Skip to content

Commit 71072df

Browse files
IBMRobIBMRob
committed
11.0.0.9-r3 update
1 parent 2ba62b5 commit 71072df

File tree

67 files changed

+1365
-248
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

67 files changed

+1365
-248
lines changed

‎Jenkinsfile‎

Lines changed: 123 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,123 @@
1+
pipeline {
2+
agent any
3+
environment {
4+
BUILD_TIMESTAMP = sh(script: ' date +"%Y%m%d-%H%M%S"', , returnStdout: true).trim()
5+
}
6+
options {
7+
timestamps ()
8+
}
9+
stages {
10+
stage('amd64 image build') {
11+
when {
12+
expression { params.BUILD_PLATFORM == 'amd64-only' || params.BUILD_PLATFORM == 'both' }
13+
}
14+
agent { label 'cf_slave' }
15+
steps {
16+
echo BRANCH_TO_BUILD
17+
deleteDir()
18+
checkout scm
19+
dir('ot4i-ace-docker') {
20+
git credentialsId: 'ffbld01_git_key', poll: false, url: '[email protected]:Cloud-Integration/ot4i-ace-docker.git', branch: "${params.BRANCH_TO_BUILD}"
21+
}
22+
dir('hip-pipeline-common') {
23+
git credentialsId: 'ffbld01_git_key', poll: false, url: '[email protected]:Cloud-Integration/hip-pipeline-common.git', branch: 'master'
24+
}
25+
dir('firefly-software-build-scripts') {
26+
git credentialsId: 'ffbld01_git_key', poll: false, url: '[email protected]:Cloud-Integration/firefly-software-build-scripts.git', branch: "${params.FIREFLY_SOFTWARE_BUILD_SCRIPTS_BRANCH}"
27+
}
28+
withCredentials([usernamePassword(credentialsId: 'cf78bbfd-e303-4969-8cfd-cd57c3902f12', passwordVariable: 'ARTIFACTORY_PASS', usernameVariable: 'ARTIFACTORY_USER'), usernamePassword(credentialsId: '37361c4d-f3f7-4bf4-97a0-48463a5d2091', passwordVariable: 'GITHUB_API_TOKEN', usernameVariable: 'GITHUB_API_USER'), usernamePassword(credentialsId: 'cf78bbfd-e303-4969-8cfd-cd57c3902f12', passwordVariable: 'NPM_PASS', usernameVariable: 'NPM_USER'), string(credentialsId: 'APPCONNECT_NPM_AUTH', variable: 'NPM_AUTH')]) {
29+
sh '''
30+
bash -c "
31+
pwd
32+
ls -l
33+
ls -l ${WORKSPACE}/jenkins-build-scripts
34+
${WORKSPACE}/jenkins-build-scripts/jenkins-build-script.sh
35+
"
36+
'''
37+
}
38+
}
39+
}
40+
stage('s390x image build') {
41+
when {
42+
expression { params.BUILD_PLATFORM == 's390x-only' || params.BUILD_PLATFORM == 'both' }
43+
}
44+
agent { label 'zlinux-ACEcc' }
45+
steps {
46+
echo BRANCH_TO_BUILD
47+
deleteDir()
48+
checkout scm
49+
dir('ot4i-ace-docker') {
50+
git credentialsId: 'ffbld01_git_key', poll: false, url: '[email protected]:Cloud-Integration/ot4i-ace-docker.git', branch: "${params.BRANCH_TO_BUILD}"
51+
}
52+
dir('hip-pipeline-common') {
53+
git credentialsId: 'ffbld01_git_key', poll: false, url: '[email protected]:Cloud-Integration/hip-pipeline-common.git', branch: 'master'
54+
}
55+
dir('firefly-software-build-scripts') {
56+
