github-mirrors/logstash
1
0
Fork 0
mirror of https://github.com/elastic/logstash.git synced 2025-06-28 01:37:28 -04:00
Code Issues Projects Releases Packages Wiki Activity

Remove jinja2 in favor of erb templates (#15142)

Browse source 
This commit removes the jinja2 templates and consequently the dependency on Python
This commit is contained in:
João Duarte 2024-02-09 13:49:58 +00:00 • committed by GitHub
parent 52ce3ff8f6
commit de01eb6ee3
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
6 changed files with 148 additions and 192 deletions
Download patch file Download diff file Expand all files Collapse all files

132
docker/Makefile
View file

@ -1,7 +1,5 @@
SHELL=/bin/bash SHELL=/bin/bash
ELASTIC_REGISTRY ?= docker.elastic.co ELASTIC_REGISTRY ?= docker.elastic.co
PY_VERSION ?= 3.6.13
export PATH := ./bin:$(HOME)/.pyenv/bin:$(HOME)/.pyenv/shims:./venv/bin:$(PATH)
# Determine the version to build. # Determine the version to build.
ELASTIC_VERSION := $(shell ../vendor/jruby/bin/jruby bin/elastic-version) ELASTIC_VERSION := $(shell ../vendor/jruby/bin/jruby bin/elastic-version)
@ -24,42 +22,34 @@ DEFAULT_IMAGE_FLAVOR ?= full
IMAGE_TAG := $(ELASTIC_REGISTRY)/logstash/logstash IMAGE_TAG := $(ELASTIC_REGISTRY)/logstash/logstash
HTTPD ?= logstash-docker-artifact-server HTTPD ?= logstash-docker-artifact-server
FIGLET := pyfiglet -w 160 -f puffy
all: build-from-local-artifacts build-from-local-oss-artifacts public-dockerfiles all: build-from-local-artifacts build-from-local-oss-artifacts public-dockerfiles
lint: venv
flake8 tests
# Build from artifacts on the local filesystem, using an http server (running # Build from artifacts on the local filesystem, using an http server (running
# in a container) to provide the artifacts to the Dockerfile. # in a container) to provide the artifacts to the Dockerfile.
build-from-local-full-artifacts: venv dockerfile env2yaml build-from-local-full-artifacts: dockerfile env2yaml
docker run --rm -d --name=$(HTTPD) \ docker run --rm -d --name=$(HTTPD) \
-p 8000:8000 --expose=8000 -v $(ARTIFACTS_DIR):/mnt \ -p 8000:8000 --expose=8000 -v $(ARTIFACTS_DIR):/mnt \
python:3 bash -c 'cd /mnt && python3 -m http.server' python:3 bash -c 'cd /mnt && python3 -m http.server'
timeout 120 bash -c 'until curl -s localhost:8000 > /dev/null; do sleep 1; done' timeout 120 bash -c 'until curl -s localhost:8000 > /dev/null; do sleep 1; done'
pyfiglet -f puffy -w 160 "Building: full"; \
docker build --network=host -t $(IMAGE_TAG)-full:$(VERSION_TAG) -f $(ARTIFACTS_DIR)/Dockerfile-full data/logstash || \ docker build --network=host -t $(IMAGE_TAG)-full:$(VERSION_TAG) -f $(ARTIFACTS_DIR)/Dockerfile-full data/logstash || \
(docker kill $(HTTPD); false); \ (docker kill $(HTTPD); false); \
docker tag $(IMAGE_TAG)-full:$(VERSION_TAG) $(IMAGE_TAG):$(VERSION_TAG); docker tag $(IMAGE_TAG)-full:$(VERSION_TAG) $(IMAGE_TAG):$(VERSION_TAG);
docker kill $(HTTPD) docker kill $(HTTPD)
build-from-local-oss-artifacts: venv dockerfile env2yaml build-from-local-oss-artifacts: dockerfile env2yaml
docker run --rm -d --name=$(HTTPD) \ docker run --rm -d --name=$(HTTPD) \
-p 8000:8000 --expose=8000 -v $(ARTIFACTS_DIR):/mnt \ -p 8000:8000 --expose=8000 -v $(ARTIFACTS_DIR):/mnt \
python:3 bash -c 'cd /mnt && python3 -m http.server' python:3 bash -c 'cd /mnt && python3 -m http.server'
timeout 120 bash -c 'until curl -s localhost:8000 > /dev/null; do sleep 1; done' timeout 120 bash -c 'until curl -s localhost:8000 > /dev/null; do sleep 1; done'
