new hardened mani

Dockerfile

@@ -17,7 +17,7 @@ WORKDIR /opt
 ADD operator-5.5.2-caas_lib.tar.gz /opt/caas/lib/
 ADD operator-5.5.2-plugins.tar.gz /usr/share/java/cc-base/
 
-COPY include/opt/caas /opt/caas
+COPY scripts/include/opt/caas /opt/caas
 
 RUN yum install -y openssl findutils && yum clean all && mkdir -p "${CONTROL_CENTER_DATA_DIR}" "${CONTROL_CENTER_CONFIG_DIR}" "${COMPONENT_SCRIPT_DIR}/${COMPONENT}" \
    	&& chmod -R ag+w "${CONTROL_CENTER_DATA_DIR}" "${CONTROL_CENTER_CONFIG_DIR}" "/opt"	   

scripts/caas/bin/configure

+#!/usr/bin/env bash
+#
+# Copyright 2018 Confluent Inc.
+#
+set -o nounset \
+    -o errexit
+
+dub ensure CONTROL_CENTER_DATA_DIR
+dub ensure CONTROL_CENTER_CONFIG_DIR
+dub ensure CONTROL_CENTER_SECRETS_DIR
+dub ensure CAAS_POD_ID
+
+echo "===> Check if ${CONTROL_CENTER_CONFIG_DIR} is writable ..."
+dub path "${CONTROL_CENTER_CONFIG_DIR}" writable
+
+echo "===> Check if ${CONTROL_CENTER_DATA_DIR} is writable ..."
+dub path "${CONTROL_CENTER_DATA_DIR}" writable
+
+if [ -e /mnt/secrets/jksPassword.txt ]; then
+	export KEYSTOREPASSWORD=$(echo $(cat /mnt/secrets/jksPassword.txt | cut -d '='  -f2-) | sed 's/ *$//g')
+else
+	export KEYSTOREPASSWORD=mystorepassword
+fi
+
+## C3 SSL configuration
+##
+create_keystore() {
+	keystore_path=$1
+	extra_certfile=${2:-""}
+	if [ -e /mnt/sslcerts/fullchain.pem ] && [ -e /mnt/sslcerts/privkey.pem ]; then
+		args="-export
+			-in /mnt/sslcerts/fullchain.pem
+			-inkey /mnt/sslcerts/privkey.pem
+			-out /tmp/pkcs.p12
+			-name ${COMPONENT}
+			-passout pass:mykeypassword"
+
+		if [ ! -z ${extra_certfile} ] && [ -e ${extra_certfile} ]; then
+			args="${args} -certfile ${extra_certfile}"
+		fi
+		openssl pkcs12 ${args}
+
+		keytool -importkeystore \
+			-deststorepass ${KEYSTOREPASSWORD} \
+			-destkeypass ${KEYSTOREPASSWORD} \
+			-destkeystore ${keystore_path} \
+			-deststoretype pkcs12 \
+			-srckeystore /tmp/pkcs.p12 \
+			-srcstoretype PKCS12 \
+			-srcstorepass mykeypassword
+	fi
+}
+create_keystore /tmp/keystore.jks
+
+##
+## Put all CAs provided as part of caCerts.pem file to truststore
+##
+if [ -e /mnt/sslcerts/cacerts.pem ]; then
+mkdir -p /tmp/trustCAs
+cat /mnt/sslcerts/cacerts.pem | awk 'split_after==1{n++;split_after=0} /-----END CERTIFICATE-----/ {split_after=1} {print > ("/tmp/trustCAs/ca" n ".pem")}'