git credentialsId: 'ffbld01_git_key', poll: false, url: '[email protected]:Cloud-Integration/firefly-software-build-scripts.git', branch: "${params.FIREFLY_SOFTWARE_BUILD_SCRIPTS_BRANCH}"
57+
}
58+
withCredentials([usernamePassword(credentialsId: 'cf78bbfd-e303-4969-8cfd-cd57c3902f12', passwordVariable: 'ARTIFACTORY_PASS', usernameVariable: 'ARTIFACTORY_USER'), usernamePassword(credentialsId: '37361c4d-f3f7-4bf4-97a0-48463a5d2091', passwordVariable: 'GITHUB_API_TOKEN', usernameVariable: 'GITHUB_API_USER'), usernamePassword(credentialsId: 'cf78bbfd-e303-4969-8cfd-cd57c3902f12', passwordVariable: 'NPM_PASS', usernameVariable: 'NPM_USER'), string(credentialsId: 'APPCONNECT_NPM_AUTH', variable: 'NPM_AUTH')]) {
59+
sh '''
60+
bash -c "
61+
pwd
62+
ls -l
63+
ls -l ${WORKSPACE}/jenkins-build-scripts
64+
${WORKSPACE}/jenkins-build-scripts/jenkins-build-script.sh
65+
"
66+
'''
67+
}
68+
}
69+
}
70+
stage('Create Docker Manifests') {
71+
agent { label 'cf_slave' }
72+
steps {
73+
echo BRANCH_TO_BUILD
74+
deleteDir()
75+
checkout scm
76+
withCredentials([usernamePassword(credentialsId: 'cf78bbfd-e303-4969-8cfd-cd57c3902f12', passwordVariable: 'ARTIFACTORY_PASS', usernameVariable: 'ARTIFACTORY_USER')]) {
77+
sh '''
78+
# the docker manifest command is an experimental feature
79+
# so need to enable the docker client side experimental feature
80+
mkdir /home/jenkins/.docker
81+
echo '
82+
{
83+
"experimental": "enabled"
84+
}
85+
' > /home/jenkins/.docker/config.json
86+
bash -c "
87+
pwd
88+
ls -la
89+
${WORKSPACE}/jenkins-build-scripts/create-docker-manifests.sh
90+
"
91+
'''
92+
}
93+
}
94+
}
95+
stage ('Trigger Image Promotion Build') {
96+
steps {
97+
script {
98+
echo "Triggering image promotion build "
99+
def ImageName = "ace-server"
100+
def tag = "${TAG_VERSION}-${BUILD_TIMESTAMP}"
101+
def updateJSON = "false"
102+
if (env.BRANCH_TO_BUILD == 'master') {
103+
echo "Master branch so updating JSON doc"
104+
updateJSON = "true"
105+
}
106+
build job: 'ibm-appconnect-operator-test-images', wait: true, parameters: [
107+
[$class: 'StringParameterValue', name: "IMAGE_NAME", value: ImageName],
108+
[$class: 'StringParameterValue', name: "UPDATE_GOOD_IMAGES_JSON", value: updateJSON],
109+
[$class: 'StringParameterValue', name: 'IMAGE_TAG', value: tag]
110+
]
111+
}
112+
}
113+
}
114+
}
115+
post {
116+
fixed {
117+
slackSend channel: '#appcon-monza-feed', message: '*' + JOB_NAME + '*\n Successfully built branch - ' + BRANCH_TO_BUILD + '\nSee - ' + BUILD_URL, color: 'good'
118+
}
119+
failure {
120+
slackSend channel: '#appcon-monza-feed', message: '*' + JOB_NAME + '*:\n Failed to build branch - ' + BRANCH_TO_BUILD + '\nSee - ' + BUILD_URL, color: '#AA0114'
121+
}
122+
}
123+
}

‎README.md‎

Lines changed: 2 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -81,26 +81,7 @@ In order to use the image, it is necessary to accept the terms of the IBM App Co
8181