pyfiglet -f puffy -w 160 "Building: oss"; \
docker build --network=host -t $(IMAGE_TAG)-oss:$(VERSION_TAG) -f $(ARTIFACTS_DIR)/Dockerfile-oss data/logstash || \ docker build --network=host -t $(IMAGE_TAG)-oss:$(VERSION_TAG) -f $(ARTIFACTS_DIR)/Dockerfile-oss data/logstash || \
(docker kill $(HTTPD); false); (docker kill $(HTTPD); false);
-docker kill $(HTTPD) -docker kill $(HTTPD)
build-from-local-ubi8-artifacts: venv dockerfile env2yaml build-from-local-ubi8-artifacts: dockerfile env2yaml
docker run --rm -d --name=$(HTTPD) \ docker run --rm -d --name=$(HTTPD) \
-p 8000:8000 --expose=8000 -v $(ARTIFACTS_DIR):/mnt \ -p 8000:8000 --expose=8000 -v $(ARTIFACTS_DIR):/mnt \
python:3 bash -c 'cd /mnt && python3 -m http.server' python:3 bash -c 'cd /mnt && python3 -m http.server'
timeout 120 bash -c 'until curl -s localhost:8000 > /dev/null; do sleep 1; done' timeout 120 bash -c 'until curl -s localhost:8000 > /dev/null; do sleep 1; done'
pyfiglet -f puffy -w 160 "Building: ubi8"; \
docker build --network=host -t $(IMAGE_TAG)-ubi8:$(VERSION_TAG) -f $(ARTIFACTS_DIR)/Dockerfile-ubi8 data/logstash || \ docker build --network=host -t $(IMAGE_TAG)-ubi8:$(VERSION_TAG) -f $(ARTIFACTS_DIR)/Dockerfile-ubi8 data/logstash || \
(docker kill $(HTTPD); false); (docker kill $(HTTPD); false);
-docker kill $(HTTPD) -docker kill $(HTTPD)
@ -118,61 +108,61 @@ ironbank_docker_paths:
public-dockerfiles: public-dockerfiles_oss public-dockerfiles_full public-dockerfiles_ubi8 public-dockerfiles_ironbank public-dockerfiles: public-dockerfiles_oss public-dockerfiles_full public-dockerfiles_ubi8 public-dockerfiles_ironbank
public-dockerfiles_full: venv templates/Dockerfile.j2 docker_paths $(COPY_FILES) public-dockerfiles_full: templates/Dockerfile.erb docker_paths $(COPY_FILES)
jinja2 \ ../vendor/jruby/bin/jruby -S erb -T "-"\
-D created_date='$(BUILD_DATE)' \ created_date="${BUILD_DATE}" \
-D elastic_version='$(ELASTIC_VERSION)' \ elastic_version="${ELASTIC_VERSION}" \
-D arch='${ARCHITECTURE}' \ arch="${ARCHITECTURE}" \
-D version_tag='$(VERSION_TAG)' \ version_tag="${VERSION_TAG}" \
-D image_flavor='full' \ release="${RELEASE}" \
-D local_artifacts='false' \ image_flavor="full" \
-D release='$(RELEASE)' \ local_artifacts="false" \
templates/Dockerfile.j2 > $(ARTIFACTS_DIR)/Dockerfile-full && \ templates/Dockerfile.erb > "${ARTIFACTS_DIR}/Dockerfile-full" && \
cd $(ARTIFACTS_DIR)/docker && \ cd $(ARTIFACTS_DIR)/docker && \
cp $(ARTIFACTS_DIR)/Dockerfile-full Dockerfile && \ cp $(ARTIFACTS_DIR)/Dockerfile-full Dockerfile && \
tar -zcf ../logstash-$(VERSION_TAG)-docker-build-context.tar.gz Dockerfile bin config env2yaml pipeline tar -zcf ../logstash-$(VERSION_TAG)-docker-build-context.tar.gz Dockerfile bin config env2yaml pipeline
public-dockerfiles_oss: venv templates/Dockerfile.j2 docker_paths $(COPY_FILES) public-dockerfiles_oss: templates/Dockerfile.erb docker_paths $(COPY_FILES)
jinja2 \ ../vendor/jruby/bin/jruby -S erb -T "-"\
-D created_date='$(BUILD_DATE)' \ created_date="${BUILD_DATE}" \
-D elastic_version='$(ELASTIC_VERSION)' \ elastic_version="${ELASTIC_VERSION}" \
-D arch='${ARCHITECTURE}' \ arch="${ARCHITECTURE}" \
-D version_tag='$(VERSION_TAG)' \ version_tag="${VERSION_TAG}" \
-D image_flavor='oss' \ release="${RELEASE}" \
-D local_artifacts='false' \ image_flavor="oss" \
-D release='$(RELEASE)' \ local_artifacts="false" \
