|
| 1 | +FROM quay.io/openshift/origin-jenkins-agent-base |
| 2 | + |
| 3 | +SHELL ["/bin/bash", "-o", "pipefail", "-c"] |
| 4 | + |
| 5 | +ENV SONAR_SCANNER_VERSION=7.0.2.4839 \ |
| 6 | + CNES_REPORT_VERSION=5.0.1 \ |
| 7 | + COSIGN_VERSION=2.4.3 \ |
| 8 | + TAILOR_VERSION=1.3.4 \ |
| 9 | + SOPS_VERSION=3.9.4 \ |
| 10 | + HELM_VERSION=3.17.1 \ |
| 11 | + HELM_PLUGIN_DIFF_VERSION=3.10.0 \ |
| 12 | + HELM_PLUGIN_SECRETS_VERSION=4.6.3 \ |
| 13 | + GIT_LFS_VERSION=3.6.1 \ |
| 14 | + IMGPKG_VERSION=0.44.0 \ |
| 15 | + TRIVY_VERSION=0.60.0 \ |
| 16 | + YQ_VERSION=4.45.1 \ |
| 17 | + JAVA_GC_OPTS="-XX:+UseParallelGC -XX:MinHeapFreeRatio=5 -XX:MaxHeapFreeRatio=10 -XX:GCTimeRatio=4 -XX:AdaptiveSizePolicyWeight=90" |
| 18 | + |
| 19 | +ARG APP_DNS |
| 20 | +ARG SNYK_DISTRIBUTION_URL |
| 21 | +ARG AQUASEC_SCANNERCLI_URL |
| 22 | + |
| 23 | +# Add UBI repositories. |
| 24 | +COPY yum.repos.d/ubi8.repo /etc/yum.repos.d/ubi.repo |
| 25 | + |
| 26 | +COPY ensure_java_jre_is_adequate.sh /usr/local/bin/ |
| 27 | +COPY ./set-default-java.sh /etc/profile.d/set-default-java.sh |
| 28 | + |
| 29 | +RUN cd /etc/yum.repos.d && rm -f localdev-* ci-rpm-mirrors.repo \ |
| 30 | + && ensure_java_jre_is_adequate.sh \ |
| 31 | + && yum -y install make glibc-langpack-en openssl skopeo \ |
| 32 | + && yum -y update \ |
| 33 | + && yum clean all \ |
| 34 | + && rm -rf /var/cache/yum/* \ |
| 35 | + && skopeo --version |
| 36 | + |
| 37 | +# Copy use java scripts. |
| 38 | +COPY use-j*.sh /usr/local/bin/ |
| 39 | +RUN chmod +x /usr/local/bin/use-j*.sh && \ |
| 40 | + chmod ugo+s /usr/local/bin/use-j*.sh && \ |
| 41 | + sh -c 'chmod ugo+s $(which alternatives)' && \ |
| 42 | + ls -la /usr/local/bin/use-j*.sh && \ |
| 43 | + echo "--- STARTS JDK 17 TESTS ---" && \ |
| 44 | + use-j17.sh && \ |
| 45 | + echo "--- ENDS JDK 17 TESTS ---" |
| 46 | + |
| 47 | +COPY ./import_certs.sh /usr/local/bin/import_certs.sh |
| 48 | +COPY ./fix_java_certs_permissions.sh /usr/local/bin/fix_java_certs_permissions.sh |
| 49 | +RUN import_certs.sh && fix_java_certs_permissions.sh |
| 50 | + |
| 51 | +# Install Sonar Scanner. |
| 52 | +RUN cd /tmp \ |
| 53 | + && curl -sSLO https://repo1.maven.org/maven2/org/sonarsource/scanner/cli/sonar-scanner-cli/${SONAR_SCANNER_VERSION}/sonar-scanner-cli-${SONAR_SCANNER_VERSION}.zip \ |
| 54 | + && unzip sonar-scanner-cli-${SONAR_SCANNER_VERSION}.zip \ |
| 55 | + && mv sonar-scanner-${SONAR_SCANNER_VERSION} /usr/local/sonar-scanner-cli \ |
| 56 | + && rm -rf sonar-scanner-cli-${SONAR_SCANNER_VERSION}.zip \ |
| 57 | + && /usr/local/sonar-scanner-cli/bin/sonar-scanner --version |
| 58 | +ENV PATH=/usr/local/sonar-scanner-cli/bin:$PATH |
| 59 | + |
| 60 | +# Add sq cnes report jar. |
