Conversation
|
Tag for build #355918 is 💻 For deploying this image using the dev scripts, run the following first: export MAIN_IMAGE_TAG='3.69.x-211-g8f45d7db74'📦 You can also generate an installation bundle with: docker run -i --rm stackrox/main:3.69.x-211-g8f45d7db74 central generate interactive > bundle.zip🕹️ A |
3c220d4 to
5de5c0d
Compare
17e4977 to
0fa8268
Compare
qa-tests-backend/src/main/groovy/orchestratormanager/Kubernetes.groovy
Outdated
Show resolved
Hide resolved
8d73652 to
28c096d
Compare
2940c57 to
8f45d7d
Compare
| dnf clean all && \ | ||
| microdnf upgrade && \ | ||
| rpm -i /tmp/snappy.rpm && \ | ||
| microdnf install lz4 bzip2 util-linux && \ |
There was a problem hiding this comment.
util-linux brings kill wich is used in e2e tests
| set -euo pipefail | ||
|
|
||
| [ -d /usr/local/share/ca-certificates ] || exit 0 | ||
| [ "$(find /usr/local/share/ca-certificates -maxdepth 1 -name '*.crt' | wc -l)" -gt 0 ] || exit 0 |
There was a problem hiding this comment.
Find is not available on ubi-minimal so we need to handle this without it
|
It would be good to see how this image fares with |
|
@gavin-stackrox I added labels and rerun workflow. Some of tests are not stable so there could be failures not related to this change. |
haha. that is a lot of labels. |
| [ "$(find /usr/local/share/ca-certificates -maxdepth 1 -name '*.crt' | wc -l)" -gt 0 ] || exit 0 | ||
| cp -L /usr/local/share/ca-certificates/* /etc/pki/ca-trust/source/anchors | ||
| update-ca-trust | ||
| cp -L /usr/local/share/ca-certificates/* /etc/pki/ca-trust/source/anchors && update-ca-trust || echo "No custom certificates" |
There was a problem hiding this comment.
So update-ca-trust will fail if there is nothing in /etc/pki/ca-trust/source/anchorscp -L /usr/local/share/ca-certificates/* /etc/pki/ca-trust/source/anchors will fail if there is nothing in /usr/local/share/ca-certificates/*? In which case the find was never required?
gavin-stackrox
left a comment
There was a problem hiding this comment.
LGTM, I will approve depending on CI in a few hours and then it will auto-merge.
|
Co-authored-by: Michaël Petrov <michael@redhat.com>
Description
Currently we are using full ubi image which has all kind of different packages installed by default.
Since our application is a simple executable and we only need a couple of compression libs (for bleve, rocksdb) and some unix tools (
killfor tests) we can useubi-minimalto limit potential vulnerabilities. In the future we can event switch toubi-microto reduce number of tools/libs even more.Once it's get merged we can revert #906 as vulnerabilities should get fixed.
Checklist
If any of these don't apply, please comment below.
Testing Performed
CI