Skip to content

Commit 561d6d5

Browse files
danpawlikdanpawlik
authored
Merge pull request #181 from danpawlik/port-improvements-v1
Port various fixes from master branch. Done changes: 4c50d4b Enable TLS certificate verification for Elasticsearch client - OSPRH-33323 284b6cb Improve container user creation - OSPRH-33322 ca0f83b Run containers as non-root user; add pod security context - OSPRH-33322 d3b621c Bump dependencies to resolve known bugs - OSPRH-33321 fcbaa1d Pin GitHub Actions to immutable commit SHAs - OSPRH-33320 a54307c Use HTTPS and enable GPG verification for opstools repo - OSPRH-33317
2 parents e048240 + 4c50d4b commit 561d6d5

11 files changed

Lines changed: 80 additions & 35 deletions

File tree

‎.github/workflows/integration.yml‎

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,6 @@
11
name: Integration testing
2+
permissions:
3+
contents: read
24
env:
35
PROJECT_ROOT: /root/go/src/github.com/infrawatch/sg-core
46
OPSTOOLS_REPO: https://raw.githubusercontent.com/infrawatch/sg-core/0d28a1c2f87bd64f2d67effcda926855af057a82/build/repos/opstools.repo
@@ -25,7 +27,7 @@ jobs:
2527
PROMETHEUS_IMAGE: quay.io/prometheus/prometheus:latest
2628
steps:
2729
- name: Checkout code
28-
uses: actions/checkout@v4.1.3
30+
uses: actions/checkout@1d96c772d19495a3b5c517cd2bc0cb401ea0529f # v4.1.3
2931

3032
- name: Remove currently installed mysql and postgresql
3133
run: |
@@ -119,7 +121,7 @@ jobs:
119121
PROMETHEUS_IMAGE: quay.io/prometheus/prometheus:latest
120122
steps:
121123
- name: Checkout code
122-
uses: actions/checkout@v4.1.3
124+
uses: actions/checkout@1d96c772d19495a3b5c517cd2bc0cb401ea0529f # v4.1.3
123125

124126
- name: Remove currently installed mysql and postgresql
125127
run: |
@@ -224,7 +226,7 @@ jobs:
224226
PROMETHEUS_IMAGE: quay.io/prometheus/prometheus:latest
225227
steps:
226228
- name: Checkout code
227-
uses: actions/checkout@v4.1.3
229+
uses: actions/checkout@1d96c772d19495a3b5c517cd2bc0cb401ea0529f # v4.1.3
228230

229231
- name: Remove currently installed mysql and postgresql
230232
run: |
@@ -308,7 +310,7 @@ jobs:
308310
RSYSLOG_VOLUME: "--volume ${{ github.workspace }}/ci/service_configs/rsyslog/rsyslog_config.conf:/etc/rsyslog.d/integration.conf:z"
309311
steps:
310312
- name: Checkout code
311-
uses: actions/checkout@v4.1.3
313+
uses: actions/checkout@1d96c772d19495a3b5c517cd2bc0cb401ea0529f # v4.1.3
312314
# start data store services
313315
- name: Start Elasticsearch service
314316
run: |

‎.github/workflows/tests.yml‎

Lines changed: 9 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,6 @@
11
name: CI
2+
permissions:
3+
contents: read
24
env:
35
PROJECT_ROOT: /root/go/src/github.com/infrawatch/sg-core
46
OPSTOOLS_REPO: https://raw.githubusercontent.com/infrawatch/sg-core/0d28a1c2f87bd64f2d67effcda926855af057a82/build/repos/opstools.repo
@@ -20,14 +22,14 @@ jobs:
2022
name: Linting
2123
runs-on: ubuntu-latest
2224
steps:
23-
- uses: actions/setup-go@v5
25+
- uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
2426
with:
2527
go-version: '1.25.9'
26-
- uses: actions/checkout@v4.1.3
28+
- uses: actions/checkout@1d96c772d19495a3b5c517cd2bc0cb401ea0529f # v4.1.3
2729
#- name: download libraries
2830
# run: go mod download
2931
- name: golangci-lint
30-
uses: golangci/golangci-lint-action@v6.1.0
32+
uses: golangci/golangci-lint-action@aaa42aa0628b4ae2578232a66b541047968fac86 # v6.1.0
3133
with:
3234
# Caching conflicts happen in GHA, so just disable for now
3335
skip-cache: true
@@ -38,7 +40,7 @@ jobs:
3840
runs-on: ubuntu-latest
3941
steps:
4042
- name: Checkout code
41-
uses: actions/checkout@v4.1.3
43+
uses: actions/checkout@1d96c772d19495a3b5c517cd2bc0cb401ea0529f # v4.1.3
4244
# start services
4345
- name: Start Elasticsearch service
4446
run: |
@@ -67,15 +69,15 @@ jobs:
6769
--volume ${{ github.workspace }}:$PROJECT_ROOT:z --workdir $PROJECT_ROOT \
6870
$TEST_IMAGE bash $PROJECT_ROOT/ci/unit/run_tests.sh
6971
- name: Send coverage
70-
uses: shogo82148/actions-goveralls@v1.8.0
72+
uses: shogo82148/actions-goveralls@7b1bd2871942af030d707d6574e5f684f9891fb2 # v1.8.0
7173
with:
7274
path-to-profile: ${{ github.workspace }}/profile.cov
7375
image-build:
7476
name: Image build
7577
runs-on: ubuntu-latest
7678
steps:
77-
- uses: actions/checkout@v4.1.3
78-
- uses: actions/setup-go@v5
79+
- uses: actions/checkout@1d96c772d19495a3b5c517cd2bc0cb401ea0529f # v4.1.3
80+
- uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
7981
with:
8082
go-version: '1.25.9'
8183
- name: Verify image builds