8282
### Red Hat OpenShift SecurityContextConstraints Requirements
8383

84-
This chart requires a SecurityContextConstraints to be bound to the target namespace prior to installation. To meet this requirement there may be cluster scoped as well as namespace scoped pre and post actions that need to occur.
85-
86-
87-
#### Running an ACE Only Integration Server
88-
89-
The predefined SecurityContextConstraints name: [`ibm-anyuid-scc`](https://ibm.biz/cpkspec-scc) has been verified for this chart when creating an ACE & MQ integration server, if your target namespace is bound to this SecurityContextConstraints resource you can proceed to install the chart.
90-
91-
Run the following command to add the service account of the Integration server to the anyuid scc - `oc adm policy add-scc-to-user ibm-anyuid-scc system:serviceaccount:<namespace>:<releaseName>-ibm-ace-server-prod-serviceaccount` i.e.
92-
```
93-
oc adm policy add-scc-to-user ibm-anyuid-scc system:serviceaccount:default:ace-nomq-ibm-ace-server-rhel-prod-serviceaccount
94-
```
95-
96-
#### Running an ACE & MQ Integration Server
97-
98-
The predefined SecurityContextConstraints name: [`ibm-anyuid-scc`](https://ibm.biz/cpkspec-scc) has been verified for this chart when creating an ACE & MQ integration server, if your target namespace is bound to this SecurityContextConstraints resource you can proceed to install the chart.
99-
100-
Run the following command to add the service account of the Integration server to the anyuid scc. - `oc adm policy add-scc-to-user ibm-anyuid-scc system:serviceaccount:<namespace>:<releaseName>-ibm-ace-server-mq-prod-serviceaccount` i.e.
101-
```
102-
oc adm policy add-scc-to-user ibm-anyuid-scc system:serviceaccount:ace:ace-mq-ibm-ace-server-mq-prod-serviceaccount
103-
```
84+
The predefined SecurityContextConstraint (SCC) `restricted` has been verified with the image when being run in a Red Hat OpenShift environment.
10485

10586
### ACE & MQ image
10687

@@ -145,7 +126,7 @@ In the `sample` folder there is an example on how to build a server image with a
145126

146127
- **ACE_ADMIN_SERVER_SECURITY** - Set to `true` if you intend to secure your Integration Server using SSL.
147128
- **ACE_ADMIN_SERVER_NAME** - Set this to the DNS name of your Integration Server for SSL SAN checking.
148-
- **ACE_ADMIN_SERVER_CA** - Set this to your Integration Server SSL CA certificate.
129+
- **ACE_ADMIN_SERVER_CA** - Set this to your Integration Server SSL CA certificates folder.
149130
- **ACE_ADMIN_SERVER_CERT** - Set this to your Integration Server SSL certificate.
150131
- **ACE_ADMIN_SERVER_KEY** - Set this to your Integration Server SSL key certificate.
151132

‎cmd/runaceserver/integrationserver.go‎

Lines changed: 104 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -129,6 +129,15 @@ func initialIntegrationServerConfig() error {
129129
}
130130
}
131131

132+
enableAdminssl := os.Getenv("ACE_ADMIN_SERVER_SECURITY")
133+
if enableAdminssl == "true" || enableAdminssl == "1" {
134+
enableAdminsslError := enableAdminsslInServerConf()
135+
if enableAdminsslError != nil {
136+
log.Errorf("Error enabling admin server security in server.conf.yaml: %v", enableAdminsslError)
137+
return enableAdminsslError
138+
}
139+
}
140+
132141
log.Printf("Initial configuration of integration server complete")
133142

134143
log.Println("Discovering override ports")
@@ -203,6 +212,37 @@ func enableOpenTracingInServerConf() error {
203212
return nil
204213
}
205214