templates/Dockerfile.j2 > $(ARTIFACTS_DIR)/Dockerfile-oss && \ templates/Dockerfile.erb > "${ARTIFACTS_DIR}/Dockerfile-oss" && \
cd $(ARTIFACTS_DIR)/docker && \ cd $(ARTIFACTS_DIR)/docker && \
cp $(ARTIFACTS_DIR)/Dockerfile-oss Dockerfile && \ cp $(ARTIFACTS_DIR)/Dockerfile-oss Dockerfile && \
tar -zcf ../logstash-oss-$(VERSION_TAG)-docker-build-context.tar.gz Dockerfile bin config env2yaml pipeline tar -zcf ../logstash-oss-$(VERSION_TAG)-docker-build-context.tar.gz Dockerfile bin config env2yaml pipeline
public-dockerfiles_ubi8: venv templates/Dockerfile.j2 docker_paths $(COPY_FILES) public-dockerfiles_ubi8: templates/Dockerfile.erb docker_paths $(COPY_FILES)
jinja2 \ ../vendor/jruby/bin/jruby -S erb -T "-"\
-D created_date='$(BUILD_DATE)' \ created_date="${BUILD_DATE}" \
-D elastic_version='$(ELASTIC_VERSION)' \ elastic_version="${ELASTIC_VERSION}" \
-D arch='${ARCHITECTURE}' \ arch="${ARCHITECTURE}" \
-D version_tag='$(VERSION_TAG)' \ version_tag="${VERSION_TAG}" \
-D image_flavor='ubi8' \ release="${RELEASE}" \
-D local_artifacts='false' \ image_flavor="ubi8" \
-D release='$(RELEASE)' \ local_artifacts="false" \
templates/Dockerfile.j2 > $(ARTIFACTS_DIR)/Dockerfile-ubi8 && \ templates/Dockerfile.erb > "${ARTIFACTS_DIR}/Dockerfile-ubi8" && \
cd $(ARTIFACTS_DIR)/docker && \ cd $(ARTIFACTS_DIR)/docker && \
cp $(ARTIFACTS_DIR)/Dockerfile-ubi8 Dockerfile && \ cp $(ARTIFACTS_DIR)/Dockerfile-ubi8 Dockerfile && \
tar -zcf ../logstash-ubi8-$(VERSION_TAG)-docker-build-context.tar.gz Dockerfile bin config env2yaml pipeline tar -zcf ../logstash-ubi8-$(VERSION_TAG)-docker-build-context.tar.gz Dockerfile bin config env2yaml pipeline
public-dockerfiles_ironbank: templates/hardening_manifest.yaml templates/Dockerfile.j2 ironbank_docker_paths $(COPY_IRONBANK_FILES) public-dockerfiles_ironbank: templates/hardening_manifest.yaml.erb templates/Dockerfile.erb ironbank_docker_paths $(COPY_IRONBANK_FILES)
jinja2 \ ../vendor/jruby/bin/jruby -S erb -T "-"\
-D elastic_version='$(ELASTIC_VERSION)' \ elastic_version="${ELASTIC_VERSION}" \
templates/hardening_manifest.yaml > $(ARTIFACTS_DIR)/ironbank/hardening_manifest.yaml && \ templates/hardening_manifest.yaml.erb > $(ARTIFACTS_DIR)/ironbank/hardening_manifest.yaml && \
jinja2 \ ../vendor/jruby/bin/jruby -S erb -T "-"\
-D created_date='$(BUILD_DATE)' \ created_date="${BUILD_DATE}" \
-D elastic_version='$(ELASTIC_VERSION)' \ elastic_version="${ELASTIC_VERSION}" \
-D arch='${ARCHITECTURE}' \ arch="${ARCHITECTURE}" \
-D version_tag='$(VERSION_TAG)' \ version_tag="${VERSION_TAG}" \
-D image_flavor='ironbank' \ release="${RELEASE}" \
-D local_artifacts='false' \ image_flavor="ironbank" \
-D release='$(RELEASE)' \ local_artifacts="false" \
templates/Dockerfile.j2 > $(ARTIFACTS_DIR)/Dockerfile-ironbank && \ templates/Dockerfile.erb > "${ARTIFACTS_DIR}/Dockerfile-ironbank" && \
cd $(ARTIFACTS_DIR)/ironbank && \ cd $(ARTIFACTS_DIR)/ironbank && \
cp $(ARTIFACTS_DIR)/Dockerfile-ironbank Dockerfile && \ cp $(ARTIFACTS_DIR)/Dockerfile-ironbank Dockerfile && \
tar -zcf ../logstash-ironbank-$(VERSION_TAG)-docker-build-context.tar.gz scripts Dockerfile hardening_manifest.yaml LICENSE README.md tar -zcf ../logstash-ironbank-$(VERSION_TAG)-docker-build-context.tar.gz scripts Dockerfile hardening_manifest.yaml LICENSE README.md
@ -189,17 +179,6 @@ push:
docker push push.$(IMAGE_TAG):$(VERSION_TAG); docker push push.$(IMAGE_TAG):$(VERSION_TAG);
docker rmi push.$(IMAGE_TAG):$(VERSION_TAG); docker rmi push.$(IMAGE_TAG):$(VERSION_TAG);
