diff --git a/.gitignore b/.gitignore index 498cdb88e8ced61d36984522d42d5c0dd96a46b7..fd2a1cd2cfe848cd1e3983c7476fd5d9080dd21f 100644 --- a/.gitignore +++ b/.gitignore @@ -1,4 +1,4 @@ # Ignore any locally downloaded or dropped releases *.tar.gz -dumb-init +tinit jq diff --git a/Dockerfile b/Dockerfile index 5e51c761290c81a0acd7825e3f52e7527ab958a8..23cef95ef502712347d129c13baac1377e1f1b3d 100644 --- a/Dockerfile +++ b/Dockerfile @@ -8,7 +8,7 @@ ARG BASE_TAG=8.3 FROM ${BASE_REGISTRY}/${BASE_IMAGE}:${BASE_TAG} as prep_files -ARG ELASTIC_STACK=7.10.0 +ARG ELASTIC_STACK=7.10.2 ARG ELASTIC_PRODUCT=elastic-agent ARG OS_AND_ARCH=linux-x86_64 @@ -44,9 +44,8 @@ ARG ELASTIC_PRODUCT=elastic-agent COPY LICENSE /licenses/elastic-${ELASTIC_PRODUCT} # Add a dumb init process -WORKDIR /usr/local/bin -COPY dumb-init /usr/local/bin/dumb-init -RUN chmod +x /usr/local/bin/dumb-init +COPY tinit /tinit +RUN chmod +x /tinit # Bring in product from the initial stage. COPY --from=prep_files --chown=1000:0 /usr/share/${ELASTIC_PRODUCT} /usr/share/${ELASTIC_PRODUCT} @@ -85,16 +84,7 @@ RUN chmod 755 /usr/local/bin/docker-entrypoint USER ${ELASTIC_PRODUCT} ENV ELASTIC_PRODUCT=${ELASTIC_PRODUCT} -# TODO update these links when Elastic Agent is in GA -LABEL org.label-schema.schema-version="1.0" \ - org.label-schema.vendor="Elastic" \ - org.label-schema.name="${ELASTIC_PRODUCT}" \ - org.label-schema.version="${ELASTIC_STACK}" \ - org.label-schema.url="https://www.elastic.co/guide/en/ingest-management/current/index.html" \ - org.label-schema.vcs-url="https://github.com/elastic/${ELASTIC_PRODUCT}" \ - org.label-schema.license="Elastic License" license="Elastic License" - -ENTRYPOINT ["/usr/local/bin/dumb-init", "--", "/usr/local/bin/docker-entrypoint"] +ENTRYPOINT ["/tinit", "--", "/usr/local/bin/docker-entrypoint"] CMD ["--environment", "container"] HEALTHCHECK --interval=10s --timeout=5s --start-period=1m --retries=5 CMD test -w '/tmp/elastic-agent/default/metricbeat/metricbeat.sock' diff --git a/Jenkinsfile b/Jenkinsfile deleted file mode 100644 index f60d67a16f97c28d8a3e13b718cf7462a86748c8..0000000000000000000000000000000000000000 --- a/Jenkinsfile +++ /dev/null @@ -1,2 +0,0 @@ -@Library('DCCSCR@master') _ -dccscrPipeline(version: '7.10.0') diff --git a/download.json b/download.json deleted file mode 100644 index 83a70e2a7e23da981f3b93565b2665b7fc822fcd..0000000000000000000000000000000000000000 --- a/download.json +++ /dev/null @@ -1,28 +0,0 @@ -{ - "resources": [ - { - "url": "https://artifacts.elastic.co/downloads/beats/elastic-agent/elastic-agent-7.10.0-linux-x86_64.tar.gz", - "filename": "elastic-agent-7.10.0-linux-x86_64.tar.gz", - "validation": { - "type": "sha512", - "value": "e539c13e83c80eb519b86004551b5c27af2946ae918f8d1cb894a50192dbcf0394c7022841cb5bcf86bd082423a001d810f73c544d312e70845412d6ccd71e48" - } - }, - { - "url": "https://github.com/Yelp/dumb-init/releases/download/v1.2.2/dumb-init_1.2.2_amd64", - "filename": "dumb-init", - "validation": { - "type": "sha256", - "value": "37f2c1f0372a45554f1b89924fbb134fc24c3756efaedf11e07f599494e0eff9" - } - }, - { - "url": "https://github.com/stedolan/jq/releases/download/jq-1.6/jq-linux64", - "filename": "jq", - "validation": { - "type": "sha256", - "value": "af986793a515d500ab2d35f8d2aecd656e764504b789b66d7e1a0b727a124c44" - } - } - ] -} diff --git a/hardening_manifest.yaml b/hardening_manifest.yaml new file mode 100644 index 0000000000000000000000000000000000000000..34c10d5137707a3be645f4b082de7459f2641272 --- /dev/null +++ b/hardening_manifest.yaml @@ -0,0 +1,75 @@ +--- +apiVersion: v1 + +# The repository name in registry1, excluding /ironbank/ +name: "elastic/beats/elastic-agent" + +# List of tags to push for the repository in registry1 +# The most specific version should be the first tag and will be shown +# on ironbank.dsop.io +tags: +- "7.10.2" +- "latest" + +# Build args passed to Dockerfile ARGs +args: + BASE_IMAGE: "redhat/ubi/ubi8" + BASE_TAG: "8.3" + BASE_REGISTRY: registry1.dsop.io + ELASTIC_STACK: "7.10.2" + ELASTIC_PRODUCT: "elastic-agent" + +# Docker image labels +labels: + org.opencontainers.image.title: "elastic-agent" + ## Human-readable description of the software packaged in the image + org.opencontainers.image.description: "elastic-agent is a single, unified way to add monitoring for logs, metrics, and other types of data to each host" + ## License(s) under which contained software is distributed + org.opencontainers.image.licenses: "Elastic License" + ## URL to find more information on the image + org.opencontainers.image.url: "https://www.elastic.co/products/beats/elastic-agent" + ## Name of the distributing entity, organization or individual + org.opencontainers.image.vendor: "Elastic" + org.opencontainers.image.version: "7.10.2" + ## Keywords to help with search (ex. "cicd,gitops,golang") + mil.dso.ironbank.image.keywords: "log,metrics,monitoring,observabilty,o11y,oblt,beats,elastic,elasticsearch,golang" + ## This value can be "opensource" or "commercial" + mil.dso.ironbank.image.type: "commercial" + ## Product the image belongs to for grouping multiple images + mil.dso.ironbank.product.name: "beats" + +# List of resources to make available to the offline build context +resources: +- filename: elastic-agent-7.10.2-linux-x86_64.tar.gz + url: https://artifacts.elastic.co/downloads/beats/elastic-agent/elastic-agent-7.10.2-linux-x86_64.tar.gz + validation: + type: sha512 + value: d6180e5b3d8d0a73f26772426791c3c6786ee835183de934accc920b617f527d177bd7b3316d2f8301d1ba83e03eeaf07531969de20b27ad293f215a361bd391 +- filename: tinit + url: https://github.com/krallin/tini/releases/download/v0.19.0/tini-amd64 + validation: + type: sha256 + value: 93dcc18adc78c65a028a84799ecf8ad40c936fdfc5f2a57b1acda5a8117fa82c + +- filename: jq + url: https://github.com/stedolan/jq/releases/download/jq-1.6/jq-linux64 + validation: + type: sha256 + value: af986793a515d500ab2d35f8d2aecd656e764504b789b66d7e1a0b727a124c44 + +# List of project maintainers +# FIXME: Fill in the following details for the current container owner in the whitelist +# FIXME: Include any other vendor information if applicable +maintainers: +- email: "nassim.kammah@elastic.co" + name: Nassim Kammah +- email: "ivan.fernandez@elastic.co" + name: Ivan Fernandez Calvo +# # The name of the current container owner +# name: "FIXME" +# # The gitlab username of the current container owner +# username: "FIXME" +# cht_member: true # FIXME: Uncomment if the maintainer is a member of CHT +# - name: "FIXME" +# username: "FIXME" +# email: "FIXME"