Merge branch 'initial-cut' into 'development'

Initial cut

See merge request !15

.dockerignore

+scripts/build-image.sh
+scripts/genManifestTemplate.sh
+scripts/importArtifacts.sh
\ No newline at end of file

.gitignore

+*.whl
+*.tar.gz
+*.rpm
+jsonnet
\ No newline at end of file

Dockerfile

+#
+# Copyright 2020 Confluent Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+ARG BASE_REGISTRY=registry1.dso.mil
+ARG BASE_IMAGE=redhat/openjdk/openjdk11
+ARG BASE_TAG=1.11
+
+FROM ${BASE_REGISTRY}/${BASE_IMAGE}:${BASE_TAG}
+
+# This affects how strings in Java class files are interpreted.  We want UTF-8 and this is the only locale in the
+# base image that supports it
+ENV LANG="C.UTF-8"
+
+USER root
+
+########################################
+## Install Python
+RUN dnf update -y && dnf install -y python38.x86_64 python38-pip-wheel.noarch \
+    && ln -s /usr/bin/python3 /usr/bin/python \
+    && ln -s /usr/bin/pip3 /usr/bin/pip \
+    && dnf clean all \
+    && rm -rf /var/cache/dnf
+
+## Python Installed
+########################################
+
+RUN mkdir -p /etc/confluent/docker /usr/logs \
+    && useradd --no-log-init --create-home --shell /bin/bash appuser \
+    && chown appuser:appuser -R /etc/confluent/ /usr/logs
+
+############ ^^^^^ Base Container Details ^^^^^ ############
+############################################################
+############ vvvvv  This Container Below  vvvvv ############
+
+WORKDIR /opt/
+
+ENV CONFIG_DIR=/mnt/config
+ENV CUB_CLASSPATH='"/usr/share/java/cp-base-new/*"'
+COPY scripts/licenses /licenses
+COPY jsonnet /usr/local/bin/jsonnet
+COPY scripts/ /opt
+
+RUN chmod -R ag+wx "/opt"
+
+ENTRYPOINT ["/opt/startup.sh"]
+
+HEALTHCHECK --interval=5s --timeout=5s --retries=5 CMD /bin/bash -c "jsonnet --version"
+
+USER 1001
+
+

LICENSE

+Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "{}"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright {yyyy} {name of copyright owner}
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+

README.md

-# <application name>
+# cp-init-container-operator-6.1.x
+
+This repository creates the Confluent cp-init-container Operator this is a simple container that applies jsonnet conventions to support pods.
+
+Architecture: https://www.confluent.io/resources/apache-kafka-confluent-enterprise-reference-architecture/
+
+Operator Deployment: https://docs.confluent.io/operator/current/co-deployment.html
+
+For questions on this container please contact: confluent-fed@confluent.io
 
-Project template for all Iron Bank container repositories.
\ No newline at end of file