+for file in /tmp/trustCAs/*; do
+  fileName="${file##*/}"
+  keytool -import \
+          -trustcacerts \
+          -alias "$fileName" \
+          -file "$file" \
+          -keystore /tmp/truststore.jks \
+          -deststorepass ${KEYSTOREPASSWORD} \
+          -noprompt
+done
+fi
+
+##
+## Control-center configuration
+##
+cat ${CONTROL_CENTER_CONFIG_DIR}/shared/${COMPONENT}.properties > ${COMPONENT_SCRIPT_DIR}/${COMPONENT}/${COMPONENT}.properties
+##
+## Pod specific configuration
+##
+cat ${CONTROL_CENTER_CONFIG_DIR}/${COMPONENT}.properties >> ${COMPONENT_SCRIPT_DIR}/${COMPONENT}/${COMPONENT}.properties
+##
+##
+## Internal Topic configuration
+##
+cat ${CONTROL_CENTER_CONFIG_DIR}/shared/internal-topic.properties >> ${COMPONENT_SCRIPT_DIR}/${COMPONENT}/${COMPONENT}.properties
+##
+## Stream Monitoring Topic configuration
+##
+cat ${CONTROL_CENTER_CONFIG_DIR}/shared/monitoring-interceptor-topic.properties >> ${COMPONENT_SCRIPT_DIR}/${COMPONENT}/${COMPONENT}.properties
+##
+##
+## Metrics Topic configuration
+##
+cat ${CONTROL_CENTER_CONFIG_DIR}/shared/metrics-topic.properties >> ${COMPONENT_SCRIPT_DIR}/${COMPONENT}/${COMPONENT}.properties
+##
+## Components configuration
+##
+cat ${CONTROL_CENTER_CONFIG_DIR}/shared/components.properties >> ${COMPONENT_SCRIPT_DIR}/${COMPONENT}/${COMPONENT}.properties
+##
+## kafka_security configuration
+##
+cat ${CONTROL_CENTER_CONFIG_DIR}/shared/streams.properties >> ${COMPONENT_SCRIPT_DIR}/${COMPONENT}/${COMPONENT}.properties
+##
+## UI https configuration
+##
+cat ${CONTROL_CENTER_CONFIG_DIR}/shared/https.properties >> ${COMPONENT_SCRIPT_DIR}/${COMPONENT}/${COMPONENT}.properties
+##
+## Command topic configuration
+##
+cat ${CONTROL_CENTER_CONFIG_DIR}/shared/command-topic.properties >> ${COMPONENT_SCRIPT_DIR}/${COMPONENT}/${COMPONENT}.properties
+##
+## Producer/Consumer topic configuration
+##
+cat ${CONTROL_CENTER_CONFIG_DIR}/shared/producer-consumer.properties >> ${COMPONENT_SCRIPT_DIR}/${COMPONENT}/${COMPONENT}.properties
+##
+## Connect configuration
+##
+cat ${CONTROL_CENTER_CONFIG_DIR}/shared/connect.properties >> ${COMPONENT_SCRIPT_DIR}/${COMPONENT}/${COMPONENT}.properties
+##
+## Email configuration
+##
