Skip to content

Commit cec1573

Browse files
ddsharpeddsharpe
authored
Revert domain file permissions to umask 027 with explicit OpenShift override (#317)
* revert chmod settings that override WLS domain default umask 027 unless requested by the user * if not specified, set OS group default to root * add integration test for OpenShift target setting
1 parent d89e1ca commit cec1573

File tree

8 files changed

+116
-19
lines changed

8 files changed

+116
-19
lines changed

‎imagetool/src/main/java/com/oracle/weblogic/imagetool/cli/menu/CommonOptions.java

Lines changed: 20 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -54,6 +54,10 @@ public abstract class CommonOptions {
5454
abstract String getInstallerVersion();
5555

5656
private void handleChown() {
57+
if (osUserAndGroup == null) {
58+
return;
59+
}
60+
5761
if (osUserAndGroup.length != 2) {
5862
throw new IllegalArgumentException(Utils.getMessage("IMG-0027"));
5963
}
@@ -180,6 +184,14 @@ void init(String buildId) throws InvalidCredentialException, IOException {
180184
handleChown();
181185
handleAdditionalBuildCommands();
182186

187+
if (kubernetesTarget == KubernetesTarget.OpenShift) {
188+
dockerfileOptions.setDomainGroupAsUser(true);
189+
// if the user did not set the OS user:group, make the default oracle:root, instead of oracle:oracle
190+
if (osUserAndGroup == null) {
191+
dockerfileOptions.setGroupId("root");
192+
}
193+
}
194+
183195
logger.exiting();
184196
}
185197

@@ -497,8 +509,7 @@ String getPassword() {
497509
@Option(
498510
names = {"--chown"},
499511
split = ":",
500-
description = "userid:groupid for JDK/Middleware installs and patches. Default: ${DEFAULT-VALUE}.",
501-
defaultValue = "oracle:oracle"
512+
description = "userid:groupid for JDK/Middleware installs and patches. Default: oracle:oracle."
502513
)
503514
private String[] osUserAndGroup;
504515

@@ -583,6 +594,13 @@ String getPassword() {
583594
)
584595
String buildEngine = "docker";
585596

597+
@Option(
598+
names = {"--target"},
599+
description = "Apply settings appropriate to the target environment. Default: ${DEFAULT-VALUE}"
600+
+ " Supported values: ${COMPLETION-CANDIDATES}"
601+
)
602+
KubernetesTarget kubernetesTarget = KubernetesTarget.Default;
603+
586604
@SuppressWarnings("unused")
587605
@Unmatched
588606

‎imagetool/src/main/java/com/oracle/weblogic/imagetool/cli/menu/KubernetesTarget.java

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
// Copyright (c) 2021, Oracle and/or its affiliates.
2+
// Licensed under the Universal Permissive License v 1.0 as shown at https://oss.oracle.com/licenses/upl.
3+
4+
package com.oracle.weblogic.imagetool.cli.menu;
5+
6+
public enum KubernetesTarget {
7+
Default,
8+
OpenShift
9+
}

‎imagetool/src/main/java/com/oracle/weblogic/imagetool/util/DockerfileOptions.java

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -59,6 +59,7 @@ public class DockerfileOptions {
5959
private PackageManagerType pkgMgr;
6060
private List<String> patchFilenames;
6161
private MiddlewareInstall mwInstallers;
62+
private boolean domainGroupAsUser;
6263

6364
// WDT values
6465
private String wdtHome;
@@ -88,12 +89,15 @@ public DockerfileOptions(String buildId) {
8889
updateOpatch = false;
8990
skipJavaInstall = false;
9091
skipMiddlewareInstall = false;
92+
domainGroupAsUser = false;
9193

9294
javaHome = DEFAULT_JAVA_HOME;
9395
oracleHome = DEFAULT_ORACLE_HOME;
9496
invLoc = DEFAULT_INV_LOC;
9597
oraInvDir = DEFAULT_ORAINV_DIR;
9698

99+
username = "oracle";
100+
groupname = "oracle";
97101
tempDirectory = "/tmp/imagetool";
98102

99103
baseImageName = "ghcr.io/oracle/oraclelinux:7-slim";
@@ -1016,4 +1020,14 @@ public DockerfileOptions setWdtBase(String value) {
10161020
wdtBase = value;
10171021
return this;
10181022
}
1023+
1024+
public DockerfileOptions setDomainGroupAsUser(boolean value) {
1025+
domainGroupAsUser = value;
1026+
return this;
1027+
}
1028+
1029+
@SuppressWarnings("unused")
1030+
public boolean domainGroupAsUser() {
1031+
return domainGroupAsUser;
1032+
}
10191033
}

‎imagetool/src/main/resources/docker-files/Rebase_Image.mustache

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -72,7 +72,9 @@ RUN mkdir -p {{domain_home}}
7272
{{/isWdtModelHomeOutsideWdtHome}}
7373
{{/modelOnly}}
7474

75-
RUN chmod g+w {{{domain_home}}}
75+
{{#domainGroupAsUser}}
76+
RUN chmod g=u {{{domain_home}}}
77+
{{/domainGroupAsUser}}
7678