hardening_manifest.yaml

+---
+apiVersion: v1
+
+# The repository name in registry1, excluding /ironbank/
+name: "confluentinc/cp-init-container-operator"
+
+# List of tags to push for the repository in registry1
+# The most specific version should be the first tag and will be shown
+# on ironbank.dso.mil
+tags:
+- "6.1.1.0"
+- "6.1.1"
+- "6.1.x"
+- "6.1"
+    
+# Build args passed to Dockerfile ARGs
+args:
+  BASE_IMAGE: "redhat/openjdk/openjdk11"
+  BASE_TAG: "1.11"
+
+# Docker image labels
+labels:
+  org.opencontainers.image.title: "cp-init-container-operator"
+  org.opencontainers.image.description: "Confluent Operator image."
+  org.opencontainers.image.licenses: "CONFLUENT ENTERPRISE LICENSE"
+  org.opencontainers.image.url: "https://docs.confluent.io/6.1.1/installation/operator/index.html"
+  org.opencontainers.image.vendor: "Confluent"
+  org.opencontainers.image.version: "6.1.1"
+  mil.dso.ironbank.image.keywords: "confluent,kafka,zookeeper,operator"
+  mil.dso.ironbank.image.type: "commercial"
+  mil.dso.ironbank.product.name: "Confluent Platform"
+
+# List of resources to make available to the offline build context
+resources:
+- filename: Python-3.6.12.tgz
+  url: https://www.python.org/ftp/python/3.6.12/Python-3.6.12.tgz
+  validation:
+    type: sha256
+    value: 12dddbe52385a0f702fb8071e12dcc6b3cb2dde07cd8db3ed60e90d90ab78693
+- filename: six-1.15.0-py2.py3-none-any.whl
+  url: https://files.pythonhosted.org/packages/ee/ff/48bde5c0f013094d729fe4b0316ba2a24774b3ff1c52d924a8a4cb04078a/six-1.15.0-py2.py3-none-any.whl
+  validation:
+    type: sha256
+    value: 8b74bedcbbbaca38ff6d7491d76f2b06b3592611af620f8426e82dddb04a5ced
+- filename: wheel-0.35.1-py2.py3-none-any.whl
+  url: https://files.pythonhosted.org/packages/a7/00/3df031b3ecd5444d572141321537080b40c1c25e1caa3d86cdd12e5e919c/wheel-0.35.1-py2.py3-none-any.whl
+  validation:
+    type: sha256
+    value: 497add53525d16c173c2c1c733b8f655510e909ea78cc0e29d374243544b77a2
+- filename: python_dateutil-2.8.0-py2.py3-none-any.whl
+  url: https://files.pythonhosted.org/packages/41/17/c62faccbfbd163c7f57f3844689e3a78bae1f403648a6afb1d0866d87fbb/python_dateutil-2.8.0-py2.py3-none-any.whl
+  validation:
+    type: sha256
+    value: 7e6584c74aeed623791615e26efd690f29817a27c73085b78e4bad02493df2fb
+- filename: setuptools-50.0.0-py3-none-any.whl
+  url: https://files.pythonhosted.org/packages/b0/8b/379494d7dbd3854aa7b85b216cb0af54edcb7fce7d086ba3e35522a713cf/setuptools-50.0.0-py3-none-any.whl
+  validation:
+    type: sha256
+    value: 1e842b6dc37a1282f95a05551efe2c4bd09ddca8dd506ed3aa635a9fb6d15309
+- filename: python_dateutil-2.8.1-py2.py3-none-any.whl
+  url: https://files.pythonhosted.org/packages/d4/70/d60450c3dd48ef87586924207ae8907090de0b306af2bce5d134d78615cb/python_dateutil-2.8.1-py2.py3-none-any.whl
+  validation:
+    type: sha256
+    value: 75bb3f31ea686f1197762692a9ee6a7550b59fc6ca3a1f4b5d7e32fb98e2da2a
+- filename: paramiko-2.4.2-py2.py3-none-any.whl
+  url: https://files.pythonhosted.org/packages/cf/ae/94e70d49044ccc234bfdba20114fa947d7ba6eb68a2e452d89b920e62227/paramiko-2.4.2-py2.py3-none-any.whl
+  validation:
+    type: sha256
+    value: 3c16b2bfb4c0d810b24c40155dbfd113c0521e7e6ee593d704e84b4c658a1f3b
+- filename: boto3-1.9.128-py2.py3-none-any.whl
+  url: https://files.pythonhosted.org/packages/bc/2d/831406bd8ad5846aef015f98cfb8ebee6a4830bdc3b3bf14ab378f79c970/boto3-1.9.128-py2.py3-none-any.whl
+  validation:
+    type: sha256
+    value: 9a133736098741ef8016fb22824c99f9bef8f39a0bfbb76f73fe8bf18373f726
