.gem
+    url: https://rubygems.org/downloads/elasticsearch-7.12.0.gem
+    validation:
+      type: sha256
+      value: cd958a5f21793c90fa83db38523e29f3c2f98b7060112b2c0bc9699a29aaa455
+
+  - url: https://rubygems.org/downloads/elasticsearch-transport-7.12.0.gem
+    filename: elasticsearch-transport.gem
+    validation:
+      type: sha256
+      value: 4b10fba2d1ff914ed834ee9f7849e2fdbee794e14bbfb3d09b78609df5cf6392
+
+  - url: https://rubygems.org/downloads/elasticsearch-api-7.12.0.gem
+    filename: elasticsearch-api.gem
+    validation:
+      type: sha256
+      value: 833d0d78dda4a62038fc9716eb51a626d52ecdaa57ecdb3f0aa84db1e324fd13
+
+# List of project maintainers
+maintainers:
+  - email: "tom@runyon.dev"
+    name: "Tom Runyon"
+    username: "runyontr"
+  - email: "jweatherford@oteemo.com"
+    name: "Jeff Weatherford"
+    username: "jweatherford"
+    cht_member: true