Skip to content

Commit 2ff8dcb

Browse files
rhmdndrhmdnd
authored
Merge pull request #12746 from rhmdnd/add-ocp-content-container-file-for-konflux
Add Containerfile for building OCP content in Konflux
2 parents d82db2b + e4ced68 commit 2ff8dcb

File tree

1 file changed

+95
-0
lines changed

1 file changed

+95
-0
lines changed

‎Dockerfiles/compliance-operator-content-konflux.Containerfile

+95
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,95 @@
1+
FROM registry.redhat.io/ubi9/ubi:latest AS builder
2+
3+
# The build tooling requires python, and the openscap-utils package to build
4+
# the content.
5+
RUN yum -y install python3 cmake make python3-pyyaml python3-jinja2 openscap-utils
6+
7+
WORKDIR /go/src/github.com/ComplianceAsCode/content
8+
COPY . .
9+
10+
11+
# Disable all profiles so we don't accidentally ship a profile we don't intend to ship
12+
RUN find . -name "*.profile" -exec sed -i 's/\(documentation_complete: \).*/\1false/' '{}' \;
13+
# Enable the default.profiles as they maintain a list rules to be added to the datastream
14+
RUN find . -name "default\.profile" -exec sed -i 's/\(documentation_complete: \).*/\1true/' '{}' \;
15+
16+
# Choose profile to enable for all architectures
17+
RUN sed -i 's/\(documentation_complete: \).*/\1true/' \
18+
products/ocp4/profiles/pci-dss-node-3-2.profile \
19+
products/ocp4/profiles/pci-dss-3-2.profile \
20+
products/ocp4/profiles/pci-dss-node-4-0.profile \
21+
products/ocp4/profiles/pci-dss-4-0.profile \
22+
products/ocp4/profiles/pci-dss-node.profile \
23+
products/ocp4/profiles/pci-dss.profile \
24+
products/ocp4/profiles/cis-node.profile \
25+
products/ocp4/profiles/cis.profile \
26+
products/ocp4/profiles/cis-node-1-4.profile \
27+
products/ocp4/profiles/cis-1-4.profile \
28+
products/ocp4/profiles/cis-node-1-5.profile \
29+
products/ocp4/profiles/cis-1-5.profile \
30+
products/ocp4/profiles/moderate-node.profile \
31+
products/ocp4/profiles/moderate.profile \
32+
products/ocp4/profiles/moderate-node-rev-4.profile \
33+
products/ocp4/profiles/moderate-rev-4.profile
34+
35+
# Only enable for x86_64
36+
RUN if [ "$(uname -m)" = "x86_64" ]; then \
37+
sed -i 's/\(documentation_complete: \).*/\1true/' products/ocp4/profiles/e8.profile && \
38+
sed -i 's/\(documentation_complete: \).*/\1true/' products/ocp4/profiles/high.profile && \
39+
sed -i 's/\(documentation_complete: \).*/\1true/' products/ocp4/profiles/high-node.profile && \
40+
sed -i 's/\(documentation_complete: \).*/\1true/' products/ocp4/profiles/high-rev-4.profile && \
41+
sed -i 's/\(documentation_complete: \).*/\1true/' products/ocp4/profiles/high-node-rev-4.profile && \
42+
sed -i 's/\(documentation_complete: \).*/\1true/' products/ocp4/profiles/nerc-cip.profile && \
43+
sed -i 's/\(documentation_complete: \).*/\1true/' products/ocp4/profiles/nerc-cip-node.profile && \
44+
sed -i 's/\(documentation_complete: \).*/\1true/' products/rhcos4/profiles/moderate.profile && \
45+
sed -i 's/\(documentation_complete: \).*/\1true/' products/rhcos4/profiles/high.profile && \
46+
sed -i 's/\(documentation_complete: \).*/\1true/' products/rhcos4/profiles/moderate-rev-4.profile && \
47+