+- filename: cryptography-2.7-cp34-abi3-manylinux1_x86_64.whl
+  url: https://files.pythonhosted.org/packages/97/18/c6557f63a6abde34707196fb2cad1c6dc0dbff25a200d5044922496668a4/cryptography-2.7-cp34-abi3-manylinux1_x86_64.whl
+  validation:
+    type: sha256
+    value: 96d8473848e984184b6728e2c9d391482008646276c3ff084a1bd89e15ff53a1
+- filename: docker-3.7.2-py2.py3-none-any.whl
+  url: https://files.pythonhosted.org/packages/48/68/c3afca1a5aa8d2997ec3b8ee822a4d752cf85907b321f07ea86888545152/docker-3.7.2-py2.py3-none-any.whl
+  validation:
+    type: sha256
+    value: 2b1f48041cfdcc9f6b5da0e04e0e326ded225e736762ade2060000e708f4c9b7
+- filename: requests-2.20.0-py2.py3-none-any.whl
+  url: https://files.pythonhosted.org/packages/f1/ca/10332a30cb25b627192b4ea272c351bce3ca1091e541245cccbace6051d8/requests-2.20.0-py2.py3-none-any.whl
+  validation:
+    type: sha256
+    value: a84b8c9ab6239b578f22d1c21d51b696dcfe004032bb80ea832398d6909d7279
+- filename: mock-2.0.0-py2.py3-none-any.whl
+  url: https://files.pythonhosted.org/packages/e6/35/f187bdf23be87092bd0f1200d43d23076cee4d0dec109f195173fd3ebc79/mock-2.0.0-py2.py3-none-any.whl
+  validation:
+    type: sha256
+    value: 5ce3c71c5545b472da17b72268978914d0252980348636840bd34a00b5cc96c1
+- filename: pyrsistent-0.16.1.tar.gz
+  url: https://files.pythonhosted.org/packages/80/18/1492d651693ef7d40e0a40377ed56a8cc5c5fe86073eb6c56e53513f4480/pyrsistent-0.16.1.tar.gz
+  validation:
+    type: sha256
+    value: aa2ae1c2e496f4d6777f869ea5de7166a8ccb9c2e06ebcf6c7ff1b670c98c5ef
+- filename: six-1.14.0-py2.py3-none-any.whl
+  url: https://files.pythonhosted.org/packages/65/eb/1f97cb97bfc2390a276969c6fae16075da282f5058082d4cb10c6c5c1dba/six-1.14.0-py2.py3-none-any.whl
+  validation:
+    type: sha256
+    value: 8f3cd2e254d8f793e7f3d6d9df77b92252b52637291d0f0da013c76ea2724b6c
+- filename: docker_compose-1.25.2-py2.py3-none-any.whl
+  url: https://files.pythonhosted.org/packages/a0/dd/6ecfedfb035567bb3be1b895ef036bfe9183917c8746b97ea1a94d1fabd5/docker_compose-1.25.2-py2.py3-none-any.whl
+  validation:
+    type: sha256
+    value: 93f8a0eb1909aebbefaeeb172b35507a4d04b88962b02ac11c08c92a545678cd
+- filename: Jinja2-2.11.2-py2.py3-none-any.whl
+  url: https://files.pythonhosted.org/packages/30/9e/f663a2aa66a09d838042ae1a2c5659828bb9b41ea3a6efa20a20fd92b121/Jinja2-2.11.2-py2.py3-none-any.whl
+  validation:
+    type: sha256
+    value: f0a4641d3cf955324a89c04f3d94663aa4d638abe8f733ecd3582848e1c37035
+- filename: PyNaCl-1.4.0-cp35-abi3-manylinux1_x86_64.whl
+  url: https://files.pythonhosted.org/packages/9d/57/2f5e6226a674b2bcb6db531e8b383079b678df5b10cdaa610d6cf20d77ba/PyNaCl-1.4.0-cp35-abi3-manylinux1_x86_64.whl
+  validation:
+    type: sha256
+    value: 30f9b96db44e09b3304f9ea95079b1b7316b2b4f3744fe3aaecccd95d547063d
+- filename: pyasn1-0.4.8-py2.py3-none-any.whl
+  url: https://files.pythonhosted.org/packages/62/1e/a94a8d635fa3ce4cfc7f506003548d0a2447ae76fd5ca53932970fe3053f/pyasn1-0.4.8-py2.py3-none-any.whl
+  validation:
+    type: sha256
+    value: 39c7e2ec30515947ff4e87fb6f456dfc6e84857d34be479c9d4a4ba4bf46aa5d
+- filename: bcrypt-3.2.0-cp36-abi3-manylinux2010_x86_64.whl
+  url: https://files.pythonhosted.org/packages/26/70/6d218afbe4c73538053c1016dd631e8f25fffc10cd01f5c272d7acf3c03d/bcrypt-3.2.0-cp36-abi3-manylinux2010_x86_64.whl
+  validation:
+    type: sha256
+    value: cd1ea2ff3038509ea95f687256c46b79f5fc382ad0aa3664d200047546d511d1
+- filename: botocore-1.12.253-py2.py3-none-any.whl
+  url: https://files.pythonhosted.org/packages/8e/7b/88f10115b4748f86be6b7b1d8761ba5023fccf6e6cbe762e368f63eddcf9/botocore-1.12.253-py2.py3-none-any.whl