# The tests are written in Python. Make a virtualenv to handle the dependencies.
venv: requirements.txt
LOCAL_PY_VER=`python3 --version 2>&1`&&\
echo "Was using $$LOCAL_PY_VER" &&\
eval "$$(pyenv init -)" && eval "$$(pyenv init --path)" &&\
pyenv install --skip-existing $(PY_VERSION) &&\
pyenv local $(PY_VERSION) &&\
python3 -mvenv venv && \
for i in 0 1 2 3 4 5; do sleep "$i"; pip install -r requirements.txt && break; done &&\
touch venv
# Compile "env2yaml", the helper for configuring logstash.yml via environment # Compile "env2yaml", the helper for configuring logstash.yml via environment
# variables. # variables.
env2yaml: env2yaml:
@ -208,20 +187,19 @@ env2yaml:
-w /usr/src/env2yaml golang:1 go build -w /usr/src/env2yaml golang:1 go build
# Generate the Dockerfiles from Jinja2 templates. # Generate the Dockerfiles from Jinja2 templates.
dockerfile: venv templates/Dockerfile.j2 dockerfile: templates/Dockerfile.erb
$(foreach FLAVOR, $(IMAGE_FLAVORS), \ $(foreach FLAVOR, $(IMAGE_FLAVORS), \
jinja2 \ ../vendor/jruby/bin/jruby -S erb -T "-"\
-D created_date='$(BUILD_DATE)' \ created_date="${BUILD_DATE}" \
-D elastic_version='$(ELASTIC_VERSION)' \ elastic_version="${ELASTIC_VERSION}" \
-D arch='${ARCHITECTURE}' \ arch="${ARCHITECTURE}" \
-D version_tag='$(VERSION_TAG)' \ version_tag="${VERSION_TAG}" \
-D image_flavor='$(FLAVOR)' \ image_flavor="${FLAVOR}" \
-D local_artifacts='true' \ local_artifacts="true" \
templates/Dockerfile.j2 > $(ARTIFACTS_DIR)/Dockerfile-$(FLAVOR); \ templates/Dockerfile.erb > "${ARTIFACTS_DIR}/Dockerfile-${FLAVOR}" ; \
) )
clean: clean:
rm -f ${ARTIFACTS_DIR}/env2yaml/env2yaml ${ARTIFACTS_DIR}/Dockerfile rm -f ${ARTIFACTS_DIR}/env2yaml/env2yaml ${ARTIFACTS_DIR}/Dockerfile
rm -rf venv
.PHONY: clean push .PHONY: clean push

5
docker/bin/pytest
View file

@ -1,5 +0,0 @@
#!/bin/bash
#
# A wrapper for `pytest` to handle the appropriate Testinfra arguments.
./venv/bin/pytest --verbose --connection=docker --hosts=logstash-test $@

6
docker/requirements.txt
View file

@ -1,6 +0,0 @@
flake8==3.4.1
jinja2-cli[yaml]==0.7.0
jinja2==2.11.3
retrying==1.3.3
testinfra==1.6.0
pyfiglet

180
docker/templates/Dockerfile.j2 → docker/templates/Dockerfile.erb
View file

@ -1,37 +1,33 @@
# This Dockerfile was generated from templates/Dockerfile.j2 # This Dockerfile was generated from templates/Dockerfile.erb
{% if local_artifacts == 'false' -%} <% if local_artifacts == 'false' -%>
{% set url_root = 'https://artifacts.elastic.co/downloads/logstash' -%} <% url_root = 'https://artifacts.elastic.co/downloads/logstash' -%>
{% else -%} <% else -%>
{% set url_root = 'http://localhost:8000' -%} <% url_root = 'http://localhost:8000' -%>
{% endif -%} <% end -%>
<% if image_flavor == 'oss' -%>
{% if image_flavor == 'oss' -%} <% tarball = "logstash-oss-#{elastic_version}-linux-$(arch).tar.gz" -%>
{% set tarball = 'logstash-oss-%s-linux-$(arch).tar.gz' % (elastic_version) -%} <% license = 'Apache 2.0' -%>
{% set license = 'Apache 2.0' -%} <% else -%>
{% else -%} <% tarball = "logstash-#{elastic_version}-linux-$(arch).tar.gz" -%>
{% set tarball = 'logstash-%s-linux-$(arch).tar.gz' % (elastic_version) -%} <% license = 'Elastic License' -%>
{% set license = 'Elastic License' -%} <% end -%>
{% endif -%} <% if image_flavor == 'ubi8' %>
<% base_image = 'docker.elastic.co/ubi8/ubi-minimal' -%>
{% if image_flavor == 'ubi8' -%} <% package_manager = 'microdnf' -%>
{% set base_image = 'docker.elastic.co/ubi8/ubi-minimal' -%} # Minimal distributions do not ship with en language packs.