215+
// enableAdminsslInServerConf adds RestAdminListener configuration fields to the server.conf.yaml in overrides
216+
// based on the env vars ACE_ADMIN_SERVER_KEY, ACE_ADMIN_SERVER_CERT, ACE_ADMIN_SERVER_CA
217+
// If the file does not exist already it gets created.
218+
func enableAdminsslInServerConf() error {
219+
220+
log.Println("Enabling Admin Server Security in server.conf.yaml")
221+
222+
serverconfContent, readError := readServerConfFile()
223+
if readError != nil {
224+
if !os.IsNotExist(readError) {
225+
// Error is different from file not existing (if the file does not exist we will create it ourselves)
226+
log.Errorf("Error reading server.conf.yaml: %v", readError)
227+
return readError
228+
}
229+
}
230+
231+
serverconfYaml, manipulationError := addAdminsslToServerConf(serverconfContent)
232+
if manipulationError != nil {
233+
return manipulationError
234+
}
235+
236+
writeError := writeServerConfFile(serverconfYaml)
237+
if writeError != nil {
238+
return writeError
239+
}
240+
241+
log.Println("Admin Server Security enabled in server.conf.yaml")
242+
243+
return nil
244+
}
245+
206246
// readServerConfFile returns the content of the server.conf.yaml file in the overrides folder
207247
func readServerConfFile() ([]byte, error) {
208248
content, err := ioutil.ReadFile("/home/aceuser/ace-server/overrides/server.conf.yaml")
@@ -305,6 +345,70 @@ func addOpenTracingToServerConf(serverconfContent []byte) ([]byte, error) {
305345
return serverconfYaml, nil
306346
}
307347

348+
// addAdminsslToServerConf gets the content of the server.conf.yaml and adds the Admin Server Security fields to it
349+
// It returns the updated server.conf.yaml content
350+
func addAdminsslToServerConf(serverconfContent []byte) ([]byte, error) {
351+
serverconfMap := make(map[interface{}]interface{})
352+
unmarshallError := yaml.Unmarshal([]byte(serverconfContent), &serverconfMap)
353+
if unmarshallError != nil {
354+
log.Errorf("Error unmarshalling server.conf.yaml: %v", unmarshallError)
355+
return nil, unmarshallError
356+
}
357+
358+
// Get the keys, certs location and default if not found
359+
cert := os.Getenv("ACE_ADMIN_SERVER_CERT")
360+
if cert == "" {
361+
cert = "/home/aceuser/adminssl/tls.crt.pem"
362+
}
363+
364+
key := os.Getenv("ACE_ADMIN_SERVER_KEY")
365+
if key == "" {
366+
key = "/home/aceuser/adminssl/tls.key.pem"
367+
}
368+
369+
cacert := os.Getenv("ACE_ADMIN_SERVER_CA")
370+
if cacert == "" {
371+
cacert = "/home/aceuser/adminssl"
372+
}
373+
374+
isTrue := true
375+
// Only update if there is not an existing entry in the override server.conf.yaml
376+
// so we don't overwrite any customer provided configuration
377+
if serverconfMap["RestAdminListener"] == nil {
378+
serverconfMap["RestAdminListener"] = map[string]interface{}{
379+
"sslCertificate" : cert,
380+
"sslPassword" : key,
381+
"requireClientCert" : isTrue,
382+
"caPath" : cacert,
383+
}
384+
log.Printf("Admin Server Security updating RestAdminListener using ACE_ADMIN_SERVER environment variables")
385+
} else {
386+
restAdminListener := serverconfMap["RestAdminListener"].(map[interface{}]interface{})
387+
388+
if restAdminListener["sslCertificate"] == nil {
389+
restAdminListener["sslCertificate"] = cert
390+
}
391+
if restAdminListener["sslPassword"] == nil {
392+
restAdminListener["sslPassword"] = key
393+
}
394+
if restAdminListener["requireClientCert"] == nil {
395+
restAdminListener["requireClientCert"] = isTrue
396+
}
397+
if restAdminListener["caPath"] == nil {
398+
restAdminListener["caPath"] = cacert
399+
}
400+
log.Printf("Admin Server Security merging RestAdminListener using ACE_ADMIN_SERVER environment variables")
401+
}
402+
403+
serverconfYaml, marshallError := yaml.Marshal(&serverconfMap)
404+
if marshallError != nil {
405+
log.Errorf("Error marshalling server.conf.yaml: %v", marshallError)
406+
return nil, marshallError
407+
}
408+
409+
return serverconfYaml, nil
410+
}
411+
308412
// getConfigurationFromContentServer checks if ACE_CONTENT_SERVER_URL exists. If so then it pulls
309413
// a bar file from that URL
310414
func getConfigurationFromContentServer() error {