+  validation:
+    type: sha256
+    value: dc080aed4f9b220a9e916ca29ca97a9d37e8e1d296fe89cbaeef929bf0c8066b
+- filename: s3transfer-0.2.1-py2.py3-none-any.whl
+  url: https://files.pythonhosted.org/packages/16/8a/1fc3dba0c4923c2a76e1ff0d52b305c44606da63f718d14d3231e21c51b0/s3transfer-0.2.1-py2.py3-none-any.whl
+  validation:
+    type: sha256
+    value: b780f2411b824cb541dbcd2c713d0cb61c7d1bcadae204cdddda2b35cef493ba
+- filename: jmespath-0.10.0-py2.py3-none-any.whl
+  url: https://files.pythonhosted.org/packages/07/cb/5f001272b6faeb23c1c9e0acc04d48eaaf5c862c17709d20e3469c6e0139/jmespath-0.10.0-py2.py3-none-any.whl
+  validation:
+    type: sha256
+    value: cdf6525904cc597730141d61b36f2e4b8ecc257c420fa2f4549bac2c2d0cb72f
+- filename: asn1crypto-1.4.0-py2.py3-none-any.whl
+  url: https://files.pythonhosted.org/packages/b5/a8/56be92dcd4a5bf1998705a9b4028249fe7c9a035b955fe93b6a3e5b829f8/asn1crypto-1.4.0-py2.py3-none-any.whl
+  validation:
+    type: sha256
+    value: 4bcdf33c861c7d40bdcd74d8e4dd7661aac320fcdf40b9a3f95b4ee12fde2fa8
+- filename: cffi-1.14.3-cp38-cp38-manylinux1_x86_64.whl
+  url: https://files.pythonhosted.org/packages/c6/60/44b6c54dbbee7d5eafbc34e0a0b67207e85906fe8e36c830dfd3966dde1d/cffi-1.14.3-cp38-cp38-manylinux1_x86_64.whl
+  validation:
+    type: sha256
+    value: 529c4ed2e10437c205f38f3691a68be66c39197d01062618c55f74294a4a4828
+- filename: docker_pycreds-0.4.0-py2.py3-none-any.whl
+  url: https://files.pythonhosted.org/packages/f5/e8/f6bd1eee09314e7e6dee49cbe2c5e22314ccdb38db16c9fc72d2fa80d054/docker_pycreds-0.4.0-py2.py3-none-any.whl
+  validation:
+    type: sha256
+    value: 7266112468627868005106ec19cd0d722702d2b7d5912a28e19b826c3d37af49
+- filename: websocket_client-0.57.0-py2.py3-none-any.whl
+  url: https://files.pythonhosted.org/packages/4c/5f/f61b420143ed1c8dc69f9eaec5ff1ac36109d52c80de49d66e0c36c3dfdf/websocket_client-0.57.0-py2.py3-none-any.whl
+  validation:
+    type: sha256
+    value: 0fc45c961324d79c781bab301359d5a1b00b13ad1b10415a4780229ef71a5549
+- filename: idna-2.7-py2.py3-none-any.whl
+  url: https://files.pythonhosted.org/packages/4b/2a/0276479a4b3caeb8a8c1af2f8e4355746a97fab05a372e4a2c6a6b876165/idna-2.7-py2.py3-none-any.whl
+  validation:
+    type: sha256
+    value: 156a6814fb5ac1fc6850fb002e0852d56c0c8d2531923a51032d1b70760e186e
+- filename: chardet-3.0.4-py2.py3-none-any.whl
+  url: https://files.pythonhosted.org/packages/bc/a9/01ffebfb562e4274b6487b4bb1ddec7ca55ec7510b22e4c51f14098443b8/chardet-3.0.4-py2.py3-none-any.whl
+  validation:
+    type: sha256
+    value: fc323ffcaeaed0e0a02bf4d117757b98aed530d9ed4531e3e15460124c106691
+- filename: certifi-2020.6.20-py2.py3-none-any.whl
+  url: https://files.pythonhosted.org/packages/5e/c4/6c4fe722df5343c33226f0b4e0bb042e4dc13483228b4718baf286f86d87/certifi-2020.6.20-py2.py3-none-any.whl
+  validation:
+    type: sha256
+    value: 8fc0819f1f30ba15bdb34cceffb9ef04d99f420f68eb75d901e9560b8749fc41
+- filename: urllib3-1.24.3-py2.py3-none-any.whl
+  url: https://files.pythonhosted.org/packages/01/11/525b02e4acc0c747de8b6ccdab376331597c569c42ea66ab0a1dbd36eca2/urllib3-1.24.3-py2.py3-none-any.whl
+  validation:
+    type: sha256
+    value: a637e5fae88995b256e3409dc4d52c2e2e0ba32c42a6365fee8bbd2238de3cfb
+- filename: pbr-5.5.0-py2.py3-none-any.whl
+  url: https://files.pythonhosted.org/packages/c1/a3/d439f338aa90edd5ad9096cd56564b44882182150e92148eb14ceb7488ba/pbr-5.5.0-py2.py3-none-any.whl
+  validation:
+    type: sha256
+    value: 5adc0f9fc64319d8df5ca1e4e06eea674c26b80e6f00c530b18ce6a6592ead15
