Skip to content

Commit

Permalink
accept certs from dir instead of .arg
Browse files Browse the repository at this point in the history 
Signed-off-by: Nianyu Shen <[email protected]>
  • Loading branch information
@nianyush
nianyush committed Sep 16, 2024
1 parent 9ed2b03 commit 2c5e518
Show file tree
Hide file tree
Showing 6 changed files with 18 additions and 28 deletions.
1 change: 0 additions & 1 deletion .arg.template
View file
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,6 @@ ISO_NAME=palette-edge-installer
ARCH=amd64
HTTPS_PROXY=
HTTP_PROXY=
PROXY_CERT_PATH=
UPDATE_KERNEL=false
CLUSTERCONFIG=spc.tgz
CIS_HARDENING=false
Expand Down
17 changes: 12 additions & 5 deletions Dockerfile
View file
Original file line number Diff line number Diff line change
Expand Up @@ -7,16 +7,23 @@ ARG HTTP_PROXY
ARG HTTPS_PROXY
ARG NO_PROXY

COPY sc.cr[t] /tmp/sc.crt
RUN if [ "${OS_DISTRIBUTION}" = "ubuntu" ] && [ "${PROXY_CERT_PATH}" != "" ]; then \
cp /tmp/sc.crt /etc/ssl/certs && \
WORKDIR /certs
COPY certs/ /certs/
RUN if [ "${OS_DISTRIBUTION}" = "ubuntu" ]; then \
cp -f /certs/ /usr/local/share/ca-certificates/ && \
update-ca-certificates; \
fi
RUN if [ "${OS_DISTRIBUTION}" = "opensuse-leap" ] && [ "${PROXY_CERT_PATH}" != "" ]; then \
cp /tmp/sc.crt /usr/share/pki/trust/anchors && \
RUN if [ "${OS_DISTRIBUTION}" = "opensuse-leap" ]; then \
cp -f /certs/ /tmp//usr/share/pki/trust/anchors/ && \
update-ca-certificates; \
fi

RUN if [ "${OS_DISTRIBUTION}" = "rhel" ]; then \
cp -f /certs/ /etc/pki/ca-trust/source/anchors/ && \
update-ca-trust; \
fi
RUN rm -rf /certs

########################### Add any other image customizations here #######################

#### Examples ####
Expand Down
20 changes: 3 additions & 17 deletions Earthfile
View file
Original file line number Diff line number Diff line change
Expand Up @@ -48,7 +48,6 @@ ARG NO_PROXY
ARG http_proxy=${HTTP_PROXY}
ARG https_proxy=${HTTPS_PROXY}
ARG no_proxy=${NO_PROXY}
ARG PROXY_CERT_PATH

ARG UPDATE_KERNEL=false
ARG ETCD_VERSION="v3.5.13"
Expand Down Expand Up @@ -173,10 +172,8 @@ build-provider-images-fips:

BASE_ALPINE:
COMMAND
IF [ ! -z $PROXY_CERT_PATH ]
COPY sc.crt /etc/ssl/certs
RUN update-ca-certificates
END
COPY --if-exists certs/ /etc/ssl/certs/
RUN update-ca-certificates
RUN apk add curl

iso-image-rootfs:
Expand Down Expand Up @@ -592,7 +589,7 @@ kairos-provider-image:

# base build image used to create the base image for all other image types
base-image:
FROM DOCKERFILE --build-arg BASE=$BASE_IMAGE --build-arg PROXY_CERT_PATH=$PROXY_CERT_PATH \
FROM DOCKERFILE --build-arg BASE=$BASE_IMAGE \
--build-arg OS_DISTRIBUTION=$OS_DISTRIBUTION --build-arg OS_VERSION=$OS_VERSION \
--build-arg HTTP_PROXY=$HTTP_PROXY --build-arg HTTPS_PROXY=$HTTPS_PROXY \
--build-arg NO_PROXY=$NO_PROXY .
Expand Down Expand Up @@ -633,12 +630,6 @@ base-image:
pro attach $UBUNTU_PRO_KEY
END

# Add proxy certificate if present
IF [ ! -z $PROXY_CERT_PATH ]
COPY sc.crt /etc/ssl/certs
RUN update-ca-certificates
END

RUN apt-get update && \
apt-get install --no-install-recommends kbd zstd vim iputils-ping bridge-utils curl tcpdump ethtool rsyslog logrotate -y

Expand Down Expand Up @@ -677,11 +668,6 @@ base-image:

