Merge branch '2.6.0' into 'development'

2.6.0

See merge request dsop/confluent/confluentinc/confluent-operator-0.435.11!11

Dockerfile

+ARG CONFLUENT_OPERATOR_BASE_IMAGE=confluentinc/confluent-operator
+ARG CONFLUENT_OPERATOR_BASE_TAG=0.771.13
+
 ARG BASE_REGISTRY=registry1.dso.mil
 ARG BASE_IMAGE=redhat/ubi/ubi8
-ARG BASE_TAG=8.7
+ARG BASE_TAG=8.8
 
+FROM ${CONFLUENT_OPERATOR_BASE_IMAGE}:${CONFLUENT_OPERATOR_BASE_TAG} as base
 FROM ${BASE_REGISTRY}/${BASE_IMAGE}:${BASE_TAG}
 
 WORKDIR /opt
@@ -10,20 +14,27 @@ ENV LANG="C.UTF-8"
 
 USER root
 
-COPY --chown=root:root --chmod=755 manager /opt/
 COPY LICENSE /licenses/
 COPY Dockerfile /etc/confluent/ironbank/
 COPY hardening_manifest.yaml /etc/confluent/ironbank/
 
+## copy from dockerhub image
+COPY --from=base /licenses /licenses
+COPY --from=base /opt/manager /opt/manager
+
 RUN echo "===> Dependency update" \
         && dnf update -y --nodocs \
+        && chmod gu-s /usr/bin/write \
     && echo "===> Clean up, Clean up" \
         && dnf clean all \
         && yum clean all \
         && rm -rf /tmp/* /var/cache/dnf
 
-ENTRYPOINT ["/opt/manager"]
-
-HEALTHCHECK --interval=5s --timeout=5s --retries=5 CMD /bin/bash -c "ls /opt/manager"
+# Polling period  : 5 seconds
+# Timeout period  : 2 seconds (if the polling does not return within this time, treat as a failed poll)
+# Retry period    : 25 sec (after which container is deemed unhealthy)
+# All settings can be overriden at run-time in Docker/Docker Compose.
+HEALTHCHECK --interval=5s --timeout=2s --retries=5 \
+    CMD curl --fail --silent --output /dev/null http://localhost:8080/readyz || exit 1
 
-USER 1001
+USER 1001
\ No newline at end of file

README.md

-# confluent-operator
+# confluent-operator-2.6.x
 This repository creates the confluent-operator that is the core of Confluent for Kubernetes.
 Architecture: https://www.confluent.io/resources/apache-kafka-confluent-enterprise-reference-architecture/
 Operator Deployment: https://docs.confluent.io/operator/current/co-deployment.html

hardening_manifest.yaml

@@ -8,13 +8,17 @@ name: "confluentinc/confluent-operator"
 # The most specific version should be the first tag and will be shown
 # on ironbank.dso.mil
 tags:
-- "0.435.67"
-- "0.435"
-
+  - "2.6.0"
+  - "2.6"
+  - "0.771.13"
+  - "0.771"
+  
 # Build args passed to Dockerfile ARGs
 args:
+  CONFLUENT_OPERATOR_BASE_IMAGE: "confluentinc/confluent-operator"
+  CONFLUENT_OPERATOR_BASE_TAG: "0.771.13"
   BASE_IMAGE: "redhat/ubi/ubi8"
-  BASE_TAG: "8.7"
+  BASE_TAG: "8.8"
 
 # Docker image labels
 labels:
@@ -23,18 +27,15 @@ labels:
   org.opencontainers.image.licenses: "CONFLUENT ENTERPRISE LICENSE"
   org.opencontainers.image.url: "https://docs.confluent.io/current/installation/operator/index.html"
   org.opencontainers.image.vendor: "Confluent"
-  org.opencontainers.image.version: "0.435.67"
+  org.opencontainers.image.version: "0.771.13"
   mil.dso.ironbank.image.keywords: "confluent,kafka,zookeeper,operator"
   mil.dso.ironbank.image.type: "commercial"
   mil.dso.ironbank.product.name: "Confluent Platform"
 
 resources:
-- filename: manager
-  url: https://ironbank-files.s3.amazonaws.com/confluent-operator-0.435.67_OptManager
-  validation:
-    type: sha256
-    value: 97d7cfbc948b12396115acacb2e60dfd6b832461d4afda03840069ab72fedebd
-    
+  - tag: confluentinc/confluent-operator:0.771.13
+    url: docker://docker.io/confluentinc/confluent-operator:0.771.13
+
 # List of project maintainers
 maintainers:
 - name: "Scott Stroud"
@@ -48,4 +49,4 @@ maintainers:
 - name: "Gary Hott"
   username: "garyhott86"
   email: "confluent-fed@confluent.io"
-  cht_member: false  
+  cht_member: false    

scripts/importArtifacts.sh

@@ -24,9 +24,6 @@ importArtifacts() {
     echo -e "\nImporting ${httpdomain} artifacts ..."
 
     maniDir=$(dirname "$manifestPath")
-    if [[ ! -f "$maniDir/build-image.sh" ]]; then
-        cp build-image.sh $maniDir/
-    fi
 
     # (re)set the filelist.txt
     mkdir -p $resourceDir    
@@ -36,11 +33,19 @@ importArtifacts() {
             url=${line##*$prefix}
             filename=$(basename "$url")
             
-            if [[ ! -f "$filename" ]]; then
+            local=$(find $RESOURCE_HOME -name $filename)
+            echo "local $local"
+
+            if [[ -f "$filename" ]]; then
+                echo "AA"
+                echo "Using existing $filename. Run ./clean.sh if thats not desired."
+            elif [[ ! -z "$local" ]]; then
+                echo "BB"
+                echo "Using existing $local. Run ./clean.sh if thats not desired."
+                cp $local $maniDir/
+            else
                 echo "downloading ${url} ..."
                 wget $url            
-            else
-                echo "Using existing $filename. Run ./clean.sh if thats not desired."
             fi
 
             if [[ ! -f "$maniDir/$filename" ]]; then
@@ -55,12 +60,14 @@ mani=$(realpath "../hardening_manifest.yaml")
 
 importArtifacts $mani 'ironbank-files.s3.amazonaws.com' "$RESOURCE_HOME/ironbank-files"
 importArtifacts $mani 'packages.confluent.io' "$RESOURCE_HOME/confluent"
+importArtifacts $mani 's3.us-west-2.amazonaws.com/staging-confluent-packages' "$RESOURCE_HOME/confluent"
 importArtifacts $mani 'files.pythonhosted.org' "$RESOURCE_HOME/pythonhosted"
+importArtifacts $mani 'repo1.maven.org' "$RESOURCE_HOME/maven"
 
-echo "Generating hardening_manifest_template.yaml ..."
-$SCRIPTS_HOME/genManifestTemplate.sh "$RESOURCE_HOME/ironbank-files"
-$SCRIPTS_HOME/genManifestTemplate.sh "$RESOURCE_HOME/confluent"
-$SCRIPTS_HOME/genManifestTemplate.sh "$RESOURCE_HOME/pythonhosted"
+# echo "Generating hardening_manifest_template.yaml ..."
+# $SCRIPTS_HOME/genManifestTemplate.sh "$RESOURCE_HOME/ironbank-files"
+# $SCRIPTS_HOME/genManifestTemplate.sh "$RESOURCE_HOME/confluent"
+# $SCRIPTS_HOME/genManifestTemplate.sh "$RESOURCE_HOME/pythonhosted"
 
 end=`date +%s`
 duration=$((end-start))