+- filename: cached_property-1.5.2-py2.py3-none-any.whl
+  url: https://files.pythonhosted.org/packages/48/19/f2090f7dad41e225c7f2326e4cfe6fff49e57dedb5b53636c9551f86b069/cached_property-1.5.2-py2.py3-none-any.whl
+  validation:
+    type: sha256
+    value: df4f613cf7ad9a588cc381aaf4a512d26265ecebd5eb9e1ba12f1319eb85a6a0
+- filename: docopt-0.6.2.tar.gz
+  url: https://files.pythonhosted.org/packages/a2/55/8f8cab2afd404cf578136ef2cc5dfb50baa1761b68c9da1fb1e4eed343c9/docopt-0.6.2.tar.gz
+  validation:
+    type: sha256
+    value: 49b3a825280bd66b3aa83585ef59c4a8c82f2c8a522dbe754a8bc8d08c85c491
+- filename: dockerpty-0.4.1.tar.gz
+  url: https://files.pythonhosted.org/packages/8d/ee/e9ecce4c32204a6738e0a5d5883d3413794d7498fe8b06f44becc028d3ba/dockerpty-0.4.1.tar.gz
+  validation:
+    type: sha256
+    value: 69a9d69d573a0daa31bcd1c0774eeed5c15c295fe719c61aca550ed1393156ce
+- filename: jsonschema-3.2.0-py2.py3-none-any.whl
+  url: https://files.pythonhosted.org/packages/c5/8f/51e89ce52a085483359217bc72cdbf6e75ee595d5b1d4b5ade40c7e018b8/jsonschema-3.2.0-py2.py3-none-any.whl
+  validation:
+    type: sha256
+    value: 4e5b3cf8216f577bee9ce139cbe72eca3ea4f292ec60928ff24758ce626cd163
+- filename: texttable-1.6.3-py2.py3-none-any.whl
+  url: https://files.pythonhosted.org/packages/06/f5/46201c428aebe0eecfa83df66bf3e6caa29659dbac5a56ddfd83cae0d4a4/texttable-1.6.3-py2.py3-none-any.whl
+  validation:
+    type: sha256
+    value: f802f2ef8459058736264210f716c757cbf85007a30886d8541aa8c3404f1dda
+- filename: PyYAML-5.3.1.tar.gz
+  url: https://files.pythonhosted.org/packages/64/c2/b80047c7ac2478f9501676c988a5411ed5572f35d1beff9cae07d321512c/PyYAML-5.3.1.tar.gz
+  validation:
+    type: sha256
+    value: b8eac752c5e14d3eca0e6dd9199cd627518cb5ec06add0de9d32baeee6fe645d
+- filename: MarkupSafe-1.1.1-cp38-cp38-manylinux1_x86_64.whl
+  url: https://files.pythonhosted.org/packages/4b/20/f6d7648c81cb84815d0be935d5c74cd1cc0239e43eadb1a61062d34b6543/MarkupSafe-1.1.1-cp38-cp38-manylinux1_x86_64.whl
+  validation:
+    type: sha256
+    value: 13d3144e1e340870b25e7b10b98d779608c02016d5184cfb9927a9f10c689f42
+- filename: docutils-0.15.2-py3-none-any.whl
+  url: https://files.pythonhosted.org/packages/22/cd/a6aa959dca619918ccb55023b4cb151949c64d4d5d55b3f4ffd7eee0c6e8/docutils-0.15.2-py3-none-any.whl
+  validation:
+    type: sha256
+    value: 6c4f696463b79f1fb8ba0c594b63840ebd41f059e92b31957c46b74a4599b6d0
+- filename: pycparser-2.20-py2.py3-none-any.whl
+  url: https://files.pythonhosted.org/packages/ae/e7/d9c3a176ca4b02024debf82342dab36efadfc5776f9c8db077e8f6e71821/pycparser-2.20-py2.py3-none-any.whl
+  validation:
+    type: sha256
+    value: 7582ad22678f0fcd81102833f60ef8d0e57288b6b5fb00323d101be910e35705
+- filename: attrs-20.2.0-py2.py3-none-any.whl
+  url: https://files.pythonhosted.org/packages/14/df/479736ae1ef59842f512548bacefad1abed705e400212acba43f9b0fa556/attrs-20.2.0-py2.py3-none-any.whl
+  validation:
+    type: sha256
+    value: fce7fc47dfc976152e82d53ff92fa0407700c21acd20886a13777a0d20e655dc
+- filename: jsonnet
+  url: https://ironbank-files.s3.amazonaws.com/jsonnet
+  validation:
+    type: sha256
+    value: 9ce7dfdedd3b742bd9a0afb8aa25afe3f5e040e80754aba01868f4a6ae163a2a 
+
+# List of project maintainers
+maintainers:
+- name: "Scott Stroud"
+  username: "scottstroud"
+  email: "confluent-fed@confluent.io"
+  cht_member: false  
+- name: "Preston McGowan"
+  username: "preston.mcgowan"
+  email: "confluent-fed@confluent.io"
+  cht_member: false  
+  
\ No newline at end of file