# OS == Opensuse
ELSE IF [ "$OS_DISTRIBUTION" = "opensuse-leap" ] && [ "$ARCH" = "amd64" ]
# Add proxy certificate if present
IF [ ! -z $PROXY_CERT_PATH ]
COPY sc.crt /usr/share/pki/trust/anchors
RUN update-ca-certificates
END
# Enable or Disable Kernel Updates
IF [ "$UPDATE_KERNEL" = "false" ]
RUN zypper al kernel-de*
Expand Down
3 changes: 1 addition & 2 deletions README.md
View file
Original file line number Diff line number Diff line change
Expand Up @@ -129,8 +129,7 @@ cp .arg.template .arg
| FIPS_ENABLED | to generate FIPS compliant binaries. `true` or `false` | string | `false` |
| HTTP_PROXY | URL of the HTTP Proxy server to be used if needed (Optional) | string | |
| HTTPS_PROXY | URL of the HTTPS Proxy server to be used if needed (Optional) | string | |
| NO_PROXY | URLS that should be excluded from proxying (Optional) | string | |
| PROXY_CERT_PATH | Absolute path of the SSL Proxy certificate in PEM format if needed (Optional) | string | |
| NO_PROXY | URLS that should be excluded from proxying (Optional) | string | |
| UPDATE_KERNEL | Determines whether to upgrade the Kernel version to the latest from the upstream OS provider | boolean | `false` |
| DISABLE_SELINUX | Disable selinux in the operating system. Some applications (like Kubevirt) do not like selinux | boolean | `true` |
| CLUSTERCONFIG | Path of the cluster config | string | |
Expand Down
4 changes: 2 additions & 2 deletions earthly.sh
View file
Original file line number Diff line number Diff line change
Expand Up @@ -11,12 +11,12 @@ function build_with_proxy() {
docker stop earthly-buildkitd
fi
# start earthly buildkitd
docker run -d --privileged --name earthly-buildkitd -v ~/.docker/config.json:/root/.docker/config.json -v /var/run/docker.sock:/var/run/docker.sock --rm -t -e GLOBAL_CONFIG="$global_config" -e BUILDKIT_TCP_TRANSPORT_ENABLED=true -e http_proxy=$HTTP_PROXY -e https_proxy=$HTTPS_PROXY -e HTTPS_PROXY=$HTTPS_PROXY -e HTTP_PROXY=$HTTP_PROXY -e NO_PROXY=$NO_PROXY -e no_proxy=$no_proxy -e EARTHLY_GIT_CONFIG=$gitconfig -v "$PROXY_CERT_PATH:/usr/local/share/ca-certificates/sc.crt:ro" -v earthly-tmp:/tmp/earthly:rw -p 8372:8372 $SPECTRO_PUB_REPO/earthly/buildkitd:$EARTHLY_VERSION
docker run -d --privileged --name earthly-buildkitd -v ~/.docker/config.json:/root/.docker/config.json -v /var/run/docker.sock:/var/run/docker.sock --rm -t -e GLOBAL_CONFIG="$global_config" -e BUILDKIT_TCP_TRANSPORT_ENABLED=true -e http_proxy=$HTTP_PROXY -e https_proxy=$HTTPS_PROXY -e HTTPS_PROXY=$HTTPS_PROXY -e HTTP_PROXY=$HTTP_PROXY -e NO_PROXY=$NO_PROXY -e no_proxy=$no_proxy -e EARTHLY_GIT_CONFIG=$gitconfig -v "$(pwd)/certs:/usr/local/share/ca-certificates:ro" -v earthly-tmp:/tmp/earthly:rw -p 8372:8372 $SPECTRO_PUB_REPO/earthly/buildkitd:$EARTHLY_VERSION
# Update the CA certificates in the container
docker exec -it earthly-buildkitd update-ca-certificates

# Run Earthly in Docker to create artifacts Variables are passed from the .arg file
docker run --privileged -v ~/.docker/config.json:/root/.docker/config.json -v /var/run/docker.sock:/var/run/docker.sock --rm --env EARTHLY_BUILD_ARGS -t -e GLOBAL_CONFIG="$global_config" -e EARTHLY_BUILDKIT_HOST=tcp://0.0.0.0:8372 -e BUILDKIT_TLS_ENABLED=false -v "$(pwd)":/workspace -v "$PROXY_CERT_PATH:/workspace/sc.crt:ro" $SPECTRO_PUB_REPO/earthly/earthly:$EARTHLY_VERSION --allow-privileged "$@"
docker run --privileged -v ~/.docker/config.json:/root/.docker/config.json -v /var/run/docker.sock:/var/run/docker.sock --rm --env EARTHLY_BUILD_ARGS -t -e GLOBAL_CONFIG="$global_config" -e EARTHLY_BUILDKIT_HOST=tcp://0.0.0.0:8372 -e BUILDKIT_TLS_ENABLED=false -v "$(pwd)":/workspace $SPECTRO_PUB_REPO/earthly/earthly:$EARTHLY_VERSION --allow-privileged "$@"
}

function build_without_proxy() {
Expand Down
1 change: 0 additions & 1 deletion test/test-two-node.sh
View file
Original file line number Diff line number Diff line change
Expand Up @@ -65,7 +65,6 @@ ISO_NAME=palette-edge-installer
ARCH=amd64
HTTPS_PROXY=
HTTP_PROXY=
PROXY_CERT_PATH=
UPDATE_KERNEL=false
EOF
}
Expand Down

0 comments on commit 2c5e518

Please sign in to comment.