diff --git a/.github/workflows/arm-AL2023-build-test-push-workflow-AL2023.yml b/.github/workflows/arm-AL2023-build-test-push-workflow-AL2023.yml index 5e337a0cd..4f9f27a6e 100644 --- a/.github/workflows/arm-AL2023-build-test-push-workflow-AL2023.yml +++ b/.github/workflows/arm-AL2023-build-test-push-workflow-AL2023.yml @@ -94,10 +94,10 @@ jobs: - name: Build and push Splunk Operator Image run: | export PLATFORMS=linux/arm64 - export BASE_OS=public.ecr.aws/amazonlinux/amazonlinux - export BASE_OS_VERSION=2023 + export BASE_IMAGE=public.ecr.aws/amazonlinux/amazonlinux + export BASE_IMAGE_VERSION=2023 export IMG=${{ secrets.ECR_REPOSITORY }}/${{ env.SPLUNK_OPERATOR_IMAGE_NAME }}:$GITHUB_SHA - make docker-buildx PLATFORMS=$PLATFORMS BASE_OS=$BASE_OS BASE_OS_VERSION=$BASE_OS_VERSION IMG=$IMG + make docker-buildx PLATFORMS=$PLATFORMS BASE_IMAGE=$BASE_IMAGE BASE_IMAGE_VERSION=$BASE_IMAGE_VERSION IMG=$IMG - name: Sign Splunk Operator image with a key run: | cosign sign --yes --key env://COSIGN_PRIVATE_KEY ${{ secrets.ECR_REPOSITORY }}/${{ env.SPLUNK_OPERATOR_IMAGE_NAME }}:${{ github.sha }} diff --git a/.github/workflows/arm-AL2023-int-test-workflow.yml b/.github/workflows/arm-AL2023-int-test-workflow.yml index 7c3479313..4bb57bfb0 100644 --- a/.github/workflows/arm-AL2023-int-test-workflow.yml +++ b/.github/workflows/arm-AL2023-int-test-workflow.yml @@ -43,10 +43,10 @@ jobs: - name: Build and push Splunk Operator Image run: | export PLATFORMS=linux/arm64 - export BASE_OS=public.ecr.aws/amazonlinux/amazonlinux - export BASE_OS_VERSION=2023 + export BASE_IMAGE=public.ecr.aws/amazonlinux/amazonlinux + export BASE_IMAGE_VERSION=2023 export IMG=${{ secrets.ECR_REPOSITORY }}/${{ env.SPLUNK_OPERATOR_IMAGE_NAME }}:$GITHUB_SHA - make docker-buildx PLATFORMS=$PLATFORMS BASE_OS=$BASE_OS BASE_OS_VERSION=$BASE_OS_VERSION IMG=$IMG + make docker-buildx PLATFORMS=$PLATFORMS BASE_IMAGE=$BASE_IMAGE BASE_IMAGE_VERSION=$BASE_IMAGE_VERSION IMG=$IMG int-tests-arm-al2023: strategy: fail-fast: false diff --git a/.github/workflows/arm-Ubuntu-build-test-push-workflow.yml b/.github/workflows/arm-Ubuntu-build-test-push-workflow.yml index 4d7d7d2c7..64c8e0883 100644 --- a/.github/workflows/arm-Ubuntu-build-test-push-workflow.yml +++ b/.github/workflows/arm-Ubuntu-build-test-push-workflow.yml @@ -94,10 +94,10 @@ jobs: - name: Build and push Splunk Operator Image run: | export PLATFORMS=linux/arm64 - export BASE_OS=ubuntu - export BASE_OS_VERSION=24.10 + export BASE_IMAGE=ubuntu + export BASE_IMAGE_VERSION=24.10 export IMG=${{ secrets.ECR_REPOSITORY }}/${{ env.SPLUNK_OPERATOR_IMAGE_NAME }}:$GITHUB_SHA - make docker-buildx PLATFORMS=$PLATFORMS BASE_OS=$BASE_OS BASE_OS_VERSION=$BASE_OS_VERSION IMG=$IMG + make docker-buildx PLATFORMS=$PLATFORMS BASE_IMAGE=$BASE_IMAGE BASE_IMAGE_VERSION=$BASE_IMAGE_VERSION IMG=$IMG - name: Sign Splunk Operator image with a key run: | cosign sign --yes --key env://COSIGN_PRIVATE_KEY ${{ secrets.ECR_REPOSITORY }}/${{ env.SPLUNK_OPERATOR_IMAGE_NAME }}:${{ github.sha }} diff --git a/.github/workflows/arm-Ubuntu-int-test-workflow.yml b/.github/workflows/arm-Ubuntu-int-test-workflow.yml index e0dd03a78..fcb2e0350 100644 --- a/.github/workflows/arm-Ubuntu-int-test-workflow.yml +++ b/.github/workflows/arm-Ubuntu-int-test-workflow.yml @@ -43,10 +43,10 @@ jobs: - name: Build and push Splunk Operator Image run: | export PLATFORMS=linux/arm64 - export BASE_OS=ubuntu - export BASE_OS_VERSION=24.10 + export BASE_IMAGE=ubuntu + export BASE_IMAGE_VERSION=24.10 export IMG=${{ secrets.ECR_REPOSITORY }}/${{ env.SPLUNK_OPERATOR_IMAGE_NAME }}:$GITHUB_SHA - make docker-buildx PLATFORMS=$PLATFORMS BASE_OS=$BASE_OS BASE_OS_VERSION=$BASE_OS_VERSION IMG=$IMG + make docker-buildx PLATFORMS=$PLATFORMS BASE_IMAGE=$BASE_IMAGE BASE_IMAGE_VERSION=$BASE_IMAGE_VERSION IMG=$IMG int-tests-arm-ubuntu: strategy: fail-fast: false diff --git a/Dockerfile b/Dockerfile index 91901977b..fb9f06277 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,7 +1,7 @@ # Setup defaults for build arguments -ARG PLATFORMS ?= linux/amd64 -ARG BASE_OS ?= registry.access.redhat.com/ubi8/ubi -ARG BASE_OS_VERSION ?= 8.10 +ARG PLATFORMS=linux/amd64 +ARG BASE_IMAGE=registry.access.redhat.com/ubi8/ubi +ARG BASE_IMAGE_VERSION=8.10 # Build the manager binary FROM golang:1.23.0 as builder @@ -26,20 +26,31 @@ COPY hack hack/ # TARGETOS and TARGETARCH are provided(inferred) by buildx via the --platforms flag RUN CGO_ENABLED=0 GOOS=${TARGETOS} GOARCH=${TARGETARCH} go build -a -o manager main.go -# Use BASE_OS as the base image -FROM ${BASE_OS}:${BASE_OS_VERSION} +# Use BASE_IMAGE as the base image +FROM ${BASE_IMAGE}:${BASE_IMAGE_VERSION} ENV OPERATOR=/manager \ USER_UID=1001 \ USER_NAME=nonroot # Install necessary packages and configure user -RUN yum -y install shadow-utils && \ - useradd -ms /bin/bash nonroot -u 1001 && \ - yum update -y krb5-libs && yum clean all && \ - yum -y update-minimal --security --sec-severity=Important --sec-severity=Critical && \ - yum -y update-minimal --security --sec-severity=Moderate && \ - yum -y update-minimal --security --sec-severity=Low +RUN if grep -q 'Ubuntu' /etc/os-release; then \ + apt-get update && \ + apt-get install -y --no-install-recommends passwd=1:4.8.1-1ubuntu5.20.04 && \ + useradd -ms /bin/bash nonroot -u 1001 && \ + apt-get install -y --no-install-recommends krb5-locales=1.17-6ubuntu4.1 && \ + apt-get upgrade -y && \ + apt-get install -y --no-install-recommends unattended-upgrades=2.3ubuntu0.1 && \ + unattended-upgrades -v --security && \ + apt-get clean && rm -rf /var/lib/apt/lists/*; \ + else \ + yum -y install shadow-utils && \ + useradd -ms /bin/bash nonroot -u 1001 && \ + yum update -y krb5-libs && yum clean all && \ + yum -y update-minimal --security --sec-severity=Important --sec-severity=Critical && \ + yum -y update-minimal --security --sec-severity=Moderate && \ + yum -y update-minimal --security --sec-severity=Low; \ + fi # Metadata LABEL name="splunk" \ diff --git a/Makefile b/Makefile index bc57ee39d..4a28cdad2 100644 --- a/Makefile +++ b/Makefile @@ -152,16 +152,16 @@ docker-push: ## Push docker image with the manager. # Pass only what is required, the rest will be defaulted # Setup defaults for build arguments PLATFORMS ?= linux/amd64 -BASE_OS ?= registry.access.redhat.com/ubi8/ubi -BASE_OS_VERSION ?= 8.10 +BASE_IMAGE ?= registry.access.redhat.com/ubi8/ubi +BASE_IMAGE_VERSION ?= 8.10 docker-buildx: @if [ -z "$(IMG)" ]; then \ echo "Error: IMG is a mandatory argument. Usage: make docker-buildx IMG= ...."; \ exit 1; \ fi docker buildx build --push --platform="${PLATFORMS}" \ - --build-arg BASE_OS="${BASE_OS}" \ - --build-arg BASE_OS_VERSION="${BASE_OS_VERSION}" \ + --build-arg BASE_IMAGE="${BASE_IMAGE}" \ + --build-arg BASE_IMAGE_VERSION="${BASE_IMAGE_VERSION}" \ --tag "${IMG}" -f Dockerfile . ##@ Deployment