diff --git a/Dockerfile b/Dockerfile index e5f7f2caa01093c18614c0d09d62354897bb9cf0..0aee5b2037d3e2ea2ea3625bf2ea2484c614d0e3 100644 --- a/Dockerfile +++ b/Dockerfile @@ -6,25 +6,33 @@ ARG BASE_REGISTRY=nexus-docker-secure.levelup-nexus.svc.cluster.local:18082 ARG BASE_IMAGE=redhat/ubi/ubi8 ARG BASE_TAG=8.2 -FROM ${BASE_REGISTRY}/${BASE_IMAGE}:${BASE_TAG} -EXPOSE 5601 +FROM ${BASE_REGISTRY}/${BASE_IMAGE}:${BASE_TAG} as prep_files RUN yum update --setopt=tsflags=nodocs -y && \ - yum install -y tar gzip fontconfig freetype shadow-utils && \ + yum install -y tar gzip && \ yum clean all RUN mkdir /usr/share/kibana WORKDIR /usr/share/kibana +COPY --chown=1000:0 kibana-7.9.2-linux-x86_64.tar.gz . +RUN tar --strip-components=1 -zxf kibana-7.9.2-linux-x86_64.tar.gz +# Ensure that group permissions are the same as user permissions. +# This will help when relying on GID-0 to run Kibana, rather than UID-1000. +# OpenShift does this, for example. +# REF: https://docs.openshift.org/latest/creating_images/guidelines.html +RUN chmod -R g=u /usr/share/kibana -ARG TARBALL=kibana-7.8.0-linux-x86_64.tar.gz -COPY --chown=1000:0 ${TARBALL} . +################################################################################ +# Build stage 1 +# Copy prepared files from the previous stage and complete the image. +################################################################################ +FROM ${BASE_REGISTRY}/${BASE_IMAGE}:${BASE_TAG} +EXPOSE 5601 -RUN tar --strip-components=1 -zxf ${TARBALL} && \ - rm -rf ${TARBALL} && \ - ln -s /usr/share/kibana /opt/kibana && \ - chown -R 1000:0 . && \ - chmod -R g=u /usr/share/kibana +RUN yum update --setopt=tsflags=nodocs -y && \ + yum install -y fontconfig freetype shadow-utils && \ + yum clean all COPY LICENSE /licenses/elastic-kibana @@ -33,6 +41,10 @@ WORKDIR /usr/local/bin COPY dumb-init /usr/local/bin/dumb-init RUN chmod +x /usr/local/bin/dumb-init +# Bring in Kibana from the initial stage. +COPY --from=prep_files --chown=1000:0 /usr/share/kibana /usr/share/kibana +WORKDIR /usr/share/kibana +RUN ln -s /usr/share/kibana /opt/kibana ENV ELASTIC_CONTAINER true ENV PATH=/usr/share/kibana/bin:$PATH @@ -44,6 +56,9 @@ COPY --chown=1000:0 config/kibana.yml /usr/share/kibana/config/kibana.yml # variables and translate them to Kibana CLI options. COPY --chown=1000:0 scripts/kibana-docker /usr/local/bin/ +# Ensure gid 0 write permissions for OpenShift. +RUN chmod g+ws /usr/share/kibana && find /usr/share/kibana -gid 0 -and -not -perm /g+w -exec chmod g+w {} \; + # Remove the suid bit everywhere to mitigate "Stack Clash" RUN find / -xdev -perm -4000 -exec chmod u-s {} + @@ -51,7 +66,7 @@ RUN find / -xdev -perm -4000 -exec chmod u-s {} + RUN groupadd --gid 1000 kibana && useradd --uid 1000 --gid 1000 --home-dir /usr/share/kibana --no-create-home kibana USER kibana -LABEL org.label-schema.schema-version="1.0" org.label-schema.vendor="Elastic" org.label-schema.name="kibana" org.label-schema.version="7.8.0" org.label-schema.url="https://www.elastic.co/products/kibana" org.label-schema.vcs-url="https://github.com/elastic/kibana" org.label-schema.license="Elastic License" license="Elastic License" +LABEL org.label-schema.schema-version="1.0" org.label-schema.vendor="Elastic" org.label-schema.name="kibana" org.label-schema.version="7.9.2" org.label-schema.url="https://www.elastic.co/products/kibana" org.label-schema.vcs-url="https://github.com/elastic/kibana" org.label-schema.license="Elastic License" license="Elastic License" ENTRYPOINT ["/usr/local/bin/dumb-init", "--"] diff --git a/Jenkinsfile b/Jenkinsfile index eb27f6c3a970c24c581ec620b43a1ab16d63d491..1913f297efbd8756880d0822c8e35b8a05723b79 100644 --- a/Jenkinsfile +++ b/Jenkinsfile @@ -1,2 +1,2 @@ @Library('DCCSCR@master') _ -dccscrPipeline(version: '7.8.0') +dccscrPipeline(version: '7.9.2') diff --git a/README.md b/README.md index 532090dce64237ed6574cca4eed577dcc5b5e263..ca0151568900ed1a560e8603591e4f9c3e133ae8 100644 --- a/README.md +++ b/README.md @@ -7,23 +7,15 @@ understanding the impact rain might have on your quarterly numbers. For more information about Kibana, please visit https://www.elastic.co/products/kibana. -### Security Warning -Versions of `https-proxy-agent` prior to 2.2.3 are vulnerable to Machine-In-The-Middle. The package fails to enforce TLS on the socket if the proxy server responds the to the request with a HTTP status different than 200. This allows an attacker with access to the proxy server to intercept unencrypted communications, which