From 885591a9f4a4dcac7621ec1a1dd69f558f7a4167 Mon Sep 17 00:00:00 2001 From: Anthony Fitzroy <101649764+AntFMoJ@users.noreply.github.com> Date: Thu, 18 Apr 2024 11:57:50 +0100 Subject: [PATCH] Migrate kubectl image from data platform (#2) * migrate image build * fixed container-structure-test pt.1 * Update Makefile * update README * Fixed linting pt.1 * Update README.md Co-authored-by: Jacob Woffenden --------- Co-authored-by: Gary H <26419401+Gary-H9@users.noreply.github.com> Co-authored-by: Emterry <123941245+Emterry@users.noreply.github.com> Co-authored-by: Jacob Woffenden --- .devcontainer/devcontainer.json | 2 +- .github/workflows/scan-image.yml | 6 +- Dockerfile | 75 +++++++++------------ Makefile | 39 +++++++---- README.md | 107 ++++++++---------------------- test/container-structure-test.yml | 18 ++--- 6 files changed, 99 insertions(+), 148 deletions(-) diff --git a/.devcontainer/devcontainer.json b/.devcontainer/devcontainer.json index 175f026..960da76 100644 --- a/.devcontainer/devcontainer.json +++ b/.devcontainer/devcontainer.json @@ -1,5 +1,5 @@ { - "name": "analytical-platform-image-build-template", + "name": "analytical-platform-kubectl", "image": "ghcr.io/ministryofjustice/devcontainer-base:latest", "features": { "ghcr.io/devcontainers/features/docker-in-docker:2": {}, diff --git a/.github/workflows/scan-image.yml b/.github/workflows/scan-image.yml index 697bc55..1563e75 100644 --- a/.github/workflows/scan-image.yml +++ b/.github/workflows/scan-image.yml @@ -26,13 +26,13 @@ jobs: with: push: false load: true - tags: analytical-platform-image-build-template + tags: analytical-platform-kubectl - name: Scan Image id: scan_image uses: aquasecurity/trivy-action@d710430a6722f083d3b36b8339ff66b32f22ee55 # v0.19.0 with: - image-ref: analytical-platform-image-build-template + image-ref: analytical-platform-kubectl exit-code: 1 format: sarif output: trivy-results.sarif @@ -51,7 +51,7 @@ jobs: id: scan_image_on_failure uses: aquasecurity/trivy-action@d710430a6722f083d3b36b8339ff66b32f22ee55 # v0.19.0 with: - image-ref: analytical-platform-image-build-template + image-ref: analytical-platform-kubectl exit-code: 1 format: table severity: CRITICAL diff --git a/Dockerfile b/Dockerfile index 4063e61..e8dddef 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,49 +1,38 @@ # checkov:skip=CKV_DOCKER_2:Healthcheck instructions have not been added to container images -# This image is an example base image for this template and can be replaced to fit user needs -FROM public.ecr.aws/ubuntu/ubuntu@sha256:12fb86d81bc4504d8261a91c83c54b9e5dcdf1d833ba0fe42ec9e0ee09a2b0ba +FROM docker.io/alpine:3.19.1 LABEL org.opencontainers.image.vendor="Ministry of Justice" \ - org.opencontainers.image.authors="Analytical Platform (analytical-platform@digital.justice.gov.uk)"\ - org.opencontainers.image.title="{image title}" \ - org.opencontainers.image.description="{decription}" \ - org.opencontainers.image.url="{your repo url}" - -ENV CONTAINER_USER="analyticalplatform" \ - CONTAINER_UID="1000" \ - CONTAINER_GROUP="analyticalplatform" \ - CONTAINER_GID="1000" \ - DEBIAN_FRONTEND="noninteractive" - -SHELL ["/bin/bash", "-e", "-u", "-o", "pipefail", "-c"] - -# User -RUN < -```text -├── .devcontainer -│ ├── devcontainer.json -│ └── devcontainer-lock.json -├── Dockerfile -├── .editorconfig -├── .github -│ ├── CODEOWNERS -│ ├── dependabot.yml -│ └── workflows -│ ├── build-and-test.yml -│ ├── dependency-review.yml -│ ├── release.yml -│ ├── scan-image.yml -│ └── super-linter.yml -├── .gitignore -├── LICENSE -├── Makefile -├── README.md -└── test - └── container-structure-test.yml -``` - -## Setup Instructions - -Once you've created your repository using this template, perform the following steps: - -### Update README - -Edit this README.md file to document your project accurately. Take the time to create a clear, engaging, and informative README.md file. Include information like what your project does, how to install and run it, how to contribute, and any other pertinent details. - -### Update repository description - -After you've created your repository, GitHub provides a brief description field that appears on the top of your repository's main page. This is a summary that gives visitors quick insight into the project. Using this field to provide a succinct overview of your repository is highly recommended. - -This description and your README.md will be one of the first things people see when they visit your repository. It's a good place to make a strong, concise first impression. Remember, this is often visible in search results on GitHub and