From 7d277903d7a6a72ee0f25ad2ad4658c0de810657 Mon Sep 17 00:00:00 2001
From: jweatherford <jweatherford@oteemo.com>
Date: Tue, 15 Dec 2020 08:16:58 -0500
Subject: [PATCH] hardening manifest migration

---
 Dockerfile              |  9 +-------
 Jenkinsfile             |  2 --
 download.yaml           |  8 -------
 hardening_manifest.yaml | 46 +++++++++++++++++++++++++++++++++++++++++
 4 files changed, 47 insertions(+), 18 deletions(-)
 delete mode 100644 Jenkinsfile
 delete mode 100644 download.yaml
 create mode 100644 hardening_manifest.yaml

diff --git a/Dockerfile b/Dockerfile
index 33666ef..3c6846b 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -17,14 +17,7 @@ RUN ./configure && \
         make install && \
         rm -f /opt/musl-1.2.0.tar.gz
 FROM kubeflow-images-public/katib/studyjob-controller:latest as base
-#FROM gcr.io/kubeflow-images-public/katib/studyjob-controller@sha256:31a3e1534c1f4d1feeb83c27dde5baac3ec66bf8ee7c684e2a9583b866fb8325 as base
 FROM ${BASE_REGISTRY}/${BASE_IMAGE}:${BASE_TAG}
-LABEL org.opencontainers.image.title="Katib-studyjob-controller" \
-      org.opencontainers.image.description="studyjob controller" \
-      org.opencontainers.image.licenses="Apache-2.0" \
-      org.opencontainers.image.url="gcr.io/kubeflow-images-public/katib/studyjob-controller@sha256:31a3e1534c1f4d1feeb83c27dde5baac3ec66bf8ee7c684e2a9583b866fb8325" \
-      org.opencontainers.image.version="latest" \
-      maintainer="cvernooy@oteemo.com"
 USER 0
 RUN dnf upgrade -y && \
         dnf clean all && \
@@ -39,4 +32,4 @@ RUN chown -R controller. /app
 RUN chmod +x /app/studyjobcontroller
 WORKDIR /app
 USER controller
-ENTRYPOINT ["./studyjobcontroller"] 
\ No newline at end of file
+ENTRYPOINT ["./studyjobcontroller"] 
diff --git a/Jenkinsfile b/Jenkinsfile
deleted file mode 100644
index 84a5119..0000000
--- a/Jenkinsfile
+++ /dev/null
@@ -1,2 +0,0 @@
-@Library('DCCSCR@master') _
-dccscrPipeline(version: "31a3e1534c1f")
diff --git a/download.yaml b/download.yaml
deleted file mode 100644
index 9db5228..0000000
--- a/download.yaml
+++ /dev/null
@@ -1,8 +0,0 @@
-resources:
-  - url: "docker://gcr.io/kubeflow-images-public/katib/studyjob-controller@sha256:31a3e1534c1f4d1feeb83c27dde5baac3ec66bf8ee7c684e2a9583b866fb8325"
-    tag: "kubeflow-images-public/katib/studyjob-controller:latest"
-  - url: "https://musl.libc.org/releases/musl-1.2.0.tar.gz"
-    filename: musl-1.2.0.tar.gz
-    validation:
-      type: sha256
-      value: c6de7b191139142d3f9a7b5b702c9cae1b5ee6e7f57e582da9328629408fd4e8          
\ No newline at end of file
diff --git a/hardening_manifest.yaml b/hardening_manifest.yaml
new file mode 100644
index 0000000..fd72372
--- /dev/null
+++ b/hardening_manifest.yaml
@@ -0,0 +1,46 @@
+---
+apiVersion: v1
+
+# The repository name in registry1, excluding /ironbank/
+name: "kubeflow/katib/studyjob-controller-31a3e1534c1f"
+
+# List of tags to push for the repository in registry1
+# The most specific version should be the first tag and will be shown
+# on ironbank.dsop.io
+tags:
+- "31a3e1534c1f"
+- "latest"
+
+# Build args passed to Dockerfile ARGs
+args:
+  BASE_IMAGE: "redhat/ubi/ubi8"
+  BASE_TAG: "8.3"
+
+# Docker image labels
+labels:
+  org.opencontainers.image.title: "studyjob-controller-31a3e1534c1f"
+  org.opencontainers.image.description: "This is a hardened version of the upstream image. This is not mean for solo deployment."
+  org.opencontainers.image.licenses: "Apache-2.0"
+  org.opencontainers.image.url: "gcr.io/kubeflow-images-public/katib/studyjob-controller@sha256:31a3e1534c1f4d1feeb83c27dde5baac3ec66bf8ee7c684e2a9583b866fb8325"
+  org.opencontainers.image.vendor: "Kubeflow"
+  org.opencontainers.image.version: "31a3e1534c1f"
+  mil.dso.ironbank.image.keywords: "kubeflow,kubernetes,katib,studyjob"
+  mil.dso.ironbank.image.type: "opensource"
+  mil.dso.ironbank.product.name: "kubeflow"
+
+# List of resources to make available to the offline build context
+resources:
+  - url: "docker://gcr.io/kubeflow-images-public/katib/studyjob-controller@sha256:31a3e1534c1f4d1feeb83c27dde5baac3ec66bf8ee7c684e2a9583b866fb8325"
+    tag: "kubeflow-images-public/katib/studyjob-controller:latest"
+  - url: "https://musl.libc.org/releases/musl-1.2.0.tar.gz"
+    filename: musl-1.2.0.tar.gz
+    validation:
+      type: sha256
+      value: c6de7b191139142d3f9a7b5b702c9cae1b5ee6e7f57e582da9328629408fd4e8
+
+# List of project maintainers
+maintainers:
+- email: "cvernooy@oteemo.com"
+  name: "cvernooy"
+  username: "Chris Vernooy"
+  cht_member: true
-- 
GitLab