may include sensitive information such as credentials. - -Because of this, If using the **ALL_PROXY** environment variable when installing plugins via the 'kibana-plugin install' command, it could be possible for an attacker to execute a MITM attack. - -DoD organizations **are not** allowed to use the **ALL_PROXY** environment variable until this issue is patched. - ### Installation instructions -Please follow the documentation on [running Kibana on Docker](https://www.elastic.co/guide/en/kibana/7.8/docker.html). +Please follow the documentation on [running Kibana on Docker](https://www.elastic.co/guide/en/kibana/7.9/docker.html). ### Where to file issues and PRs - [Issues](https://github.com/elastic/kibana/issues) - [PRs](https://github.com/elastic/kibana/pulls) - ### DoD Restrictions Due to the [NODE-SECURITY-1184](https://www.npmjs.com/advisories/1184) issue, Kibana users should not use the `ALL_PROXY` environment variable to specify a proxy when installing Kibana plugins with the kibana-plugin command line application. @@ -41,9 +33,9 @@ visiting [Elastic Community](https://www.elastic.co/community). This software is governed by the [Elastic -License](https://github.com/elastic/elasticsearch/blob/7.8/licenses/ELASTIC-LICENSE.txt), +License](https://github.com/elastic/elasticsearch/blob/7.9/licenses/ELASTIC-LICENSE.txt), and includes the full set of [free features](https://www.elastic.co/subscriptions). View the detailed release notes -[here](https://www.elastic.co/guide/en/elasticsearch/reference/7.8/es-release-notes.html). +[here](https://www.elastic.co/guide/en/elasticsearch/reference/7.9/es-release-notes.html). diff --git a/download.json b/download.json index 3712809650b42db605e0155b17038feee0a15a2a..7885611d39546a673aeaecef702615414011f595 100644 --- a/download.json +++ b/download.json @@ -1,11 +1,11 @@ { "resources": [ { - "url": "https://artifacts.elastic.co/downloads/kibana/kibana-7.8.0-linux-x86_64.tar.gz", - "filename": "kibana-7.8.0-linux-x86_64.tar.gz", + "url": "https://artifacts.elastic.co/downloads/kibana/kibana-7.9.2-linux-x86_64.tar.gz", + "filename": "kibana-7.9.2-linux-x86_64.tar.gz", "validation": { "type": "sha512", - "value": "3c9ffbbfe56b66226ff62740cbe8eae83e43b07a1e3aec2ca845398c7d4418fd9c3cf67bebf5d9dd77c285468265c23c46080762cd90df070cd03ebe92b3ebef" + "value": "79d7b836a93b496fa9dc58d3d2286ca6f6ad4d5c66558047a24841085b41c8beeae2a4f68a8883013b93e3036e029f76ebcb6e30080fc0b1979377b1f6d2b19a" } }, { diff --git a/scripts/kibana-docker b/scripts/kibana-docker index bed04a3eafd281bdf87bedfaaff0514571e4659e..b69fd8b70dcbe003f24a0a3b2ef244d24cc4e525 100755 --- a/scripts/kibana-docker +++ b/scripts/kibana-docker @@ -93,7 +93,6 @@ kibana_vars=( path.data pid.file regionmap - regionmap.includeElasticMapsService server.basePath server.customResponseHeaders server.compression.enabled @@ -175,7 +174,11 @@ kibana_vars=( xpack.infra.sources.default.fields.timestamp xpack.infra.sources.default.logAlias xpack.infra.sources.default.metricAlias + xpack.ingestManager.fleet.tlsCheckDisabled + xpack.ingestManager.registryUrl xpack.license_management.enabled + xpack.maps.enabled + xpack.maps.showMapVisualizationTypes xpack.ml.enabled xpack.reporting.capture.browser.autoDownload xpack.reporting.capture.browser.chromium.disableSandbox @@ -193,11 +196,16 @@ kibana_vars=( xpack.reporting.capture.viewport.width xpack.reporting.capture.zoom xpack.reporting.csv.checkForFormulas + xpack.reporting.csv.escapeFormulaValues xpack.reporting.csv.enablePanelActionDownload + xpack.reporting.csv.useByteOrderMarkEncoding xpack.reporting.csv.maxSizeBytes xpack.reporting.csv.scroll.duration xpack.reporting.csv.scroll.size xpack.reporting.capture.maxAttempts + xpack.reporting.capture.timeouts.openUrl + xpack.reporting.capture.timeouts.waitForElements + xpack.reporting.capture.timeouts.renderComplete xpack.reporting.enabled xpack.reporting.encryptionKey xpack.reporting.index @@ -232,9 +240,12 @@ kibana_vars=( xpack.security.session.idleTimeout xpack.security.session.lifespan xpack.security.loginAssistanceMessage + xpack.security.loginHelp xpack.security.public.protocol xpack.security.public.hostname xpack.security.public.port + xpack.spaces.enabled + xpack.spaces.maxSpaces telemetry.allowChangingOptInStatus telemetry.enabled telemetry.optIn @@ -273,3 +284,4 @@ umask 0002 # available for the container this process will run in. exec /usr/share/kibana/bin/kibana --cpu.cgroup.path.override=/ --cpuacct.cgroup.path.override=/ ${longopts} "$@" +