{% set package_manager = 'microdnf' -%} <% locale = 'C.UTF-8' -%>
# Minimal distributions do not ship with en language packs. <% elsif image_flavor == 'ironbank' -%>
{% set locale = 'C.UTF-8' -%} <% package_manager = 'yum' -%>
{% elif image_flavor == 'ironbank' -%} <% else -%>
{% set package_manager = 'yum' -%} <% base_image = 'ubuntu:20.04' -%>
{% else -%} <% package_manager = 'apt-get' -%>
{% set base_image = 'ubuntu:20.04' -%} <% locale = 'en_US.UTF-8' -%>
{% set package_manager = 'apt-get' -%} <% end -%>
{% set locale = 'en_US.UTF-8' -%} <% if image_flavor == 'ironbank' -%>
{% endif -%}
{% if image_flavor == 'ironbank' -%}
ARG BASE_REGISTRY=registry1.dsop.io ARG BASE_REGISTRY=registry1.dsop.io
ARG BASE_IMAGE=ironbank/redhat/ubi/ubi9 ARG BASE_IMAGE=ironbank/redhat/ubi/ubi9
ARG BASE_TAG=9.2 ARG BASE_TAG=9.2
ARG LOGSTASH_VERSION={{ elastic_version }} ARG LOGSTASH_VERSION=<%= elastic_version %>
ARG GOLANG_VERSION=1.17.8 ARG GOLANG_VERSION=1.17.8
FROM ${BASE_REGISTRY}/${BASE_IMAGE}:${BASE_TAG} AS env2yaml FROM ${BASE_REGISTRY}/${BASE_IMAGE}:${BASE_TAG} AS env2yaml
@ -66,93 +62,92 @@ RUN tar zxf /opt/logstash.tar.gz && \
mv /usr/share/logstash-${LOGSTASH_VERSION} /usr/share/logstash mv /usr/share/logstash-${LOGSTASH_VERSION} /usr/share/logstash
FROM ${BASE_REGISTRY}/${BASE_IMAGE}:${BASE_TAG} FROM ${BASE_REGISTRY}/${BASE_IMAGE}:${BASE_TAG}
<% else -%>
{% else -%} FROM <%= base_image %>
FROM {{ base_image }} <% end -%>
{% endif -%}
RUN for iter in {1..10}; do \ RUN for iter in {1..10}; do \
{% if image_flavor == 'full' or image_flavor == 'oss' -%} <% if image_flavor == 'full' || image_flavor == 'oss' -%>
export DEBIAN_FRONTEND=noninteractive && \ export DEBIAN_FRONTEND=noninteractive && \
{% endif -%} <% end -%>
{{ package_manager }} update -y && \ <%= package_manager %> update -y && \
{% if image_flavor != 'ironbank' -%} <% if image_flavor != 'ironbank' -%>
{{ package_manager }} upgrade -y && \ <%= package_manager %> upgrade -y && \
{% endif -%} <% end -%>
{{ package_manager }} install -y procps findutils tar gzip curl && \ <%= package_manager %> install -y procps findutils tar gzip curl && \
{% if image_flavor == 'ubi8' or image_flavor == 'ironbank' -%} <% if image_flavor == 'ubi8' || image_flavor == 'ironbank' -%>
{{ package_manager }} install -y which shadow-utils && \ <%= package_manager %> install -y which shadow-utils && \
{% else -%} <% else -%>
{{ package_manager }} install -y locales && \ <%= package_manager %> install -y locales && \
{% endif -%} <% end -%>
{{ package_manager }} clean all && \ <%= package_manager %> clean all && \
{% if image_flavor == 'full' or image_flavor == 'oss' -%} <% if image_flavor == 'full' || image_flavor == 'oss' -%>
locale-gen 'en_US.UTF-8' && \ locale-gen 'en_US.UTF-8' && \
{{ package_manager }} clean metadata && \ <%= package_manager %> clean metadata && \
{% endif -%} <% end -%>
exit_code=0 && break || exit_code=$? && \ exit_code=0 && break || exit_code=$? && \
echo "packaging error: retry $iter in 10s" && \ echo "packaging error: retry $iter in 10s" && \
{{ package_manager }} clean all && \ <%= package_manager %> clean all && \
{% if image_flavor == 'full' or image_flavor == 'oss' -%} <% if image_flavor == 'full' || image_flavor == 'oss' -%>
{{ package_manager }} clean metadata && \ <%= package_manager %> clean metadata && \
{% endif -%} <% end -%>
sleep 10; done; \ sleep 10; done; \
(exit $exit_code) (exit $exit_code)