| 61 | +RUN cd /tmp \ |
| 62 | + && curl -sSL https://github.com/cnescatlab/sonar-cnes-report/releases/download/${CNES_REPORT_VERSION}/sonar-cnes-report-${CNES_REPORT_VERSION}.jar -o cnesreport.jar \ |
| 63 | + && mkdir /usr/local/cnes \ |
| 64 | + && mv cnesreport.jar /usr/local/cnes/cnesreport.jar \ |
| 65 | + && chmod 777 /usr/local/cnes/cnesreport.jar |
| 66 | + |
| 67 | +# Install sigstore/cosign |
| 68 | +RUN cd /tmp \ |
| 69 | + && curl -sSLO https://github.com/sigstore/cosign/releases/download/v${COSIGN_VERSION}/cosign-linux-amd64 \ |
| 70 | + && mv /tmp/cosign-linux-amd64 /usr/local/bin/cosign \ |
| 71 | + && chmod 755 /usr/local/bin/cosign \ |
| 72 | + && cosign version |
| 73 | + |
| 74 | +# Install Tailor. |
| 75 | +RUN cd /tmp \ |
| 76 | + && curl -sSLO https://github.com/opendevstack/tailor/releases/download/v${TAILOR_VERSION}/tailor-linux-amd64 \ |
| 77 | + && mv tailor-linux-amd64 /usr/local/bin/tailor \ |
| 78 | + && chmod a+x /usr/local/bin/tailor \ |
| 79 | + && tailor version |
| 80 | + |
| 81 | +# Install Helm. |
| 82 | +RUN cd /tmp \ |
| 83 | + && dnf install -y https://github.com/mozilla/sops/releases/download/v${SOPS_VERSION}/sops-${SOPS_VERSION}-1.x86_64.rpm \ |
| 84 | + && mkdir -p /tmp/helm \ |
| 85 | + && curl -sSLO https://get.helm.sh/helm-v${HELM_VERSION}-linux-amd64.tar.gz \ |
| 86 | + && tar -zxvf helm-v${HELM_VERSION}-linux-amd64.tar.gz -C /tmp/helm \ |
| 87 | + && mv /tmp/helm/linux-amd64/helm /usr/local/bin/helm \ |
| 88 | + && chmod a+x /usr/local/bin/helm \ |
| 89 | + && helm version \ |
| 90 | + && helm env \ |
| 91 | + && helm plugin install https://github.com/databus23/helm-diff --version v${HELM_PLUGIN_DIFF_VERSION} \ |
| 92 | + && helm plugin install https://github.com/jkroepke/helm-secrets --version v${HELM_PLUGIN_SECRETS_VERSION} \ |
| 93 | + && sops --version \ |
| 94 | + && rm -rf /tmp/helm /tmp/helm-v${HELM_VERSION}-linux-amd64.tar.gz |
| 95 | + |
| 96 | +# Install imgpkg. |
| 97 | +RUN cd /tmp \ |
| 98 | + && curl -sSLO https://github.com/carvel-dev/imgpkg/releases/download/v${IMGPKG_VERSION}/imgpkg-linux-amd64 \ |
| 99 | + && mv imgpkg-linux-amd64 /usr/local/bin/imgpkg \ |
| 100 | + && chmod a+x /usr/local/bin/imgpkg \ |
| 101 | + && imgpkg --version |
| 102 | + |
| 103 | +# Install yq. |
| 104 | +RUN cd /tmp \ |
| 105 | + && curl -sSLO https://github.com/mikefarah/yq/releases/download/v${YQ_VERSION}/yq_linux_amd64 \ |
| 106 | + && mv yq_linux_amd64 /usr/local/bin/yq \ |
| 107 | + && chmod a+x /usr/local/bin/yq \ |
| 108 | + && yq --version |
| 109 | + |
| 110 | +# Install GIT-LFS extension https://git-lfs.github.com/. |
| 111 | +RUN cd /tmp \ |
| 112 | + && mkdir -p /tmp/git-lfs \ |
