From 2afb034b1a8db48ce28d3af8a4ba6b048e2241ce Mon Sep 17 00:00:00 2001 From: Pascal Armand Date: Wed, 19 Jan 2022 10:40:42 +0100 Subject: [PATCH 1/6] add custom certs --- README.md | 20 ++++++++++++++++---- entrypoint | 49 +++++++++++++++++++++++++++++-------------------- 2 files changed, 45 insertions(+), 24 deletions(-) diff --git a/README.md b/README.md index d549fee..c609766 100644 --- a/README.md +++ b/README.md @@ -23,7 +23,7 @@ strategy = mitogen_linear ### Run Playbook -``` +```sh docker run -it --rm \ -v ${PWD}:/ansible \ pad92/ansible-alpine:latest \ @@ -32,7 +32,7 @@ docker run -it --rm \ ### Generate Base Role structure -``` +```sh docker run -it --rm \ -v ${PWD}:/ansible \ pad92/ansible-alpine:latest \ @@ -41,13 +41,13 @@ docker run -it --rm \ ### Lint Role -``` +```sh docker run -it --rm pad92/ansible-alpine:latest \ -v ${PWD}:/ansible ansible-playbook tests/playbook.yml --syntax-check ``` ### Run with forwarding ssh agent -``` +```sh docker run -it --rm \ -v $(readlink -f $SSH_AUTH_SOCK):/ssh-agent \ -v ${PWD}:/ansible \ @@ -55,3 +55,15 @@ docker run -it --rm \ pad92/ansible-alpine:latest \ sh ``` + +### add custom certifitates + +```sh +docker run -it --rm \ + -v $(readlink -f $SSH_AUTH_SOCK):/ssh-agent \ + -v ${PWD}:/ansible \ + -v ${PWD}/certs/int.pem:/usr/local/share/ca-certificates/int.pem + -v ${PWD}/certs/root.pem:/usr/local/share/ca-certificates/root.pem + -e SSH_AUTH_SOCK=/ssh-agent \ + pad92/ansible-alpine:2.10.7-1 sh +``` diff --git a/entrypoint b/entrypoint index 09c990a..3c92215 100755 --- a/entrypoint +++ b/entrypoint @@ -15,43 +15,52 @@ # Rotate ansible log if exist if [ -f "ansible.log" ]; then - DATE_LOG=$(date -d "$(head -1 ansible.log | cut -d, -f1 )" +%Y%m%d-%H%M%S) 2>/dev/null - if [ -n "$DATE_LOG" ]; then - mv ansible.log ansible-${DATE_LOG}.log - gzip ansible-${DATE_LOG}.log & - fi + DATE_LOG=$(date -d "$(head -1 ansible.log | cut -d, -f1 )" +%Y%m%d-%H%M%S) 2>/dev/null + if [ -n "${DATE_LOG}" ]; then + mv ansible.log ansible-${DATE_LOG}.log + gzip ansible-${DATE_LOG}.log & + fi fi # Optional deploy key -if [ ! -z "$DEPLOY_KEY" ] && [ ! -f "/root/.ssh/id_rsa" ]; then - mkdir -p /root/.ssh/ - echo "${DEPLOY_KEY}" > /root/.ssh/id_rsa - chmod 0600 /root/.ssh/id_rsa +if [ ! -z "${DEPLOY_KEY}" ] && [ ! -f "/root/.ssh/id_rsa" ]; then + mkdir -p /root/.ssh/ + echo "${DEPLOY_KEY}" > /root/.ssh/id_rsa + chmod 0600 /root/.ssh/id_rsa fi # Loadkey into ssh-agent if key exist if [ -f "/root/.ssh/id_rsa" ]; then - eval $(ssh-agent) - ssh-add /root/.ssh/id_rsa + eval $(ssh-agent) + ssh-add /root/.ssh/id_rsa fi # install pip requirements, if any -if [ -z "$PIP_REQUIREMENTS" ]; then - PIP_REQUIREMENTS=requirements.txt +if [ -z "${PIP_REQUIREMENTS}" ]; then + PIP_REQUIREMENTS='requirements.txt' fi -if [ -f "$PIP_REQUIREMENTS" ]; then - pip3 install --upgrade -r $PIP_REQUIREMENTS +if [ -f "${PIP_REQUIREMENTS}" ]; then + pip3 install --upgrade -r $PIP_REQUIREMENTS fi - # install Galaxy roles, if any -if [ -z "$ANSIBLE_REQUIREMENTS" ]; then - ANSIBLE_REQUIREMENTS=requirements.yml +if [ -z "${ANSIBLE_REQUIREMENTS}" ]; then + ANSIBLE_REQUIREMENTS='requirements.yml' +fi + +if [ -f "${ANSIBLE_REQUIREMENTS}" ]; then + ansible-galaxy install $ANSIBLE_GALAXY_PARAM -r $ANSIBLE_REQUIREMENTS +fi + +# update ca-certs +if [ -z "${REQUESTS_CA_BUNDLE}" ]; then + REQUESTS_CA_BUNDLE='/etc/ssl/certs/ca-certificates.crt' fi -if [ -f "$ANSIBLE_REQUIREMENTS" ]; then - ansible-galaxy install $ANSIBLE_GALAXY_PARAM -r $ANSIBLE_REQUIREMENTS +if [ -n "${REQUESTS_CA_BUNDLE}" ]; then + update-ca-certificates + export REQUESTS_CA_BUNDLE="${REQUESTS_CA_BUNDLE}" fi exec "$@" From f1d92c559489e5b1ae4313aab479316fafdf8cfd Mon Sep 17 00:00:00 2001 From: Pascal Armand Date: Wed, 19 Jan 2022 10:55:27 +0100 Subject: [PATCH 2/6] add update switch for ca-certificates package --- README.md | 15 ++++++++------- entrypoint | 2 +- 2 files changed, 9 insertions(+), 8 deletions(-) diff --git a/README.md b/README.md index c609766..6280098 100644 --- a/README.md +++ b/README.md @@ -6,11 +6,12 @@ ### Environnement variable -| Variable | Default Value | Usage | -|----------------------|------------------|---------------------------------------------| -| PIP_REQUIREMENTS | requirements.txt | install python library requirements | -| ANSIBLE_REQUIREMENTS | requirements.yml | install ansible galaxy roles requirements | -| DEPLOY_KEY | | pass an SSH private key to use in container | +| Variable | Default Value | Usage | +|----------------------|------------------|-------------------------------------------------| +| PIP_REQUIREMENTS | requirements.txt | install python library requirements | +| ANSIBLE_REQUIREMENTS | requirements.yml | install ansible galaxy roles requirements | +| DEPLOY_KEY | | pass an SSH private key to use in container | +| CA_CERT_UPGRADE | | set to `true` to update ca-certificates package | ### Mitogen @@ -45,6 +46,7 @@ docker run -it --rm \ docker run -it --rm pad92/ansible-alpine:latest \ -v ${PWD}:/ansible ansible-playbook tests/playbook.yml --syntax-check ``` + ### Run with forwarding ssh agent ```sh @@ -62,8 +64,7 @@ docker run -it --rm \ docker run -it --rm \ -v $(readlink -f $SSH_AUTH_SOCK):/ssh-agent \ -v ${PWD}:/ansible \ - -v ${PWD}/certs/int.pem:/usr/local/share/ca-certificates/int.pem - -v ${PWD}/certs/root.pem:/usr/local/share/ca-certificates/root.pem + -v ${PWD}/ca-certificates:/usr/local/share/ca-certificates -e SSH_AUTH_SOCK=/ssh-agent \ pad92/ansible-alpine:2.10.7-1 sh ``` diff --git a/entrypoint b/entrypoint index 3c92215..0b468cb 100755 --- a/entrypoint +++ b/entrypoint @@ -58,7 +58,7 @@ if [ -z "${REQUESTS_CA_BUNDLE}" ]; then REQUESTS_CA_BUNDLE='/etc/ssl/certs/ca-certificates.crt' fi -if [ -n "${REQUESTS_CA_BUNDLE}" ]; then +if [ "$(find -type f /usr/local/share/ca-certificates/ 2>/dev/null | wc -l)" -gt "0" ]; then update-ca-certificates