scripts/build-image.sh

+#!/bin/bash
+start=`date +%s`
+
+##
+# Docker Dependencies: 
+#   https://docs.confluent.io/current/installation/docker/image-reference.html#image-reference
+
+##
+# Settings for the build process
+
+if [[ -f .env ]]; then
+    echo "Loading in '.env' for values ..."
+    export $(grep -v '^#' .env | xargs)
+    echo " "
+elif [[ -f ../.env ]]; then
+    echo "Loading in PARENT '.env' for values ..."
+    export $(grep -v '^#' ../.env | xargs)
+    echo " "
+fi
+
+# The BASE_ is used by PlatformOne to change the base image, we will make use of RedHat
+BASE_REGISTRY=${BASE_REGISTRY:-'registry1.dso.mil'}
+MANI='hardening_manifest.yaml'
+
+cd ../
+
+## parse manifest with yq (https://github.com/mikefarah/yq)
+name=$(yq e '.name' $MANI)
+tags=( $(yq e '.tags.[]' $MANI) )
+baseImage=$(yq e '.args.BASE_IMAGE' $MANI)
+baseTag=$(yq e '.args.BASE_TAG' $MANI)
+
+echo "Starting $name build ..."
+
+echo "$name docker build ..."
+
+if [[ "$1" == "--squash" ]]; then
+  echo "Squashing like a cockroach ..."
+  DOCKER_BUILDKIT=1 docker build \
+    --squash \
+    --tag $BASE_REGISTRY/$name:latest \
+    --build-arg BASE_REGISTRY=$BASE_REGISTRY \
+    --build-arg BASE_IMAGE=$baseImage \
+    --build-arg BASE_TAG=$baseTag \
+    . 
+else
+  DOCKER_BUILDKIT=1 docker build \
+    --tag $BASE_REGISTRY/$name:latest \
+    --build-arg BASE_REGISTRY=$BASE_REGISTRY \
+    --build-arg BASE_IMAGE=$baseImage \
+    --build-arg BASE_TAG=$baseTag \
+    .  
+fi
+
+for tag in "${tags[@]}";do
+  docker tag $BASE_REGISTRY/$name:latest $BASE_REGISTRY/$name:$tag
+  echo "🏷 Tagged build with $BASE_REGISTRY/$name:$tag" 
+done
+
+cd scripts
+
+end=`date +%s`
+duration=$((end-start))
+echo "🏁 Finished $CONTAINER build (${duration} seconds)"
\ No newline at end of file

