Skip to content
This repository was archived by the owner on Dec 7, 2020. It is now read-only.

Commit aa9ae98

Browse files
ASzcASzc
authored
Issue-609 Port over Gatekeeper's Dockerfile and kube YAMLs (#638)
I ended up rewriting a good portion of the Dockerfile. It now uses a multi-stage build. It can accept source code to build, or unpack a premade binary. I also updated the Makefile Fixes #609 Fixes #541
1 parent 3f64894 commit aa9ae98

File tree

5 files changed

+160
-19
lines changed

5 files changed

+160
-19
lines changed

‎.dockerignore‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
/bin/

‎Dockerfile‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
#
2+
# Builder image
3+
#
4+
5+
FROM golang:1.14.4 AS build-env
6+
ARG SOURCE=*
7+
8+
ADD $SOURCE /src/
9+
WORKDIR /src/
10+
11+
# Unpack any tars, then try to execute a Makefile, but if the SOURCE url is
12+
# just a tar of binaries, then there probably won't be one. Using multiple RUN
13+
# commands to ensure any errors are caught.
14+
RUN find . -name '*.tar.gz' -type f | xargs -rn1 tar -xzf
15+
RUN if [ -f Makefile ]; then make; fi
16+
RUN cp "$(find . -name 'louketo-proxy' -type f -print -quit)" /louketo-proxy
17+
18+
#
19+
# Actual image
20+
#
21+
22+
FROM registry.access.redhat.com/ubi8/ubi-minimal:8.2
23+
24+
LABEL Name=louketo-proxy \
25+
Release=https://github.com/louketo/louketo-proxy \
26+
Url=https://github.com/louketo/louketo-proxy \
27+
Help=https://github.com/louketo/louketo-proxy/issues
28+
29+
WORKDIR "/opt/louketo"
30+
31+
RUN echo "louketo:x:1000:louketo" >> /etc/group && \
32+
echo "louketo:x:1000:1000:louketo user:/opt/louketo:/sbin/nologin" >> /etc/passwd && \
33+
chown -R louketo:louketo /opt/louketo && \
34+
chmod -R g+rw /opt/louketo
35+
36+
COPY templates ./templates
37+
COPY --from=build-env /louketo-proxy ./
38+
RUN chmod +x louketo-proxy
39+
40+
USER 1000
41+
ENTRYPOINT [ "/opt/louketo/louketo-proxy" ]

‎Makefile‎

Lines changed: 28 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
NAME=louketo-proxy
22
AUTHOR=louketo
33
REGISTRY=docker.io
4-
GOVERSION ?= 1.10.2
4+
CONTAINER_TOOL=$(shell command -v podman 2>/dev/null || command -v docker)
55
ROOT_DIR=${PWD}
66
HARDWARE=$(shell uname -m)
77
GIT_SHA=$(shell git --no-pager describe --always --dirty)
@@ -14,10 +14,10 @@ VETARGS ?= -asmdecl -atomic -bool -buildtags -copylocks -methods -nilfunc -print
1414
PLATFORMS=darwin linux windows
1515
ARCHITECTURES=amd64
1616

17-
.PHONY: test authors changelog build docker static release lint cover vet
1817

1918
default: build
2019

20+
.PHONY: golang build static
2121
golang:
2222
@echo "--> Go Version"
2323
@go version
@@ -28,35 +28,42 @@ build: golang
2828
go build -ldflags "${LFLAGS}" -o bin/${NAME}
2929

3030
static: golang
31-
@echo "--> Compiling the static binary"
31+
@echo "--> Compiling the project statically"
3232
@mkdir -p bin
3333
CGO_ENABLED=0 GOOS=linux go build -a -tags netgo -ldflags "-w ${LFLAGS}" -o bin/${NAME}
3434

35+
.PHONY: container-build docker-build
36+
container-build: docker-build
3537
docker-build:
36-
@echo "--> Compiling the project"
37-
docker run --rm \
38-
-v ${ROOT_DIR}:/go/src/github.com/${AUTHOR}/${NAME} \
39-
-w /go/src/github.com/${AUTHOR}/${NAME} \
40-
-e GOOS=linux golang:${GOVERSION} \
41-
make static
42-
38+
@echo "--> Compiling the project, inside a temporary container"
39+
$(eval IMAGE=$(shell uuidgen))
40+
${CONTAINER_TOOL} build --target build-env -t ${IMAGE} .
41+
${CONTAINER_TOOL} run --rm ${IMAGE} /bin/cat /louketo-proxy > bin/louketo-proxy
42+
${CONTAINER_TOOL} rmi ${IMAGE}
43+
chmod +x bin/louketo-proxy
44+
45+
.PHONY: container-test docker-test
46+
container-test: docker-test
4347
docker-test:
44-
@echo "--> Running the docker test"
45-
docker run --rm -ti -p 3000:3000 \
48+
@echo "--> Running the container image tests"
49+
${CONTAINER_TOOL} run --rm -ti -p 3000:3000 \
4650
-v ${ROOT_DIR}/config.yml:/etc/louketo/config.yml:ro \
4751
-v ${ROOT_DIR}/tests:/opt/tests:ro \
4852
${REGISTRY}/${AUTHOR}/${NAME}:${VERSION} --config /etc/louketo/config.yml
4953