7779
WORKDIR {{{work_dir}}}
7880

‎imagetool/src/main/resources/docker-files/final-wdt-copy.mustache

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -10,9 +10,13 @@
1010
{{#isWdtModelHomeOutsideWdtHome}}
1111
COPY --from=wdt_build --chown={{userid}}:{{groupid}} {{wdt_model_home}} {{wdt_model_home}}/
1212
{{/isWdtModelHomeOutsideWdtHome}}
13-
RUN chmod g+w {{{domain_parent}}} {{{wdt_home}}} {{{wdt_model_home}}}
13+
{{#domainGroupAsUser}}
14+
RUN chmod g=u {{{domain_parent}}} {{{wdt_home}}} {{{wdt_model_home}}}
15+
{{/domainGroupAsUser}}
1416
{{/modelOnly}}
1517
{{^modelOnly}}
1618
COPY --from=wdt_build --chown={{userid}}:{{groupid}} {{{domain_home}}} {{{domain_home}}}/
17-
RUN chmod g+w {{{domain_home}}}
19+
{{#domainGroupAsUser}}
20+
RUN chmod g=u {{{domain_home}}}
21+
{{/domainGroupAsUser}}
1822
{{/modelOnly}}

‎imagetool/src/main/resources/docker-files/run-wdt.mustache

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -56,13 +56,17 @@ RUN test -d {{{wdt_home}}}/weblogic-deploy && rm -rf {{{wdt_home}}}/weblogic-dep
5656
{{#runRcu}}
5757
-run_rcu \
5858
{{/runRcu}}
59-
{{{wdtVariableFileArgument}}} {{{wdtModelFileArgument}}} {{{wdtArchiveFileArgument}}} \
60-
&& chmod -R g+w {{{domain_home}}}
59+
{{{wdtVariableFileArgument}}} {{{wdtModelFileArgument}}} {{{wdtArchiveFileArgument}}}
60+
{{#domainGroupAsUser}}
61+
RUN chmod -R g=u {{{domain_home}}}
62+
{{/domainGroupAsUser}}
6163
{{/modelOnly}}
6264
{{#isWdtValidateEnabled}}
6365
RUN cd {{{wdt_home}}}/weblogic-deploy/bin \
6466
&& rm ./*.cmd \
65-
&& chmod -R g+w {{{wdt_home}}}/weblogic-deploy/lib \
67+
{{#domainGroupAsUser}}
68+
&& chmod -R g=u {{{wdt_home}}}/weblogic-deploy/lib \
69+
{{/domainGroupAsUser}}
6670
&& ./validateModel.sh {{^strictValidation}}-method lax{{/strictValidation}} \
6771
-oracle_home {{{oracle_home}}} \
6872
-domain_type {{domainType}} \

‎tests/src/test/java/com/oracle/weblogic/imagetool/tests/ITImagetool.java

Lines changed: 48 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,7 @@
1616
import java.util.ArrayList;
1717
import java.util.List;
1818

19+
import com.oracle.weblogic.imagetool.cli.menu.KubernetesTarget;
1920
import com.oracle.weblogic.imagetool.logging.LoggingFacade;
2021
import com.oracle.weblogic.imagetool.logging.LoggingFactory;
2122
import com.oracle.weblogic.imagetool.tests.annotations.IntegrationTest;
@@ -970,13 +971,13 @@ void createMiiOl8slim(TestInfo testInfo) throws Exception {
970971
// verify the docker image is created
971972
assertTrue(imageExists(tagName), "Image was not created: " + tagName);
972973

973-
validateFilePermissions("/u01/domains", "drwxrwxr-x", tagName, out);
974-
validateFilePermissions("/u01/wdt", "drwxrwxr-x", tagName, out);
975-
validateFilePermissions("/u01/wdt/models", "drwxrwxr-x", tagName, out);
976-
validateFilePermissions("/u01/wdt/weblogic-deploy", "drwxr-x---", tagName, out);
977-
validateFilePermissions("/u01/oracle", "drwxr-xr-x", tagName, out);
978-
validateFilePermissions("/u01/wdt/weblogic-deploy/bin/createDomain.sh", "-rwxr-x---", tagName, out);
979-
validateFilePermissions("/u01/wdt/weblogic-deploy/bin/validateModel.sh", "-rwxr-x---", tagName, out);
974+
verifyFilePermissions("/u01/domains", "drwxr-xr-x", tagName, out);
975+
verifyFilePermissions("/u01/wdt", "drwxr-xr-x", tagName, out);
976+
verifyFilePermissions("/u01/wdt/models", "drwxr-xr-x", tagName, out);
977+
verifyFilePermissions("/u01/wdt/weblogic-deploy", "drwxr-x---", tagName, out);
978+
verifyFilePermissions("/u01/oracle", "drwxr-xr-x", tagName, out);
979+
verifyFilePermissions("/u01/wdt/weblogic-deploy/bin/createDomain.sh", "-rwxr-x---", tagName, out);
980+
verifyFilePermissions("/u01/wdt/weblogic-deploy/bin/validateModel.sh", "-rwxr-x---", tagName, out);
980981
}
981982
}
982983