scripts/genManifestTemplate.sh

+if [[ -f .env ]]; then
+    echo "Loading in '.env' for values ..."
+    export $(grep -v '^#' .env | xargs)
+    echo " "
+fi
+
+VERSION=${VERSION:-'6.1.1.0'}
+
+SCRIPTS_HOME="$( cd "$( dirname "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )"
+PROJECT_HOME=${PROJECT_HOME:-'../'}
+PROJECT_HOME=$(realpath $PROJECT_HOME)
+
+myShaRona () {  
+    myfile=$(basename $1)
+    mydir=$(dirname $1)
+
+    mkdir -p $mydir
+    if [ ! -e "$mydir/filelist.txt" ] ; then
+        touch "$mydir/filelist.txt"
+    fi
+
+    if [[ "$OSTYPE" == "darwin"* ]] ; then
+        mySha=$(shasum -a 256 $1 | cut -d " " -f 1)
+    else
+        mySha=$(sha256sum $1 | cut -d " " -f 1)
+    fi
+
+    echo -e "$myfile | $mySha" >> $mydir/filelist.txt
+}
+
+filelist () {
+    rm -f $1/filelist.txt
+
+    for filename in $1/*; do
+        myShaRona $filename
+    done
+}
+
+if [ $# -eq 0 ]; then
+    echo "filelist.txt or dir path argument required "
+    exit 1
+fi
+
+# if there is not a filelist.txt, generate one
+if [ -f "$1" ]; then
+    filefile=$(realpath $1)
+elif [ -f "$1/filelist.txt" ]; then
+    filefile=$(realpath $1)/filelist.txt
+elif [ -d "$1" ]; then
+    filefile=$(realpath $1)/filelist.txt
+fi
+
+filelist $1
+
+basedir=$(dirname $filefile)
+cd $basedir
+
+if [[ $filefile == *"ironbank-files"* ]]; then
+    urlPrefix="https://ironbank-files.s3.amazonaws.com"
+elif [[ $filefile == *"confluent"* ]]; then
+    urlPrefix="https://packages.confluent.io/rpm/${VERSION:0:3}"
+elif [[ $filefile == *"pythonhosted"* ]]; then
+    echo "unsupported cause of the weird guid in the path"
+    exit 0
+fi
+
+echo "resources:" > $basedir/hardened_manifest_template.yaml
+
+while IFS= read -r line
+do
+IFS=" | " read -a parts <<< $line
+cat >> $basedir/hardened_manifest_template.yaml << EOL
+- filename: ${parts[0]}
+  url: ${urlPrefix}/${parts[0]}
+  validation:
+    type: sha256
+    value: ${parts[1]}
+EOL
+
+done < "$filefile"
\ No newline at end of file

