From beadf4d356f611b3a25f26995a8192a55efab053 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jakub=20=C4=8Cajka?= Date: Mon, 17 Sep 2018 10:31:00 +0200 Subject: [PATCH 1/2] Ininitial f27/3.6 commit --- Dockerfile | 44 +++ bin/.gitignore | 2 + system-container/config.json.template | 290 +++++++++++++++++++ system-container/manifest.json | 11 + system-container/service.template | 18 ++ system-container/system-container-wrapper.sh | 4 + system-container/tmpfiles.template | 2 + 7 files changed, 371 insertions(+) create mode 100644 Dockerfile create mode 100644 bin/.gitignore create mode 100644 system-container/config.json.template create mode 100644 system-container/manifest.json create mode 100644 system-container/service.template create mode 100755 system-container/system-container-wrapper.sh create mode 100644 system-container/tmpfiles.template diff --git a/Dockerfile b/Dockerfile new file mode 100644 index 0000000..60839ed --- /dev/null +++ b/Dockerfile @@ -0,0 +1,44 @@ +# +# This is the official OpenShift Origin image. It has as its entrypoint the OpenShift +# all-in-one binary. +# +# While this image can be used for a simple node it does not support OVS based +# SDN or storage plugins required for EBS, GCE, Gluster, Ceph, or iSCSI volume +# management. For those features please use 'openshift/node' +# +# The standard name for this image is openshift/origin +# +FROM registry.fedoraproject.org/f27/origin-base:latest + +ENV NAME=origin \ + VERSION=3.6 \ + ARCH=x86_64 + +COPY system-container/system-container-wrapper.sh /usr/local/bin/ +COPY system-container/config.json.template system-container/manifest.json system-container/service.template system-container/tmpfiles.template /exports/ +RUN INSTALL_PKGS="origin" && \ + dnf install -y ${INSTALL_PKGS} && \ + rpm -V ${INSTALL_PKGS} && \ + dnf clean all && \ + setcap 'cap_net_bind_service=ep' /usr/bin/openshift + +LABEL io.k8s.display-name="OpenShift Origin Application Platform" \ + io.k8s.description="OpenShift Origin is a platform for developing, building, and deploying containerized applications." \ + summary="OpenShift Origin is a platform for developing, building, and deploying containerized applications." \ + io.openshift.tags="openshift,core" \ + maintainer="Jakub Cajka " \ + License="GPLv2+" \ + name="$FGC/$NAME" \ + com.redhat.component="$NAME" \ + version="$VERSION" \ + architecture="$ARCH" \ + usage="Image used for deployment of openshift origin" + +ENV HOME=/root \ + OPENSHIFT_CONTAINERIZED=true \ + KUBECONFIG=/var/lib/origin/openshift.local.config/master/admin.kubeconfig + +WORKDIR /var/lib/origin +EXPOSE 8443 53 + +ENTRYPOINT ["/usr/bin/openshift"] diff --git a/bin/.gitignore b/bin/.gitignore new file mode 100644 index 0000000..d6b7ef3 --- /dev/null +++ b/bin/.gitignore @@ -0,0 +1,2 @@ +* +!.gitignore diff --git a/system-container/config.json.template b/system-container/config.json.template new file mode 100644 index 0000000..8807445 --- /dev/null +++ b/system-container/config.json.template @@ -0,0 +1,290 @@ +{ + "ociVersion": "1.0.0", + "platform": { + "os": "linux", + "arch": "amd64" + }, + "process": { + "terminal": false, + "user": {}, + "args": [ + "/usr/local/bin/system-container-wrapper.sh" + ], + "env": [ + "container=docker", + "PKGM=yum", + "PATH=/usr/local/bin:/usr/bin:/bin:/usr/local/sbin:/usr/sbin", + "HOME=/root", + "NAME=$NAME", + "COMMAND=$COMMAND", + "OPENSHIFT_CONTAINERIZED=true", + "KUBECONFIG=/var/lib/origin/openshift.local.config/master/admin.kubeconfig", + "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "TERM=xterm" + ], + "cwd": "/var/lib/origin", + "capabilities": { + "bounding" : [ + "CAP_AUDIT_WRITE", + "CAP_KILL", + "CAP_NET_BIND_SERVICE" + ], + "permitted" : [ + "CAP_AUDIT_WRITE", + "CAP_KILL", + "CAP_NET_BIND_SERVICE" + ], + "inheritable" : [ + "CAP_AUDIT_WRITE", + "CAP_KILL", + "CAP_NET_BIND_SERVICE" + ], + "effective" : [ + "CAP_AUDIT_WRITE", + "CAP_KILL", + "CAP_NET_BIND_SERVICE" + ], + "ambient" : [ + "CAP_AUDIT_WRITE", + "CAP_KILL", + "CAP_NET_BIND_SERVICE" + ] + }, + "rlimits": [ + { + "type": "RLIMIT_NOFILE", + "hard": 1024, + "soft": 1024 + } + ], + "noNewPrivileges": true + }, + "root": { + "path": "rootfs", + "readonly": true + }, + "mounts": [ + { + "destination": "/proc", + "type": "proc", + "source": "proc" + }, + { + "destination": "/dev", + "type": "tmpfs", + "source": "tmpfs", + "options": [ + "nosuid", + "strictatime", + "mode=755", + "size=65536k" + ] + }, + { + "destination": "/dev/pts", + "type": "devpts", + "source": "devpts", + "options": [ + "nosuid", + "noexec", + "newinstance", + "ptmxmode=0666", + "mode=0620", + "gid=5" + ] + }, + { + "destination": "/dev/shm", + "type": "tmpfs", + "source": "shm", + "options": [ + "nosuid", + "noexec", + "nodev", + "mode=1777", + "size=65536k" + ] + }, + { + "destination": "/dev/mqueue", + "type": "mqueue", + "source": "mqueue", + "options": [ + "nosuid", + "noexec", + "nodev" + ] + }, + { + "destination": "/sys", + "type": "sysfs", + "source": "sysfs", + "options": [ + "nosuid", + "noexec", + "nodev", + "ro" + ] + }, + { + "destination": "/sys/fs/cgroup", + "type": "cgroup", + "source": "cgroup", + "options": [ + "nosuid", + "noexec", + "nodev", + "relatime", + "ro" + ] + }, + { + "type": "bind", + "source": "/etc/resolv.conf", + "destination": "/etc/resolv.conf", + "options": [ + "rbind", + "ro" + ] + }, + { + "type": "bind", + "source": "$ORIGIN_CONFIG_DIR", + "destination": "/etc/origin", + "options": [ + "bind", + "rw", + "mode=755" + ] + }, + { + "type": "bind", + "source": "/etc/pki", + "destination": "/etc/pki", + "options": [ + "bind", + "ro" + ] + }, + { + "type": "bind", + "source": "$ORIGIN_DATA_DIR", + "destination": "/var/lib/origin", + "options": [ + "rbind", + "rw", + "mode=755" + ] + }, + { + "destination": "/tmp", + "type": "tmpfs", + "source": "tmpfs", + "options": [ + "nosuid", + "strictatime", + "mode=755", + "size=65536k" + ] + }, + { + "type": "bind", + "source": "/var/log", + "destination": "/var/log", + "options": [ + "rbind", + "rw", + "mode=755" + ] + }, + { + "type": "bind", + "source": "/var/run", + "destination": "/var/run", + "options": [ + "rbind", + "rw", + "mode=755" + ] + } + ], + "hooks": {}, + "linux": { + "resources": { + "devices": [ + { + "allow": false, + "access": "rwm" + }, + { + "allow": true, + "type": "c", + "major": 