‎cmd/runaceserver/integrationserver_internal_test.go‎

Lines changed: 85 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -122,3 +122,88 @@ func TestCheckLogs(t *testing.T) {
122122
t.Error(err)
123123
}
124124
}
125+
126+
127+
var yamlAdminTests = []struct {
128+
in string
129+
out string
130+
}{
131+
{ // User's yaml does not have a ResourceAdminListener section, so it is added
132+
`Defaults:
133+
defaultApplication: ''
134+
policyProject: 'DefaultPolicies'
135+
Policies:
136+
HTTPSConnector: 'HTTPS'`,
137+
`Defaults:
138+
Policies:
139+
HTTPSConnector: HTTPS
140+
defaultApplication: ""
141+
policyProject: DefaultPolicies
142+
RestAdminListener:
143+
caPath: /home/aceuser/adminssl
144+
requireClientCert: true
145+
sslCertificate: /home/aceuser/adminssl/tls.crt.pem
146+
sslPassword: /home/aceuser/adminssl/tls.key.pem
147+
`},
148+
{ // User's yaml has RestAdminListener in don't alter.
149+
`Defaults:
150+
defaultApplication: ''
151+
policyProject: 'DefaultPolicies'
152+
Policies:
153+
HTTPSConnector: 'HTTPS'
154+
RestAdminListener:
155+
caPath: "test"
156+
requireClientCert: false
157+
sslCertificate: "test"
158+
sslPassword: "test"`,
159+
`Defaults:
160+
Policies:
161+
HTTPSConnector: HTTPS
162+
defaultApplication: ""
163+
policyProject: DefaultPolicies
164+
RestAdminListener:
165+
caPath: test
166+
requireClientCert: false
167+
sslCertificate: test
168+
sslPassword: test
169+
`},
170+
{ // User's yaml has a ResourceAdminListener section, so ours is merged with users taking precedence
171+
`Defaults:
172+
defaultApplication: ''
173+
policyProject: 'DefaultPolicies'
174+
Policies:
175+
HTTPSConnector: 'HTTPS'
176+
RestAdminListener:
177+
authorizationEnabled: true
178+
requireClientCert: false
179+
authorizationMode: file
180+
sslPassword: "test"
181+
`,
182+
`Defaults:
183+
Policies:
184+
HTTPSConnector: HTTPS
185+
defaultApplication: ""
186+
policyProject: DefaultPolicies
187+
RestAdminListener:
188+
authorizationEnabled: true
189+
authorizationMode: file
190+
caPath: /home/aceuser/adminssl
191+
requireClientCert: false
192+
sslCertificate: /home/aceuser/adminssl/tls.crt.pem
193+
sslPassword: test
194+
`},
195+
}
196+
197+
198+
func TestAddAdminsslToServerConf(t *testing.T) {
199+
for _, table := range yamlAdminTests {
200+
out, err := addAdminsslToServerConf([]byte(table.in))
201+
if err != nil {
202+
t.Error(err)
203+
}
204+
stringOut := string(out)
205+
if stringOut != table.out {
206+
t.Errorf("addAdminsslToServerConf expected \n%v, got \n%v", table.out, stringOut)
207+
}
208+
}
209+
}

0 commit comments

Comments
 (0)