‎.github/workflows/updates.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,7 @@ jobs:
2222
issues: write
2323
steps:
2424
- name: update PR with coveralls badge
25-
uses: actions/github-script@v7.0.1
25+
uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
2626
continue-on-error: true
2727
with:
2828
github-token: ${{ secrets.GITHUB_TOKEN }}

‎build/Dockerfile‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,8 @@ COPY . $D/
99
# dependencies for qpid-proton-c
1010
COPY build/repos/opstools.repo /etc/yum.repos.d/CentOS-OpsTools.repo
1111

12-
RUN dnf install golang git qpid-proton-c-devel -y --setopt=tsflags=nodocs
12+
RUN rpm --import https://www.centos.org/keys/RPM-GPG-KEY-CentOS-SIG-OpsTools && \
13+
dnf install golang git qpid-proton-c-devel -y --setopt=tsflags=nodocs
1314
RUN go install golang.org/dl/go1.25.9@latest && /go/bin/go1.25.9 download && PRODUCTION_BUILD=false CONTAINER_BUILD=true GOCMD=/go/bin/go1.25.9 ./build.sh
1415

1516
# --- end build, create smart gateway layer ---
@@ -22,4 +23,7 @@ LABEL io.k8s.display-name="Smart Gateway" \
2223
COPY --from=builder /tmp/sg-core /
2324
COPY --from=builder /tmp/plugins/*.so /usr/lib64/sg-core/
2425

26+
RUN useradd -ms /sbin/nologin sg
27+
USER sg
28+
2529
ENTRYPOINT ["/sg-core"]

‎build/repos/opstools.repo‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,8 @@
22

33
[centos9-opstools]
44
name=centos9-opstools
5-
baseurl=http://mirror.stream.centos.org/SIGs/9-stream/opstools/$basearch/collectd-5/
5+
baseurl=https://mirror.stream.centos.org/SIGs/9-stream/opstools/$basearch/collectd-5/
66
enabled=1
7-
gpgcheck=0
7+
gpgcheck=1
8+
gpgkey=https://www.centos.org/keys/RPM-GPG-KEY-CentOS-SIG-OpsTools
89
module_hotfixes=1

‎deploy/sg-core-pod-security.yaml‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
# Reference-only securityContext for sg-core container deployments.
2+
# This file is not consumed by any automation. The smart-gateway-operator
3+
# already applies these settings during reconciliation.
4+
# Use this as a guide when deploying sg-core outside the operator
5+
# (vanilla Kubernetes, manual podman, etc.).
6+
apiVersion: v1
7+
kind: Pod
8+
metadata:
9+
name: sg-core
10+
labels:
11+
app: sg-core
12+
spec:
13+
securityContext:
14+
runAsNonRoot: true
15+
runAsUser: 1001
16+
seccompProfile:
17+
type: RuntimeDefault
18+
containers:
19+
- name: sg-core
20+
image: quay.io/infrawatch/sg-core:latest
21+
args: ["-config", "/etc/sg-core/sg-core.conf.yaml"]
22+
securityContext:
23+
allowPrivilegeEscalation: false
24+
readOnlyRootFilesystem: true
25+
capabilities:
26+
drop:
27+
- ALL
28+
volumeMounts:
29+
- name: socket-dir
30+
mountPath: /tmp
31+
- name: sg-core-config
32+
mountPath: /etc/sg-core
33+
readOnly: true
34+
volumes:
35+
- name: socket-dir
36+
emptyDir: {}
37+
- name: sg-core-config
38+
configMap:
39+
name: sg-core-config

‎generator/Dockerfile‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ COPY . $D/
77
RUN dnf install -y gcc make qpid-proton-c-devel
88
RUN make && mv gen /gen
99