1, + "minor": 5, + "access": "rwm" + }, + { + "allow": true, + "type": "c", + "major": 1, + "minor": 3, + "access": "rwm" + }, + { + "allow": true, + "type": "c", + "major": 1, + "minor": 9, + "access": "rwm" + }, + { + "allow": true, + "type": "c", + "major": 1, + "minor": 8, + "access": "rwm" + }, + { + "allow": true, + "type": "c", + "major": 5, + "minor": 0, + "access": "rwm" + }, + { + "allow": true, + "type": "c", + "major": 5, + "minor": 1, + "access": "rwm" + }, + { + "allow": false, + "type": "c", + "major": 10, + "minor": 229, + "access": "rwm" + } + ] + }, + "namespaces": [ + { + "type": "mount" + } + ], + "maskedPaths": [ + "/proc/kcore", + "/proc/latency_stats", + "/proc/timer_stats", + "/proc/sched_debug" + ], + "readonlyPaths": [ + "/proc/asound", + "/proc/bus", + "/proc/fs", + "/proc/irq", + "/proc/sys", + "/proc/sysrq-trigger" + ] + } +} diff --git a/system-container/manifest.json b/system-container/manifest.json new file mode 100644 index 0000000..7b87e0c --- /dev/null +++ b/system-container/manifest.json @@ -0,0 +1,11 @@ +{ + "version": "1.0", + "defaultValues": { + "COMMAND": "", + "ORIGIN_CONFIG_DIR": "/etc/origin", + "ORIGIN_DATA_DIR": "/var/lib/origin", + "ETCD_SERVICE": "etcd.service", + "NODE_SERVICE": "atomic-openshift-node.service", + "DOCKER_SERVICE": "docker.service" + } +} diff --git a/system-container/service.template b/system-container/service.template new file mode 100644 index 0000000..f2d5271 --- /dev/null +++ b/system-container/service.template @@ -0,0 +1,18 @@ +[Unit] +After=network-online.target +After=${ETCD_SERVICE} +Before=${NODE_SERVICE} + +[Service] +EnvironmentFile=-/etc/sysconfig/$NAME +ExecStartPre=/bin/bash -c 'export -p > /run/$NAME-env' +ExecStart=$EXEC_START +ExecStop=$EXEC_STOP +SyslogIdentifier=$NAME +Restart=always +RestartSec=5s +WorkingDirectory=$DESTDIR +RuntimeDirectory=${NAME} + +[Install] +WantedBy=${DOCKER_SERVICE} diff --git a/system-container/system-container-wrapper.sh b/system-container/system-container-wrapper.sh new file mode 100755 index 0000000..0e1d2ee --- /dev/null +++ b/system-container/system-container-wrapper.sh @@ -0,0 +1,4 @@ +#!/bin/sh +source /run/$NAME-env + +exec /usr/bin/openshift start master $COMMAND --config=${CONFIG_FILE} $OPTIONS diff --git a/system-container/tmpfiles.template b/system-container/tmpfiles.template new file mode 100644 index 0000000..7e4c301 --- /dev/null +++ b/system-container/tmpfiles.template @@ -0,0 +1,2 @@ +d $ORIGIN_CONFIG_DIR - - - - - +d $ORIGIN_DATA_DIR - - - - - From 4edd7c9b5a592dcf38ce88515e395f4470caee73 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jakub=20=C4=8Cajka?= Date: Thu, 20 Sep 2018 09:38:40 +0200 Subject: [PATCH 2/2] Fix up the BZ component --- Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Dockerfile b/Dockerfile index 60839ed..d5134f2 100644 --- a/Dockerfile +++ b/Dockerfile @@ -29,7 +29,7 @@ LABEL io.k8s.display-name="OpenShift Origin Application Platform" \ maintainer="Jakub Cajka " \ License="GPLv2+" \ name="$FGC/$NAME" \ - com.redhat.component="$NAME" \ + com.redhat.component="origin" \ version="$VERSION" \ architecture="$ARCH" \ usage="Image used for deployment of openshift origin"