sed -i 's/\(documentation_complete: \).*/\1true/' products/rhcos4/profiles/high-rev-4.profile && \
48+
sed -i 's/\(documentation_complete: \).*/\1true/' products/rhcos4/profiles/e8.profile && \
49+
sed -i 's/\(documentation_complete: \).*/\1true/' products/rhcos4/profiles/nerc-cip.profile && \
50+
sed -i 's/\(documentation_complete: \).*/\1true/' products/ocp4/profiles/pci-dss-node.profile && \
51+
sed -i 's/\(documentation_complete: \).*/\1true/' products/ocp4/profiles/pci-dss.profile && \
52+
sed -i 's/\(documentation_complete: \).*/\1true/' products/ocp4/profiles/pci-dss-node-3-2.profile && \
53+
sed -i 's/\(documentation_complete: \).*/\1true/' products/ocp4/profiles/pci-dss-3-2.profile && \
54+
sed -i 's/\(documentation_complete: \).*/\1true/' products/ocp4/profiles/stig.profile && \
55+
sed -i 's/\(documentation_complete: \).*/\1true/' products/ocp4/profiles/stig-node.profile && \
56+
sed -i 's/\(documentation_complete: \).*/\1true/' products/rhcos4/profiles/stig.profile && \
57+
sed -i 's/\(documentation_complete: \).*/\1true/' products/ocp4/profiles/stig-v1r1.profile && \
58+
sed -i 's/\(documentation_complete: \).*/\1true/' products/ocp4/profiles/stig-node-v1r1.profile && \
59+
sed -i 's/\(documentation_complete: \).*/\1true/' products/rhcos4/profiles/stig-v1r1.profile && \
60+
sed -i 's/\(documentation_complete: \).*/\1true/' products/ocp4/profiles/stig-v2r1.profile && \
61+
sed -i 's/\(documentation_complete: \).*/\1true/' products/ocp4/profiles/stig-node-v2r1.profile && \
62+
sed -i 's/\(documentation_complete: \).*/\1true/' products/rhcos4/profiles/stig-v2r1.profile; \
63+
fi
64+
65+
# OCPBUGS-32794: Ensure stability of rules shipped
66+
# Before building the content we re-enable all profiles as hidden, this will include any rule selected
67+
# by these profiles in the data stream without creating a profile for them.
68+
RUN grep -lr 'documentation_complete: false' ./products | xargs -I '{}' \
69+
sed -i -e 's/\(documentation_complete: \).*/\1true/' -e '/documentation_complete/a hidden: true' {}
70+
71+
# Build the OpenShift and RHCOS content for x86 architectures. Only build
72+
# OpenShift content for ppc64le and s390x architectures.
73+
RUN if [ "$(uname -m)" = "x86_64" ]; then \
74+
./build_product ocp4 rhcos4 --datastream-only; \
75+
else ./build_product ocp4 --datastream-only; \
76+
fi
77+
78+
FROM registry.redhat.io/ubi9/ubi-micro:latest
79+
80+
LABEL \
81+
io.k8s.display-name="Compliance Content" \
82+
io.k8s.description="OpenSCAP content for the compliance-operator." \
83+
io.openshift.tags="openshift,compliance,security" \
84+
com.redhat.delivery.appregistry="false" \
85+
maintainer="Red Hat ISC <[email protected]>" \
86+
License="GPLv2+" \
87+
name="openshift-compliance-content" \
88+
com.redhat.component="openshift-compliance-content-container" \
89+
io.openshift.maintainer.product="OpenShift Container Platform" \
90+
io.openshift.maintainer.component="Compliance Operator"
91+
# Implement this using Konflux dynamic labels
92+
# version=1.6.1-dev
93+
94+
WORKDIR /
95+
COPY --from=builder /go/src/github.com/ComplianceAsCode/content/build/ssg-*-ds.xml .

0 commit comments

Comments
 (0)