# Provide a non-root user to run the process. # Provide a non-root user to run the process.
RUN groupadd --gid 1000 logstash && \ RUN groupadd --gid 1000 logstash && \
adduser --uid 1000 --gid 1000 \ adduser --uid 1000 --gid 1000 \
{% if image_flavor != 'ironbank' %} --home {% else %} --home-dir {% endif -%} /usr/share/logstash --no-create-home \ <% if image_flavor != 'ironbank' %>--home <% else %>--home-dir <% end %>/usr/share/logstash --no-create-home \
logstash logstash
{% if image_flavor == 'ironbank' -%} <% if image_flavor == 'ironbank' %>
WORKDIR /usr/share/logstash WORKDIR /usr/share/logstash
COPY --from=env2yaml /usr/local/src/go/src/env2yaml/env2yaml /usr/local/bin/env2yaml COPY --from=env2yaml /usr/local/src/go/src/env2yaml/env2yaml /usr/local/bin/env2yaml
COPY --from=builder --chown=1000:0 /usr/share/logstash /usr/share/logstash COPY --from=builder --chown=1000:0 /usr/share/logstash /usr/share/logstash
{% endif -%} <% end -%>
# Add Logstash itself. # Add Logstash itself.
RUN \ RUN \
{% if image_flavor != 'ironbank' -%} curl -Lo - {{ url_root }}/{{ tarball }} | \ <% if image_flavor != 'ironbank' %> curl -Lo - <%= url_root %>/<%= tarball %> | \
tar zxf - -C /usr/share && \ tar zxf - -C /usr/share && \
mv /usr/share/logstash-{{ elastic_version }} /usr/share/logstash && \ mv /usr/share/logstash-<%= elastic_version %> /usr/share/logstash && \
{% endif -%} <% end -%>
chown --recursive logstash:logstash /usr/share/logstash/ && \ chown --recursive logstash:logstash /usr/share/logstash/ && \
chown -R logstash:root /usr/share/logstash && \ chown -R logstash:root /usr/share/logstash && \
chmod -R g=u /usr/share/logstash && \ chmod -R g=u /usr/share/logstash && \
mkdir /licenses/ && \ mkdir /licenses/ && \
mv /usr/share/logstash/NOTICE.TXT /licenses/NOTICE.TXT && \ mv /usr/share/logstash/NOTICE.TXT /licenses/NOTICE.TXT && \
mv /usr/share/logstash/LICENSE.txt /licenses/LICENSE.txt && \ mv /usr/share/logstash/LICENSE.txt /licenses/LICENSE.txt && \
{% if image_flavor != 'ironbank' -%} find /usr/share/logstash -type d -exec chmod g+s {} \; && \ <% if image_flavor != 'ironbank' -%>
{% endif -%} find /usr/share/logstash -type d -exec chmod g+s {} \; && \
<% end -%>
ln -s /usr/share/logstash /opt/logstash ln -s /usr/share/logstash /opt/logstash
{% if image_flavor != 'ironbank' -%} <% if image_flavor != 'ironbank' %>
WORKDIR /usr/share/logstash WORKDIR /usr/share/logstash
{% endif -%} <% end -%>
ENV ELASTIC_CONTAINER true ENV ELASTIC_CONTAINER true
ENV PATH=/usr/share/logstash/bin:$PATH ENV PATH=/usr/share/logstash/bin:$PATH
# Provide a minimal configuration, so that simple invocations will provide # Provide a minimal configuration, so that simple invocations will provide