@@ -989,7 +990,7 @@ void createMiiOl8slim(TestInfo testInfo) throws Exception {
989990
* @throws IOException if process start fails
990991
* @throws InterruptedException if the wait is interrupted before the process completes
991992
*/
992-
private void validateFilePermissions(String path, String expected, String tagName, PrintWriter out)
993+
private void verifyFilePermissions(String path, String expected, String tagName, PrintWriter out)
993994
throws IOException, InterruptedException {
994995
String command = String.format(" docker run --rm -t %s ls -ld %s", tagName, path);
995996
String actual = Runner.run(command, out, logger).stdout().trim();
@@ -1028,8 +1029,8 @@ void updateAddModel(TestInfo testInfo) throws Exception {
10281029

10291030
// verify the docker image is created
10301031
assertTrue(imageExists(tagName), "Image was not created: " + tagName);
1031-
validateFilePermissions("/u01/wdt/weblogic-deploy/bin/createDomain.sh", "-rwxr-x---", tagName, out);
1032-
validateFilePermissions("/u01/wdt/weblogic-deploy/bin/validateModel.sh", "-rwxr-x---", tagName, out);
1032+
verifyFilePermissions("/u01/wdt/weblogic-deploy/bin/createDomain.sh", "-rwxr-x---", tagName, out);
1033+
verifyFilePermissions("/u01/wdt/weblogic-deploy/bin/validateModel.sh", "-rwxr-x---", tagName, out);
10331034
}
10341035
}
10351036

@@ -1064,4 +1065,41 @@ void updateAddSecondModel(TestInfo testInfo) throws Exception {
10641065
assertTrue(imageExists(tagName), "Image was not created: " + tagName);
10651066
}
10661067
}
1068+
1069+
/**
1070+
* create WLS image with OpenShift settings.
1071+
*
1072+
* @throws Exception - if any error occurs
1073+
*/
1074+
@Test
1075+
@Order(30)
1076+
@Tag("nightly")
1077+
@DisplayName("Create image with OpenShift settings")
1078+
void createWlsImgWithOpenShiftSettings(TestInfo testInfo) throws Exception {
1079+
String tagName = build_tag + ":" + getMethodName(testInfo);
1080+
String command = new CreateCommand()
1081+
.jdkVersion(JDK_VERSION)
1082+
.tag(tagName)
1083+
.wdtVersion(WDT_VERSION)
1084+
.wdtArchive(WDT_ARCHIVE)
1085+
.wdtDomainHome("/u01/domains/simple_domain")
1086+
.wdtModel(WDT_MODEL, WDT_MODEL2)
1087+
.wdtVariables(WDT_VARIABLES)
1088+
.target(KubernetesTarget.OpenShift)
1089+
.build();
1090+
1091+
try (PrintWriter out = getTestMethodWriter(testInfo)) {
1092+
CommandResult result = Runner.run(command, out, logger);
1093+
assertEquals(0, result.exitValue(), "for command: " + command);
1094+
1095+
// verify the docker image is created
1096+
assertTrue(imageExists(tagName), "Image was not created: " + tagName);
1097+
1098+
// verify the file permissions on the domain directory were set correctly
1099+
verifyFilePermissions("/u01/domains/simple_domain", "drwxrwxr-x", tagName, out);
1100+
}
1101+
1102+
}
1103+
1104+
10671105
}

‎tests/src/test/java/com/oracle/weblogic/imagetool/tests/utils/CreateCommand.java

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,8 @@
77
import java.util.Arrays;
88
import java.util.stream.Collectors;
99

10+
import com.oracle.weblogic.imagetool.cli.menu.KubernetesTarget;
11+
1012
public class CreateCommand extends ImageToolCommand {
1113
private String version;
1214
private String type;
@@ -20,6 +22,7 @@ public class CreateCommand extends ImageToolCommand {
2022
private String passwordEnv;
2123
private String patches;
2224
private String additionalBuildCommands;
25+
private String kubernetesTarget;
2326

2427
// WDT flags
2528
private String wdtVersion;
@@ -89,12 +92,16 @@ public CreateCommand patches(String... values) {
8992
return this;
9093
}
9194

92-
9395
public CreateCommand additionalBuildCommands(Path value) {
9496
additionalBuildCommands = value.toString();
9597
return this;
9698
}
9799

100+
public CreateCommand target(KubernetesTarget value) {
101+
kubernetesTarget = value.toString();
102+
return this;
103+
}
104+
98105
public CreateCommand wdtVersion(String value) {
99106
wdtVersion = value;
100107
return this;
@@ -152,6 +159,7 @@ public String build() {
152159
+ field("--passwordEnv", passwordEnv)
153160
+ field("--patches", patches)
154161
+ field("--additionalBuildCommands", additionalBuildCommands)
162+
+ field("--target", kubernetesTarget)
155163
+ field("--wdtVersion", wdtVersion)
156164
+ field("--wdtModel", wdtModel)
157165
+ field("--wdtArchive", wdtArchive)

0 commit comments

Comments
 (0)