export REQUESTS_CA_BUNDLE="${REQUESTS_CA_BUNDLE}" fi From 082ec042ba8858471439ee56fb1b33f3fb08179e Mon Sep 17 00:00:00 2001 From: Pascal Armand Date: Wed, 19 Jan 2022 10:57:20 +0100 Subject: [PATCH 3/6] fix comments --- entrypoint | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/entrypoint b/entrypoint index 0b468cb..3e3d886 100755 --- a/entrypoint +++ b/entrypoint @@ -53,14 +53,20 @@ if [ -f "${ANSIBLE_REQUIREMENTS}" ]; then ansible-galaxy install $ANSIBLE_GALAXY_PARAM -r $ANSIBLE_REQUIREMENTS fi -# update ca-certs +# upgrade ca-certificates package +if [ "x${CA_CERT_UPGRADE}" == "xtrue" ]; then + apk add --no-cache ca-certificates +fi + +# export REQUESTS_CA_BUNDLE if [ -z "${REQUESTS_CA_BUNDLE}" ]; then REQUESTS_CA_BUNDLE='/etc/ssl/certs/ca-certificates.crt' fi +export REQUESTS_CA_BUNDLE="${REQUESTS_CA_BUNDLE}" +# update ca-certs if [ "$(find -type f /usr/local/share/ca-certificates/ 2>/dev/null | wc -l)" -gt "0" ]; then update-ca-certificates - export REQUESTS_CA_BUNDLE="${REQUESTS_CA_BUNDLE}" fi exec "$@" From d3b8acb4b38ed1c0204def447990c13a9f494903 Mon Sep 17 00:00:00 2001 From: Pascal Armand Date: Wed, 19 Jan 2022 11:27:33 +0100 Subject: [PATCH 4/6] find only *.crt files --- entrypoint | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/entrypoint b/entrypoint index 3e3d886..0b5ea5b 100755 --- a/entrypoint +++ b/entrypoint @@ -65,7 +65,7 @@ fi export REQUESTS_CA_BUNDLE="${REQUESTS_CA_BUNDLE}" # update ca-certs -if [ "$(find -type f /usr/local/share/ca-certificates/ 2>/dev/null | wc -l)" -gt "0" ]; then +if [ "$(find -type f -name '*.crt' /usr/local/share/ca-certificates/ 2>/dev/null | wc -l)" -gt "0" ]; then update-ca-certificates fi From 9dfeca001a4ed3cce0196a3408a442f20b479f87 Mon Sep 17 00:00:00 2001 From: Pascal Armand Date: Wed, 19 Jan 2022 12:34:55 +0100 Subject: [PATCH 5/6] update apk --- entrypoint | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/entrypoint b/entrypoint index 0b5ea5b..bcfc6cc 100755 --- a/entrypoint +++ b/entrypoint @@ -55,7 +55,7 @@ fi # upgrade ca-certificates package if [ "x${CA_CERT_UPGRADE}" == "xtrue" ]; then - apk add --no-cache ca-certificates + apk add --upgrade --no-cache ca-certificates fi # export REQUESTS_CA_BUNDLE From fed3f141b1294bc62ed51bd59363223f981e4959 Mon Sep 17 00:00:00 2001 From: Pascal Armand Date: Wed, 19 Jan 2022 13:33:15 +0100 Subject: [PATCH 6/6] update image version --- hooks/build | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/hooks/build b/hooks/build index b587138..d2f2b01 100755 --- a/hooks/build +++ b/hooks/build @@ -5,4 +5,4 @@ docker build --build-arg VCS_REF=`git rev-parse --short HEAD` \ --build-arg BUILD_DATE=`date -u +”%Y-%m-%dT%H:%M:%SZ”` \ --build-arg ANSIBLE_VERSION=${ANSIBLE_VERSION:=2.10.7} \ --build-arg ANSIBLE_LINT_VERSION=${ANSIBLE_LINT_VERSION:=5.1.3} \ - -t ${IMAGE_NAME:=pad92/ansible-alpine:2.10.7-1} . + -t ${IMAGE_NAME:=pad92/ansible-alpine:2.10.7-2} .