# a good experience. # a good experience.
{% if image_flavor != 'ironbank' -%} <% if image_flavor != 'ironbank' -%>
COPY config/pipelines.yml config/pipelines.yml COPY config/pipelines.yml config/pipelines.yml
{% if image_flavor == 'oss' -%} <% if image_flavor == 'oss' -%>
COPY config/logstash-oss.yml config/logstash.yml COPY config/logstash-oss.yml config/logstash.yml
{% else -%} <% else -%>
COPY config/logstash-full.yml config/logstash.yml COPY config/logstash-full.yml config/logstash.yml
{% endif -%} <% end -%>
COPY config/log4j2.properties config/ COPY config/log4j2.properties config/
COPY config/log4j2.file.properties config/ COPY config/log4j2.file.properties config/
COPY pipeline/default.conf pipeline/logstash.conf COPY pipeline/default.conf pipeline/logstash.conf
RUN chown --recursive logstash:root config/ pipeline/ RUN chown --recursive logstash:root config/ pipeline/
# Ensure Logstash gets the correct locale by default. # Ensure Logstash gets the correct locale by default.
ENV LANG={{ locale }} LC_ALL={{ locale }} ENV LANG=<%= locale %> LC_ALL=<%= locale %>
COPY env2yaml/env2yaml /usr/local/bin/ COPY env2yaml/env2yaml /usr/local/bin/
# Place the startup wrapper script. # Place the startup wrapper script.
COPY bin/docker-entrypoint /usr/local/bin/ COPY bin/docker-entrypoint /usr/local/bin/
{% else -%} <% else -%>
COPY scripts/config/pipelines.yml config/pipelines.yml COPY scripts/config/pipelines.yml config/pipelines.yml
COPY scripts/config/logstash.yml config/logstash.yml COPY scripts/config/logstash.yml config/logstash.yml
COPY scripts/config/log4j2.properties config/ COPY scripts/config/log4j2.properties config/
@ -161,7 +156,7 @@ COPY scripts/pipeline/default.conf pipeline/logstash.conf
RUN chown --recursive logstash:root config/ pipeline/ RUN chown --recursive logstash:root config/ pipeline/
# Place the startup wrapper script. # Place the startup wrapper script.
COPY scripts/bin/docker-entrypoint /usr/local/bin/ COPY scripts/bin/docker-entrypoint /usr/local/bin/
{% endif -%} <% end -%>
RUN chmod 0755 /usr/local/bin/docker-entrypoint RUN chmod 0755 /usr/local/bin/docker-entrypoint
@ -169,33 +164,32 @@ USER 1000
EXPOSE 9600 5044 EXPOSE 9600 5044
{% if image_flavor != 'ironbank' -%} <% if image_flavor != 'ironbank' -%>
LABEL org.label-schema.schema-version="1.0" \ LABEL org.label-schema.schema-version="1.0" \
org.label-schema.vendor="Elastic" \ org.label-schema.vendor="Elastic" \
org.opencontainers.image.vendor="Elastic" \ org.opencontainers.image.vendor="Elastic" \
org.label-schema.name="logstash" \ org.label-schema.name="logstash" \
org.opencontainers.image.title="logstash" \ org.opencontainers.image.title="logstash" \
org.label-schema.version="{{ elastic_version }}" \ org.label-schema.version="<%= elastic_version %>" \
org.opencontainers.image.version="{{ elastic_version }}" \ org.opencontainers.image.version="<%= elastic_version %>" \
org.label-schema.url="https://www.elastic.co/products/logstash" \ org.label-schema.url="https://www.elastic.co/products/logstash" \
org.label-schema.vcs-url="https://github.com/elastic/logstash" \ org.label-schema.vcs-url="https://github.com/elastic/logstash" \
org.label-schema.license="{{ license }}" \ org.label-schema.license="<%= license %>" \
org.opencontainers.image.licenses="{{ license }}" \ org.opencontainers.image.licenses="<%= license %>" \
org.opencontainers.image.description="Logstash is a free and open server-side data processing pipeline that ingests data from a multitude of sources, transforms it, and then sends it to your favorite 'stash.'" \ org.opencontainers.image.description="Logstash is a free and open server-side data processing pipeline that ingests data from a multitude of sources, transforms it, and then sends it to your favorite 'stash.'" \
org.label-schema.build-date={{ created_date }} \ org.label-schema.build-date=<%= created_date %> \
{% if image_flavor == 'ubi8' -%} <% if image_flavor == 'ubi8' -%> license="<%= license %>" \
license="{{ license }}" \