+cat ${CONTROL_CENTER_CONFIG_DIR}/shared/email.properties >> ${COMPONENT_SCRIPT_DIR}/${COMPONENT}/${COMPONENT}.properties
+##
+## Alert configuration
+##
+cat ${CONTROL_CENTER_CONFIG_DIR}/shared/alert.properties >> ${COMPONENT_SCRIPT_DIR}/${COMPONENT}/${COMPONENT}.properties
+##
+## Log4J configuration
+##
+cat ${CONTROL_CENTER_CONFIG_DIR}/shared/log4j.properties >  ${COMPONENT_SCRIPT_DIR}/${COMPONENT}/log4j.properties
+cat ${CONTROL_CENTER_CONFIG_DIR}/log4j.properties >> ${COMPONENT_SCRIPT_DIR}/${COMPONENT}/log4j.properties
+##
+## UI Authentication configuration
+##
+if [ -e ${CONTROL_CENTER_CONFIG_DIR}/shared/ui-authentication.properties ] \
+    && [ -e ${CONTROL_CENTER_CONFIG_DIR}/shared/login.properties ] \
+	&& [ -e ${CONTROL_CENTER_CONFIG_DIR}/shared/propertyfile.jaas ] ; then
+
+	cat ${CONTROL_CENTER_CONFIG_DIR}/shared/ui-authentication.properties >> ${COMPONENT_SCRIPT_DIR}/${COMPONENT}/${COMPONENT}.properties
+	cat ${CONTROL_CENTER_CONFIG_DIR}/shared/login.properties > ${COMPONENT_SCRIPT_DIR}/${COMPONENT}/login.properties
+	cat ${CONTROL_CENTER_CONFIG_DIR}/shared/propertyfile.jaas > ${COMPONENT_SCRIPT_DIR}/${COMPONENT}/propertyfile.jaas
+fi 
+##
+## Control-Center's managed Kafka JAAS file
+##
+cat ${CONTROL_CENTER_CONFIG_DIR}/shared/c3-kafka-client-jaas.conf > ${COMPONENT_SCRIPT_DIR}/${COMPONENT}/c3-kafka-client-jaas.conf
+##
+## JVM configurations
+##
+cat ${CONTROL_CENTER_CONFIG_DIR}/shared/jvm.config > ${COMPONENT_SCRIPT_DIR}/${COMPONENT}/jvm.config
+cat ${CONTROL_CENTER_CONFIG_DIR}/jvm.config >> ${COMPONENT_SCRIPT_DIR}/${COMPONENT}/jvm.config
+##
+## JOLOKIA Configurations
+##
+if [ -e ${CONTROL_CENTER_CONFIG_DIR}/shared/jolokia.config ]; then
+	create_keystore /tmp/jolokia-keystore.jks /mnt/sslcerts/cacerts.pem
+	cat ${CONTROL_CENTER_CONFIG_DIR}/shared/jolokia.config > ${COMPONENT_SCRIPT_DIR}/${COMPONENT}/jolokia.config
+fi
+##
+## JMX Prometheus Configurations
+##
+cp /opt/caas/templates/jmx-exporter.yaml.j2 ${COMPONENT_SCRIPT_DIR}/jmx-exporter.yaml
+##
+## Disk Usage agent that pushes information to mbeans which can be access through JMX
+##
+cat ${CONTROL_CENTER_CONFIG_DIR}/shared/disk-usage-agent.properties >  ${COMPONENT_SCRIPT_DIR}/${COMPONENT}/disk-usage-agent.properties
+find ${COMPONENT_SCRIPT_DIR} -type f | xargs sed -i  "s/<<keystorepassword>>/${KEYSTOREPASSWORD}/g"