| 113 | + && curl -sSLO https://github.com/git-lfs/git-lfs/releases/download/v${GIT_LFS_VERSION}/git-lfs-linux-amd64-v${GIT_LFS_VERSION}.tar.gz \ |
| 114 | + && tar -zxvf git-lfs-linux-amd64-v${GIT_LFS_VERSION}.tar.gz -C /tmp/git-lfs \ |
| 115 | + && bash /tmp/git-lfs/git-lfs-${GIT_LFS_VERSION}/install.sh \ |
| 116 | + && git lfs version \ |
| 117 | + && rm -rf /tmp/git-lfs* |
| 118 | + |
| 119 | +# Optionally install snyk. |
| 120 | +RUN if [ -z $SNYK_DISTRIBUTION_URL ] ; then echo 'Skipping snyk installation!' ; else echo 'Installing snyk... getting binary from' $SNYK_DISTRIBUTION_URL \ |
| 121 | + && curl -sSL $SNYK_DISTRIBUTION_URL --output snyk \ |
| 122 | + && mv snyk /usr/local/bin \ |
| 123 | + && chmod +rwx /usr/local/bin/snyk \ |
| 124 | + && mkdir -p $HOME/.config/configstore/ \ |
| 125 | + && chmod -R g+rw $HOME/.config/configstore/ \ |
| 126 | + && echo 'Snyk CLI version:' \ |
| 127 | + && snyk --version \ |
| 128 | + && echo 'Snyk installation completed!'; \ |
| 129 | + fi |
| 130 | + |
| 131 | +# Optionally install Aquasec. |
| 132 | +RUN if [ -z $AQUASEC_SCANNERCLI_URL ] ; then echo 'Skipping AquaSec installation!' ; else echo 'Installing AquaSec... getting binary from' $AQUASEC_SCANNERCLI_URL \ |
| 133 | + && curl -sSL $AQUASEC_SCANNERCLI_URL --output aquasec \ |
| 134 | + && mv aquasec /usr/local/bin \ |
| 135 | + && chmod +rwx /usr/local/bin/aquasec \ |
| 136 | + && echo 'AquaSec CLI version:' \ |
| 137 | + && aquasec version \ |
| 138 | + && echo 'AquaSec installation completed!'; \ |
| 139 | + fi |
| 140 | + |
| 141 | +# Install Trivy. |
| 142 | +RUN curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin v$TRIVY_VERSION \ |
| 143 | + && echo 'Trivy CLI version:' \ |
| 144 | + && trivy version |
| 145 | + |
| 146 | +# Set java proxy var. |
| 147 | +COPY set_java_proxy.sh /tmp/set_java_proxy.sh |
| 148 | +RUN . /tmp/set_java_proxy.sh && echo $JAVA_OPTS |
| 149 | + |
| 150 | +# Customize entrypoint. |
| 151 | +COPY fix_openshift_run_jnlp_client.sh /usr/local/bin/fix_openshift_run_jnlp_client.sh |
| 152 | +RUN mv /usr/local/bin/run-jnlp-client /usr/local/bin/openshift-run-jnlp-client \ |
| 153 | + && fix_openshift_run_jnlp_client.sh /usr/local/bin/openshift-run-jnlp-client |
| 154 | + |
| 155 | +COPY ods-run-jnlp-client.sh /usr/local/bin/run-jnlp-client |
| 156 | + |
| 157 | +# Fix permissions. |
| 158 | +RUN mkdir -p /home/jenkins/.config && chmod -R g+w /home/jenkins/.config \ |
| 159 | + && mkdir -p /home/jenkins/.cache && chmod -R g+w /home/jenkins/.cache \ |
| 160 | + && mkdir -p /home/jenkins/.sonar && chmod -R g+w /home/jenkins/.sonar \ |
| 161 | + && mkdir -p /tmp/aqua && chmod -R g+w /tmp/aqua |
0 commit comments