description="Logstash is a free and open server-side data processing pipeline that ingests data from a multitude of sources, transforms it, and then sends it to your favorite 'stash.'" \ description="Logstash is a free and open server-side data processing pipeline that ingests data from a multitude of sources, transforms it, and then sends it to your favorite 'stash.'" \
name="logstash" \ name="logstash" \
maintainer="info@elastic.co" \ maintainer="info@elastic.co" \
summary="Logstash is a free and open server-side data processing pipeline that ingests data from a multitude of sources, transforms it, and then sends it to your favorite 'stash.'" \ summary="Logstash is a free and open server-side data processing pipeline that ingests data from a multitude of sources, transforms it, and then sends it to your favorite 'stash.'" \
vendor="Elastic" \ vendor="Elastic" \
{% endif -%} <% end -%>
org.opencontainers.image.created={{ created_date }} org.opencontainers.image.created=<%= created_date %>
{% endif -%} <% end -%>
{% if image_flavor == 'ironbank' -%} <% if image_flavor == 'ironbank' -%>
HEALTHCHECK --interval=10s --timeout=5s --start-period=1m --retries=5 CMD curl -I -f --max-time 5 http://localhost:9600 || exit 1 HEALTHCHECK --interval=10s --timeout=5s --start-period=1m --retries=5 CMD curl -I -f --max-time 5 http://localhost:9600 || exit 1
{% endif -%} <% end -%>
ENTRYPOINT ["/usr/local/bin/docker-entrypoint"] ENTRYPOINT ["/usr/local/bin/docker-entrypoint"]

12
docker/templates/hardening_manifest.yaml → docker/templates/hardening_manifest.yaml.erb
View file

@ -8,14 +8,14 @@ name: "elastic/logstash/logstash"
# The most specific version should be the first tag and will be shown # The most specific version should be the first tag and will be shown
# on ironbank.dsop.io # on ironbank.dsop.io
tags: tags:
- "{{ elastic_version }}" - "<%= elastic_version %>"
- "latest" - "latest"
# Build args passed to Dockerfile ARGs # Build args passed to Dockerfile ARGs
args: args:
BASE_IMAGE: "redhat/ubi/ubi9" BASE_IMAGE: "redhat/ubi/ubi9"
BASE_TAG: "9.2" BASE_TAG: "9.2"
LOGSTASH_VERSION: "{{ elastic_version }}" LOGSTASH_VERSION: "<%= elastic_version %>"
GOLANG_VERSION: "1.17.8" GOLANG_VERSION: "1.17.8"
# Docker image labels # Docker image labels
@ -29,7 +29,7 @@ labels:
org.opencontainers.image.url: "https://www.elastic.co/products/logstash" org.opencontainers.image.url: "https://www.elastic.co/products/logstash"
## Name of the distributing entity, organization or individual ## Name of the distributing entity, organization or individual
org.opencontainers.image.vendor: "Elastic" org.opencontainers.image.vendor: "Elastic"
org.opencontainers.image.version: "{{ elastic_version }}" org.opencontainers.image.version: "<%= elastic_version %>"
## Keywords to help with search (ex. "cicd,gitops,golang") ## Keywords to help with search (ex. "cicd,gitops,golang")
# mil.dso.ironbank.image.keywords: "FIXME" # mil.dso.ironbank.image.keywords: "FIXME"
## This value can be "opensource" or "commercial" ## This value can be "opensource" or "commercial"
@ -39,11 +39,11 @@ labels:
# List of resources to make available to the offline build context # List of resources to make available to the offline build context
resources: resources:
- filename: logstash-{{ elastic_version }}-linux-x86_64.tar.gz - filename: logstash-<%= elastic_version %>-linux-x86_64.tar.gz
url: <artifact_path>/logstash-{{ elastic_version }}-linux-x86_64.tar.gz url: <artifact_path>/logstash-<%= elastic_version %>-linux-x86_64.tar.gz
validation: validation:
type: sha512 type: sha512
value: <INSERT SHA512 VALUE FROM https://artifacts.elastic.co/downloads/logstash/logstash-{{ elastic_version }}-linux-x86_64.tar.gz.sha512> value: <INSERT SHA512 VALUE FROM https://artifacts.elastic.co/downloads/logstash/logstash-<%= elastic_version %>-linux-x86_64.tar.gz.sha512>
- filename: go1.17.8.linux-amd64.tar.gz - filename: go1.17.8.linux-amd64.tar.gz
url: https://dl.google.com/go/go1.17.8.linux-amd64.tar.gz url: https://dl.google.com/go/go1.17.8.linux-amd64.tar.gz
validation: validation:

5
docker/tox.ini
View file

@ -1,5 +0,0 @@
# pytest fixtures (which are wonderful) trigger false positives for these
# pyflakes checks.
[flake8]
ignore = F401,F811
max-line-length = 120