scripts/caas/bin/ensure

+#!/usr/bin/env bash
+#
+# Copyright 2018 Confluent Inc.
+#
+set -o errexit
+
+echo "===> Check if Kafka is healthy ..."
+
+export CONTROL_CENTER_BOOTSTRAP_SERVERS=$(grep '^bootstrap.servers' ${COMPONENT_SCRIPT_DIR}/${COMPONENT}/${COMPONENT}.properties | cut -d '=' -f 2)
+export CONTROL_CENTER_REPLICATION_FACTOR=$(grep -w 'confluent.controlcenter.internal.topics.replication' ${COMPONENT_SCRIPT_DIR}/${COMPONENT}/${COMPONENT}.properties | cut -d '=' -f 2)
+
+cub kafka-ready "${CONTROL_CENTER_REPLICATION_FACTOR}" \
+  "${CONTROL_CENTER_CUB_KAFKA_TIMEOUT:-40}" \
+  -b "${CONTROL_CENTER_BOOTSTRAP_SERVERS}" \
+  --config "${COMPONENT_SCRIPT_DIR}/${COMPONENT}/c3-kafka-client-jaas.conf"

scripts/caas/bin/launch

+#!/usr/bin/env bash
+#
+# Copyright 2018 Confluent Inc.
+#
+set -o errexit
+
+if [[ -e ${COMPONENT_SCRIPT_DIR}/${COMPONENT}/propertyfile.jaas ]] ; then
+    export CONTROL_CENTER_OPTS="-Djava.security.auth.login.config=${COMPONENT_SCRIPT_DIR}/${COMPONENT}/propertyfile.jaas"
+fi
+
+echo "===> Adding disk usage agent to the java command ... " 
+export CONTROL_CENTER_OPTS="${CONTROL_CENTER_OPTS} -javaagent:/usr/share/java/cc-base/disk-usage-agent-${CONFLUENT_VERSION}.jar=${COMPONENT_SCRIPT_DIR}/${COMPONENT}/disk-usage-agent.properties"
+
+echo "===> Adding jolokia agent to the java command ... " 
+export JOLOKIA_AGENT_PORT=${JOLOKIA_AGENT_PORT:-7777}
+export JOLOKIA_AGENT_HOST=${JOLOKIA_AGENT_HOST:-"0.0.0.0"}
+if [ -e "${COMPONENT_SCRIPT_DIR}/${COMPONENT}/jolokia.config" ]; then
+export JOLOKIA_EXTRA_ARGS=",$(cat ${COMPONENT_SCRIPT_DIR}/${COMPONENT}/jolokia.config | xargs)"
+fi
+export CONTROL_CENTER_OPTS="${CONTROL_CENTER_OPTS} -javaagent:/opt/caas/lib/jolokia/jolokia-jvm-1.6.2-agent.jar=port=${JOLOKIA_AGENT_PORT},host=${JOLOKIA_AGENT_HOST}${JOLOKIA_EXTRA_ARGS}"
+
+echo "===> Adding jmx exporter to the java command ... " 
+export JMX_EXPORTER_AGENT_PORT=${JMX_EXPORTER_AGENT_PORT:-7778}
+export JMX_EXPORTER_AGENT_HOST=${JMX_EXPORTER_AGENT_HOST:-"0.0.0.0"}
+
+export CONTROL_CENTER_OPTS="${CONTROL_CENTER_OPTS} -javaagent:/opt/caas/lib/jmx_prometheus_javaagent-0.14.0.jar=${JMX_EXPORTER_AGENT_PORT}:${COMPONENT_SCRIPT_DIR}/jmx-exporter.yaml"
+
+echo "===> Adding JVM config to the java command ... "
+export CONTROL_CENTER_OPTS="$(cat ${COMPONENT_SCRIPT_DIR}/${COMPONENT}/jvm.config | xargs) ${CONTROL_CENTER_OPTS}"
+
+echo "===> Launching ${COMPONENT} ... "
+export CONTROL_CENTER_LOG4J_OPTS="-Dlog4j.configuration=file:${COMPONENT_SCRIPT_DIR}/${COMPONENT}/log4j.properties"
+export CONTROL_CENTER_HEAP_OPTS=' '
+export CONTROL_CENTER_JVM_PERFORMANCE_OPTS=' '
+export CONTROL_CENTER_JMX_OPTS=' '
+export JMX_PORT=' '
+exec ${COMPONENT}-start ${COMPONENT_SCRIPT_DIR}/${COMPONENT}/${COMPONENT}.properties
\ No newline at end of file

scripts/caas/bin/run

+#!/usr/bin/env bash
+#
+# Copyright 2018 Confluent Inc.
+#
+set -o nounset \
+    -o errexit
+
+echo "===> User"
+id
+
+echo "===> Configuring ..."
+${DOCKER_SCRIPT_DIR}/configure
+
+echo "===> Running preflight checks ... "
+${DOCKER_SCRIPT_DIR}/ensure
+
+echo "===> Launching ... "
+exec ${DOCKER_SCRIPT_DIR}/launch
\ No newline at end of file

scripts/caas/templates/jmx-exporter.yaml.j2

+lowercaseOutputLabelNames: false
+lowercaseOutputName: true

scripts/licenses/confluent.txt

+Copyright 2020 Confluent, Inc.