search engines, so it's also an opportunity to help people discover your project. - -### Grant Team Permissions - -Assign permissions to the appropriate Ministry of Justice teams. Ensure at least one team is granted Admin permissions. Whenever possible, assign permissions to teams rather than individual users. +This repository contains the GitHub Kubectl container image for use in the Analytical Platform. -### Read about the GitHub Repository Standards +## Running Locally -Familiarise yourself with the Ministry of Justice GitHub Repository Standards. These standards ensure consistency, maintainability, and best practices across all our repositories. +### Build -You can find the standards [here](https://operations-engineering.service.justice.gov.uk/documentation/services/repository-standards.html). - -Please read and understand these standards thoroughly and enable them when you feel comfortable. - -### Modify the GitHub Repository Standards Badge - -Once you've ensured that all the [GitHub Repository Standards](https://operations-engineering.service.justice.gov.uk/documentation/services/repository-standards.html) have been applied to your repository, it's time to update the Ministry of Justice (MoJ) Compliance Badge located in the README file. - -The badge demonstrates that your repository is compliant with MoJ's standards. Please follow these [instructions](https://operations-engineering.service.justice.gov.uk/documentation/runbooks/services/add-repo-badge.html) to modify the badge URL to reflect the status of your repository correctly. - -**Please note** the badge will not function correctly if your repository is internal or private. In this case, you may remove the badge from your README. - -### Manage Outside Collaborators - -To add an Outside Collaborator to the repository, follow the guidelines detailed [here](https://github.com/ministryofjustice/github-collaborators). +```bash +docker build --platform linux/amd64 --file Dockerfile --tag analytical-platform.service.justice.gov.uk/kubectl:local . +``` -### Update CODEOWNERS +### Run -(Optional) Modify the CODEOWNERS file to specify the teams or users authorized to approve pull requests. +```bash +docker run -it --rm \ + --platform linux/amd64 \ + --name analytical-platform-actions-runner \ + analytical-platform.service.justice.gov.uk/actions-runner:local +``` +## Versions -### Configure Dependabot +### Alpine -Adapt the dependabot.yml file to match your project's [dependency manager](https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#package-ecosystem) and to enable [automated pull requests for package updates](https://docs.github.com/en/code-security/supply-chain-security). +Generally Dependabot does this, but the following command will return the digest: -### Dependency Review +```bash +docker pull --platform linux/amd64 docker.io/alpine:3.19.1 -If your repository is private with no GitHub Advanced Security license, remove the `.github/workflows/dependency-review.yml` file. +docker image inspect --format='{{index .RepoDigests 0}}' docker.io/alpine:3.19.1 +``` -### Dockerfile +### APT Packages -Make sure to add your own build logic to the bottom of the `Dockerfile`. +To find latest APT package versions, you can run the following: -### Tests +```bash +docker run -it --rm --platform linux/amd64 docker.io/alpine:3.19.1 -> [!NOTE] -> No application testing has been added to this template, this is to be implemented by the developer as required. +apk update -Please make sure to add any additional container structure tests needed to the `container-structure-test.yml`. +apk policy ${PACKAGE} # for example curl, git or gpg +``` diff --git a/test/container-structure-test.yml b/test/container-structure-test.yml index 8948a04..744c020 100644 --- a/test/container-structure-test.yml +++ b/test/container-structure-test.yml @@ -2,24 +2,24 @@ schemaVersion: 2.0.0 containerRunOptions: - user: "analyticalplatform" + user: "nonroot" commandTests: - - name: "ubuntu" + - name: "alpine" command: "grep" - args: ["DISTRIB_RELEASE", "/etc/lsb-release"] - expectedOutput: ["DISTRIB_RELEASE=22.04"] + args: ["VERSION_ID", "/etc/os-release"] + expectedOutput: ["VERSION_ID=3.19.1"] - name: "whoami" command: "whoami" - expectedOutput: ["analyticalplatform"] + expectedOutput: ["nonroot"] - name: "user" command: "id" - args: ["--user", "analyticalplatform"] - expectedOutput: ["1000"] + args: ["-u", "nonroot"] + expectedOutput: ["10000"] - name: "groups" command: "id" - args: ["--groups", "analyticalplatform"] - expectedOutput: ["100"] + args: ["-g", "nonroot"] + expectedOutput: ["10000"]