diff --git a/build-tools-internal/src/main/java/org/elasticsearch/gradle/internal/DockerBase.java b/build-tools-internal/src/main/java/org/elasticsearch/gradle/internal/DockerBase.java index d4904be95fbd2..7badb42f89bbe 100644 --- a/build-tools-internal/src/main/java/org/elasticsearch/gradle/internal/DockerBase.java +++ b/build-tools-internal/src/main/java/org/elasticsearch/gradle/internal/DockerBase.java @@ -24,16 +24,21 @@ public enum DockerBase { // Chainguard based wolfi image with latest jdk // This is usually updated via renovatebot // spotless:off - WOLFI("docker.elastic.co/wolfi/chainguard-base:latest@sha256:1c7f5aa0e7997455b8500d095c7a90e617102d3941eb0757ac62cfea509e09b9", + WOLFI( + "docker.elastic.co/wolfi/chainguard-base:latest@sha256:1c7f5aa0e7997455b8500d095c7a90e617102d3941eb0757ac62cfea509e09b9", "-wolfi", "apk" ), - FIPS("docker.elastic.co/wolfi/chainguard-base-fips:sha256-ebfc3f1d7dba992231747a2e05ad1b859843e81b5e676ad342859d7cf9e425a7", "-fips", "apk"), // spotless:on // Based on WOLFI above, with more extras. We don't set a base image because // we programmatically extend from the wolfi image. - CLOUD_ESS(null, "-cloud-ess", "apk"); + CLOUD_ESS(null, "-cloud-ess", "apk"), + CLOUD_ESS_FIPS( + "docker.elastic.co/wolfi/chainguard-base-fips:sha256-ebfc3f1d7dba992231747a2e05ad1b859843e81b5e676ad342859d7cf9e425a7", + "-cloud-ess-fips", + "apk" + ); private final String image; private final String suffix; diff --git a/distribution/docker/build.gradle b/distribution/docker/build.gradle index 6e6b30b33cdca..70b580950eacd 100644 --- a/distribution/docker/build.gradle +++ b/distribution/docker/build.gradle @@ -307,7 +307,7 @@ void addBuildDockerContextTask(Architecture architecture, DockerBase base) { filter TransformLog4jConfigFilter } } - if(base == DockerBase.FIPS) { + if(base == DockerBase.CLOUD_ESS_FIPS) { // If we're performing a release build, but `build.id` hasn't been set, we can // infer that we're not at the Docker building stage of the build, and therefore @@ -587,19 +587,19 @@ subprojects { Project subProject -> base = DockerBase.UBI } else if (subProject.name.contains('ironbank-')) { base = DockerBase.IRON_BANK - } else if (subProject.name.contains('cloud-ess-')) { + } else if (subProject.name.contains('cloud-ess-docker')) { base = DockerBase.CLOUD_ESS } else if (subProject.name.contains('wolfi-')) { base = DockerBase.WOLFI - } else if (subProject.name.contains('fips-')) { - base = DockerBase.FIPS + } else if (subProject.name.contains('cloud-ess-fips-docker')) { + base = DockerBase.CLOUD_ESS_FIPS } final String arch = architecture == Architecture.AARCH64 ? '-aarch64' : '' final String extension = base == DockerBase.UBI ? 'ubi.tar' : (base == DockerBase.IRON_BANK ? 'ironbank.tar' : (base == DockerBase.CLOUD_ESS ? 'cloud-ess.tar' : - (base == DockerBase.FIPS ? 'fips.tar' : + (base == DockerBase.CLOUD_ESS_FIPS ? 'cloud-ess-fips.tar' : (base == DockerBase.WOLFI ? 'wolfi.tar' : 'docker.tar')))) final String artifactName = "elasticsearch${arch}${base.suffix}_test" diff --git a/distribution/docker/fips-docker-aarch64-export/build.gradle b/distribution/docker/cloud-ess-fips-docker-aarch64-export/build.gradle similarity index 100% rename from distribution/docker/fips-docker-aarch64-export/build.gradle rename to distribution/docker/cloud-ess-fips-docker-aarch64-export/build.gradle diff --git a/distribution/docker/fips-docker-export/build.gradle b/distribution/docker/cloud-ess-fips-docker-export/build.gradle similarity index 100% rename from distribution/docker/fips-docker-export/build.gradle rename to distribution/docker/cloud-ess-fips-docker-export/build.gradle diff --git a/distribution/docker/src/docker/Dockerfile b/distribution/docker/src/docker/Dockerfile index 27cf9602b9130..8f5685a41612c 100644 --- a/distribution/docker/src/docker/Dockerfile +++ b/distribution/docker/src/docker/Dockerfile @@ -43,13 +43,13 @@ RUN chmod 0555 /bin/tini # Install required packages to extract the Elasticsearch distribution <% if (docker_base == 'default') { %> RUN <%= retry.loop(package_manager, "${package_manager} update && DEBIAN_FRONTEND=noninteractive ${package_manager} install -y curl ") %> -<% } else if (docker_base == "wolfi" || docker_base == "fips") { %> +<% } else if (docker_base == "wolfi" || docker_base == 'cloud_ess_fips') { %> RUN <%= retry.loop(package_manager, "export DEBIAN_FRONTEND=noninteractive && ${package_manager} update && ${package_manager} update && ${package_manager} add --no-cache curl") %> <% } else { %> RUN <%= retry.loop(package_manager, "${package_manager} install -y findutils tar gzip") %> <% } %> -<% if (docker_base != 'wolfi' && docker_base != 'fips' ) { %> +<% if (docker_base != 'wolfi' && docker_base != 'cloud_ess_fips' ) { %> # `tini` is a tiny but valid init for containers. This is used to cleanly # control how ES and any child processes are shut down. # For wolfi we pick it from the blessed wolfi package registry. @@ -117,7 +117,7 @@ RUN sed -i -e 's/ES_DISTRIBUTION_TYPE=tar/ES_DISTRIBUTION_TYPE=docker/' bin/elas chmod 0775 bin config config/jvm.options.d data logs plugins && \\ find config -type f -exec chmod 0664 {} + -<% if (docker_base == "fips") { %> +<% if (docker_base == 'cloud_ess_fips') { %> # Add plugins infrastructure RUN mkdir -p /opt/plugins/archive RUN chmod -R 0555 /opt/plugins @@ -178,7 +178,7 @@ RUN ${package_manager} update --setopt=tsflags=nodocs -y && \\ nc shadow-utils zip findutils unzip procps-ng && \\ ${package_manager} clean all -<% } else if (docker_base == "wolfi" || docker_base == "fips") { %> +<% } else if (docker_base == "wolfi" || docker_base == 'cloud_ess_fips') { %> RUN <%= retry.loop(package_manager, "export DEBIAN_FRONTEND=noninteractive && \n" + " ${package_manager} update && \n" + @@ -227,7 +227,7 @@ RUN groupadd -g 1000 elasticsearch && \\ adduser --uid 1000 --gid 1000 --home /usr/share/elasticsearch elasticsearch && \\ adduser elasticsearch root && \\ chown -R 0:0 /usr/share/elasticsearch -<% } else if (docker_base == "wolfi" || docker_base == "fips") { %> +<% } else if (docker_base == "wolfi" || docker_base == 'cloud_ess_fips') { %> RUN groupadd -g 1000 elasticsearch && \ adduser -G elasticsearch -u 1000 elasticsearch -D --home /usr/share/elasticsearch elasticsearch && \ adduser elasticsearch root && \ @@ -243,7 +243,7 @@ ENV ELASTIC_CONTAINER true WORKDIR /usr/share/elasticsearch COPY --from=builder --chown=0:0 /usr/share/elasticsearch /usr/share/elasticsearch -<% if (docker_base != "wolfi" && docker_base != "fips") { %> +<% if (docker_base != "wolfi" && docker_base != 'cloud_ess_fips') { %> COPY --from=builder --chown=0:0 /bin/tini /bin/tini <% } %> @@ -277,7 +277,7 @@ RUN chmod g=u /etc/passwd && \\ # stays up-to-date with changes to Ubuntu's store) COPY bin/docker-openjdk /etc/ca-certificates/update.d/docker-openjdk RUN /etc/ca-certificates/update.d/docker-openjdk -<% } else if (docker_base == 'wolfi' || docker_base == "fips") { %> +<% } else if (docker_base == 'wolfi' || docker_base == 'cloud_ess_fips') { %> RUN ln -sf /etc/ssl/certs/java/cacerts /usr/share/elasticsearch/jdk/lib/security/cacerts <% } else { %> RUN ln -sf /etc/pki/ca-trust/extracted/java/cacerts /usr/share/elasticsearch/jdk/lib/security/cacerts @@ -324,7 +324,7 @@ RUN mkdir /licenses && cp LICENSE.txt /licenses/LICENSE COPY LICENSE /licenses/LICENSE.addendum <% } %> -<% if (docker_base == "wolfi" || docker_base == "fips") { %> +<% if (docker_base == "wolfi" || docker_base == 'cloud_ess_fips') { %> # Our actual entrypoint is `tini`, a minimal but functional init program. It # calls the entrypoint we provide, while correctly forwarding signals. ENTRYPOINT ["/sbin/tini", "--", "/usr/local/bin/docker-entrypoint.sh"] @@ -344,7 +344,7 @@ USER 1000:0 HEALTHCHECK --interval=10s --timeout=5s --start-period=1m --retries=5 CMD curl -I -f --max-time 5 http://localhost:9200 || exit 1 <% } %> -<% if (docker_base == 'fips') { %> +<% if (docker_base == 'cloud_ess_fips') { %> COPY --from=builder --chown=0:0 /opt /opt ENV ES_PLUGIN_ARCHIVE_DIR /opt/plugins/archive WORKDIR /usr/share/elasticsearch @@ -352,4 +352,4 @@ COPY --from=builder --chown=0:0 /fips/libs/*.jar /usr/share/elasticsearch/lib/ <% } %> ################################################################################ # End of multi-stage Dockerfile -################################################################################ +################################################################################ \ No newline at end of file diff --git a/settings.gradle b/settings.gradle index 313d1c2d88cf7..ec5c03d21a453 100644 --- a/settings.gradle +++ b/settings.gradle @@ -72,8 +72,8 @@ List projects = [ 'distribution:docker:ubi-docker-export', 'distribution:docker:wolfi-docker-aarch64-export', 'distribution:docker:wolfi-docker-export', - 'distribution:docker:fips-docker-export', - 'distribution:docker:fips-docker-aarch64-export', + 'distribution:docker:cloud-ess-fips-docker-export', + 'distribution:docker:cloud-ess-fips-docker-aarch64-export', 'distribution:packages:aarch64-deb', 'distribution:packages:deb', 'distribution:packages:aarch64-rpm',