10+
RUN useradd -ms /sbin/nologin sg
11+
USER sg
1012

1113
ENTRYPOINT ["/gen"]
12-
13-

‎go.mod‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,7 @@ require (
1212
github.com/json-iterator/go v1.1.12
1313
github.com/pkg/errors v0.9.1
1414
github.com/prometheus/client_golang v1.11.1
15+
github.com/prometheus/client_model v0.2.0
1516
github.com/stretchr/testify v1.6.1
1617
github.com/vmihailenco/msgpack/v5 v5.3.5
1718
gopkg.in/errgo.v2 v2.1.0
@@ -28,18 +29,17 @@ require (
2829
github.com/go-ini/ini v1.62.0 // indirect
2930
github.com/go-playground/locales v0.13.0 // indirect
3031
github.com/go-playground/universal-translator v0.17.0 // indirect
31-
github.com/golang/protobuf v1.5.2 // indirect
32+
github.com/golang/protobuf v1.5.4 // indirect
3233
github.com/leodido/go-urn v1.2.1 // indirect
3334
github.com/matttproud/golang_protobuf_extensions v1.0.1 // indirect
3435
github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
3536
github.com/modern-go/reflect2 v1.0.2 // indirect
3637
github.com/pmezard/go-difflib v1.0.0 // indirect
37-
github.com/prometheus/client_model v0.2.0
3838
github.com/prometheus/common v0.29.0 // indirect
3939
github.com/prometheus/procfs v0.6.0 // indirect
4040
github.com/smartystreets/goconvey v1.7.2 // indirect
4141
github.com/vmihailenco/tagparser/v2 v2.0.0 // indirect
42-
golang.org/x/sys v0.1.0 // indirect
42+
golang.org/x/sys v0.47.0 // indirect
4343
google.golang.org/protobuf v1.33.0 // indirect
4444
gopkg.in/ini.v1 v1.63.2 // indirect
4545
)

‎go.sum‎

Lines changed: 4 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -133,9 +133,8 @@ github.com/golang/protobuf v1.4.0/go.mod h1:jodUvKwWbYaEsadDk5Fwe5c77LiNKVO9IDvq
133133
github.com/golang/protobuf v1.4.1/go.mod h1:U8fpvMrcmy5pZrNK1lt4xCsGvpyWQ/VVv6QDs8UjoX8=
134134
github.com/golang/protobuf v1.4.2/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw735rRwI=
135135
github.com/golang/protobuf v1.4.3/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw735rRwI=
136-
github.com/golang/protobuf v1.5.0/go.mod h1:FsONVRAS9T7sI+LIUmWTfcYkHO4aIWwzhcaSAoJOfIk=
137-
github.com/golang/protobuf v1.5.2 h1:ROPKBNFfQgOUMifHyP+KYbvpjbdoFNs+aK7DXlji0Tw=
138-
github.com/golang/protobuf v1.5.2/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY=
136+
github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek=
137+
github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps=
139138
github.com/google/btree v0.0.0-20180813153112-4030bb1f1f0c/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ=
140139
github.com/google/btree v1.0.0/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ=
141140
github.com/google/go-cmp v0.2.0/go.mod h1:oXzfMopK8JAjlY9xF4vHSVASa0yLyX7SntLO5aqRK0M=
@@ -378,8 +377,8 @@ golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7w
378377
golang.org/x/sys v0.0.0-20210124154548-22da62e12c0c/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
379378
golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
380379
golang.org/x/sys v0.0.0-20210603081109-ebe580a85c40/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
381-
golang.org/x/sys v0.1.0 h1:kunALQeHf1/185U1i0GOB/fy1IPRDDpuoOOqRReG57U=
382-
golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
380+
golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
381+
golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
383382
golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
384383
golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
385384
golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
@@ -510,7 +509,6 @@ google.golang.org/protobuf v1.23.1-0.20200526195155-81db48ad09cc/go.mod h1:EGpAD
510509
google.golang.org/protobuf v1.24.0/go.mod h1:r/3tXBNzIEhYS9I1OUVjXDlt8tc493IdKGjtUeSXeh4=
511510
google.golang.org/protobuf v1.25.0/go.mod h1:9JNX74DMeImyA3h4bdi1ymwjUzf21/xIlbajtzgsN7c=
512511
google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
513-
google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
514512
google.golang.org/protobuf v1.33.0 h1:uNO2rsAINq/JlFpSdYEKIZ0uKD/R9cpdv0T+yoGwGmI=
515513
google.golang.org/protobuf v1.33.0/go.mod h1:c6P6GXX6sHbq/GpV6MGZEdwhWPcYBgnhAHhKbcUYpos=
516514
gopkg.in/alecthomas/kingpin.v2 v2.2.6/go.mod h1:FMv+mEhP44yOT+4EoQTLFTRgOQ1FBLkstjWtayDeSgw=

‎plugins/application/elasticsearch/pkg/lib/client.go‎

Lines changed: 1 addition & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -44,14 +44,10 @@ func createTLSConfig(serverName string, certFile string, keyFile string, caFile
4444

4545
tlsConfig := &tls.Config{
4646
MinVersion: tls.VersionTLS13,
47+
ServerName: serverName,
4748
Certificates: []tls.Certificate{cert},
4849
RootCAs: certPool,
4950
}
50-
if len(serverName) == 0 {
51-
tlsConfig.InsecureSkipVerify = true
52-
} else {
53-
tlsConfig.ServerName = serverName
54-
}
5551

5652
return tlsConfig, nil
5753
}

0 commit comments

Comments
 (0)