50-
docker-release:
51-
@echo "--> Building a release image"
52-
@$(MAKE) static
53-
@$(MAKE) docker
54-
@docker push ${REGISTRY}/${AUTHOR}/${NAME}:${VERSION}
54+
.PHONY: container-release docker-release
55+
container-release: docker-release
56+
docker-release: docker
57+
@echo "--> Releasing the container image"
58+
${CONTAINER_TOOL} push ${REGISTRY}/${AUTHOR}/${NAME}:${VERSION}
5559

60+
.PHONY: container docker
61+
container: docker
5662
docker:
57-
@echo "--> Building the docker image"
58-
docker build -t ${REGISTRY}/${AUTHOR}/${NAME}:${VERSION} .
63+
@echo "--> Building the container image"
64+
${CONTAINER_TOOL} build -t ${REGISTRY}/${AUTHOR}/${NAME}:${VERSION} .
5965

66+
.PHONY: certs
6067
certs:
6168
@echo "--> Generating the root CA"
6269
@cfssl gencert -initca tests/ca-csr.json | cfssljson -bare tests/ca
@@ -68,6 +75,7 @@ certs:
6875
-profile=server \
6976
tests/proxy-csr.json | cfssljson -bare tests/proxy
7077

78+
.PHONY: clean authors vet lint gofmt verify format bench coverage cover spelling
7179
clean:
7280
rm -rf ./bin/* 2>/dev/null
7381
rm -rf ./release/* 2>/dev/null
@@ -134,6 +142,7 @@ spelling:
134142
@misspell -error *.go
135143
@misspell -error *.md
136144

145+
.PHONY: test all changelog
137146
test:
138147
@echo "--> Running the tests"
139148
@go test -v

‎kube/forward.yml‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
apiVersion: extensions/v1beta1
2+
kind: Deployment
3+
metadata:
4+
name: proxy
5+
spec:
6+
replicas: 1
7+
template:
8+
metadata:
9+
labels:
10+
name: proxy
11+
annotations:
12+
repository: https://github.com/louketo/louketo-proxy
13+
spec:
14+
containers:
15+
- name: proxy
16+
image: docker.io/jboss/louketo/louketo-proxy:latest
17+
imagePullPolicy: Always
18+
args:
19+
- --config /etc/secrets/forwarding.yml
20+
- --discovery-url https://sso.example.com/auth/realms/hod-test
21+
- --client-id broker
22+
- --client-secret
23+
- --listen 127.0.0.1:3000
24+
- --enable-forwarding=true
25+
- --forwarding-username=username
26+
- --forwarding-password=password
27+
- --enable-logging=true
28+
- --enable-json-logging true
29+
- --verbose true
30+
volumeMounts:
31+
- name: secrets
32+
mountPath: /etc/secrets
33+
volumes:
34+
- name: secrets
35+
secret:
36+
secretName: config

‎kube/reverse.yml‎

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
apiVersion: extensions/v1beta1
2+
kind: Deployment
3+
metadata:
4+
name: proxy
5+
spec:
6+
replicas: 1
7+
template:
8+
metadata:
9+
labels:
10+
name: proxy
11+
annotations:
12+
repository: https://github.com/louketo/louketo-proxy
13+
spec:
14+
securityContext:
15+
fsGroup: 1000
16+
runAsNonRoot: true
17+
runAsUser: 1000
18+
volumes:
19+
- name: certs
20+
secret:
21+
secretName: tls
22+
containers:
23+
- name: proxy
24+
image: docker.io/jboss/louketo/louketo-proxy:latest
25+
imagePullPolicy: Always
26+
args:
27+
- --client-id=broker
28+
- --discovery-url=https://sso.example.com/auth/realms/hod-test
29+
- --enable-default-deny=false
30+
- --enable-json-logging=true
31+
- --enable-logging=true
32+
- --enable-request-id=true
33+
- --enable-security-filter=true
34+
- --http-only-cookie=true
35+
- --listen=127.0.0.1:3000
36+
- --preserve-host=true
37+
- --redirection-url=https://www.example.com
38+
- --resources=uri=/admin/*|roles=admin
39+
- --skip-client-id=true
40+
- --tls-cert=/certs/tls.pem
41+
- --tls-private-key=/certs/tls-key.pem
42+
- --upstream-url=http://127.0.0.1:8080
43+
env:
44+
- name: PROXY_CLIENT_SECRET
45+
valueFrom:
46+
secretKeyRef:
47+
name: openid
48+
key: client.secret
49+
securityContext:
50+
readOnlyRootFilesystem: true
51+
volumeMounts:
52+
- name: certs
53+
mountPath: /certs
54+
readOnly: true

0 commit comments

Comments
 (0)