scripts/importArtifacts.sh

+
+#!/bin/bash
+
+start=`date +%s`
+
+if [[ -f .env ]]; then
+    echo "Loading in '.env' for values ..."
+    export $(grep -v '^#' .env | xargs)
+    echo " "
+fi
+
+SCRIPTS_HOME="$( cd "$( dirname "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )"
+PROJECT_HOME=${PROJECT_HOME:-'../'}
+PROJECT_HOME=$(realpath $PROJECT_HOME)
+RESOURCE_HOME=${RESOURCE_HOME:-'../../resources'}
+RESOURCE_HOME=$(realpath $RESOURCE_HOME)
+
+importArtifacts() {
+    
+    manifestPath=$1
+    httpdomain=$2
+    resourceDir=$3
+
+    echo -e "\nImporting ${httpdomain} artifacts ..."
+
+    maniDir=$(dirname "$manifestPath")
+
+    # (re)set the filelist.txt
+    mkdir -p $resourceDir    
+    prefix="url: "
+    pushd $resourceDir
+        grep $httpdomain $manifestPath | while read -r line ; do
+            url=${line##*$prefix}
+            filename=$(basename "$url")
+            
+            if [[ ! -f "$filename" ]]; then
+                echo "downloading ${url} ..."
+                wget $url            
+            else
+                echo "Using existing $filename. Run ./clean.sh if thats not desired."
+            fi
+
+            if [[ ! -f "$maniDir/$filename" ]]; then
+                echo "copying ${filename} into ${maniDir} ..."
+                cp $filename $maniDir/
+            fi
+        done
+    popd
+}
+    
+mani=$(realpath "../hardening_manifest.yaml")
+
+importArtifacts $mani 'ironbank-files.s3.amazonaws.com' "$RESOURCE_HOME/ironbank-files"
+importArtifacts $mani 'packages.confluent.io' "$RESOURCE_HOME/confluent"
+importArtifacts $mani 'files.pythonhosted.org' "$RESOURCE_HOME/pythonhosted"
+
+echo "Generating hardening_manifest_template.yaml ..."
+$SCRIPTS_HOME/genManifestTemplate.sh "$RESOURCE_HOME/ironbank-files"
+$SCRIPTS_HOME/genManifestTemplate.sh "$RESOURCE_HOME/confluent"
+$SCRIPTS_HOME/genManifestTemplate.sh "$RESOURCE_HOME/pythonhosted"
+
+end=`date +%s`
+duration=$((end-start))
+echo "#########################"
+echo "All done (${duration} seconds)"
+echo "#########################"
+

scripts/licenses/confluent.txt

+Copyright 2019 Confluent, Inc.

scripts/parser.py

+#!/usr/bin/env python
+
+import json
+import sys
+
+pod_name = sys.argv[1]
+json_file_path = sys.argv[2]
+dest_folder = sys.argv[3]
+
+def create_file(file_name, data):
+    '''
+    create a file: file name is based on the key on the json with appended path.
+    '''
+    with open(file_name, 'w') as out_file:
+        for key, value in data.items():
+            if isinstance(value, int) or isinstance(value, float) :
+                value = str(value)
+            out_file.write(key+"="+value+"\n")
+
+def read_file(file_name):
+    '''
+    Read a file and print each line
+    '''
+    with open(file_name, 'r') as out_file:
+        lines = out_file.readlines()
+        for line in lines:
+            sys.stdout.write(line)
+            
+
+def read_json_file(file_name):
+    '''
+    read a json file
+    '''
+    with open(file_name, 'r') as file:
+        data = json.load(file)
+    return data
+##
+## create required files
+d = read_json_file(json_file_path)
+for key in d:
+    dest_file_path = "/".join([dest_folder, key])
+    create_file(dest_file_path, d[key])
+    print(dest_file_path)
+    read_file(dest_file_path)

scripts/startup.sh

+#!/usr/bin/env sh
+
+set -ox errexit
+if [[ -z ${POD_NAME} ]]; then
+    echo "Environment variable POD_NAME not found..."
+    env
+    exit
+fi
+pod_id=${POD_NAME}
+id=${pod_id##*-};
+pod_name=${POD_NAME%-*}
+cat /mnt/config/pod/${pod_name}/template.jsonnet | base64 -d > /opt/template.jsonnet
+/usr/local/bin/jsonnet /opt/template.jsonnet --ext-str id=${id} -o /opt/${pod_name}.json
+cat /opt/${pod_name}.json
+/opt/parser.py ${pod_name} /opt/${pod_name}.json /mnt/config