Commit 2705abd4 authored by Fabio Luchetti's avatar Fabio Luchetti
Browse files

add eos-nobody user and use the rpm provided forwardable keytab

parent 5e052130
Pipeline #2628103 skipped with stage
...@@ -31,7 +31,7 @@ COPY eos-docker/xrootd-fwd-proxy.cfg /etc/xrootd/ ...@@ -31,7 +31,7 @@ COPY eos-docker/xrootd-fwd-proxy.cfg /etc/xrootd/
RUN sed -i "s/__EOS_CODENAME__/${EOS_CODENAME}/g" /etc/yum.repos.d/eos.repo RUN sed -i "s/__EOS_CODENAME__/${EOS_CODENAME}/g" /etc/yum.repos.d/eos.repo
RUN mkdir /var/tmp/eosxd-cache/ /var/tmp/eosxd-journal/ RUN mkdir /var/tmp/eosxd-cache/ /var/tmp/eosxd-journal/
RUN adduser eos-user RUN adduser eos-user && adduser eosnobody
# Docker will aggressively cache the following command, but this is fine, since # Docker will aggressively cache the following command, but this is fine, since
# these packages are not updated often. # these packages are not updated often.
...@@ -79,14 +79,11 @@ RUN if [ "${EOS_CODENAME}" != "diopside" ]; then yum -y --nogpg install quarkdb; ...@@ -79,14 +79,11 @@ RUN if [ "${EOS_CODENAME}" != "diopside" ]; then yum -y --nogpg install quarkdb;
# fails. This happens on CC7 and C8. # fails. This happens on CC7 and C8.
RUN yum install -y --nogpg install xrootd-client RUN yum install -y --nogpg install xrootd-client
# Generate a new forwardable keytab 'eos-test+' to replace the not-forwardable # Swap and use the forwardable keytab (installed by the eos-testkeytab package).
# one (installed by the eos-testkeytab package). # This is useful for clients who reside on a private network and tunnel through a
# This is useful to deploy EOS on Kubernetes clusters running on CERN's Cloud # Network Address Translation (NAT) device. You can remove these lines if you don't need them.
# Infrastructure; you can remove these lines if you don't need one. RUN mv -f /etc/eos.keytab.fw /etc/eos.keytab
RUN yes | xrdsssadmin -k eos-test del /etc/eos.keytab \
&& yes | xrdsssadmin -u daemon -g daemon -k eos-test+ -n 1234567890123456789 add /etc/eos.keytab \
&& chown daemon:daemon /etc/eos.keytab \
&& chmod 400 /etc/eos.keytab
# Change owner of /var/spool/xrootd directory to daemon # Change owner of /var/spool/xrootd directory to daemon
RUN chown daemon:daemon /var/spool/xrootd RUN chown daemon:daemon /var/spool/xrootd
......
...@@ -26,7 +26,7 @@ COPY xrootd-fwd-proxy.cfg /etc/xrootd/ ...@@ -26,7 +26,7 @@ COPY xrootd-fwd-proxy.cfg /etc/xrootd/
RUN mkdir /var/tmp/eosxd-cache/ /var/tmp/eosxd-journal/ RUN mkdir /var/tmp/eosxd-cache/ /var/tmp/eosxd-journal/
RUN adduser eos-user RUN adduser eos-user && adduser eosnobody
# Install XRootD # Install XRootD
ENV XRD_VERSION 4.12.7 ENV XRD_VERSION 4.12.7
...@@ -43,14 +43,10 @@ RUN yum -y --nogpg update \ ...@@ -43,14 +43,10 @@ RUN yum -y --nogpg update \
xrootd-server-libs-$XRD_VERSION \ xrootd-server-libs-$XRD_VERSION \
&& yum clean all && yum clean all
# Generate a new forwardable keytab 'eos-test+' to replace the not-forwardable # Swap and use the forwardable keytab (installed by the eos-testkeytab package).
# one (installed by the eos-testkeytab package). # This is useful for clients who reside on a private network and tunnel through a
# This is useful to deploy EOS on Kubernetes clusters running on CERN's Cloud # Network Address Translation (NAT) device. You can remove these lines if you don't need them.
# Infrastructure; you can remove these lines if you don't need one. RUN mv -f /etc/eos.keytab.fw /etc/eos.keytab
RUN yes | xrdsssadmin -k eos-test del /etc/eos.keytab \
&& yes | xrdsssadmin -u daemon -g daemon -k eos-test+ -n 1234567890123456789 add /etc/eos.keytab \
&& chown daemon:daemon /etc/eos.keytab \
&& chmod 400 /etc/eos.keytab
# Change owner of /var/spool/xrootd directory to daemon # Change owner of /var/spool/xrootd directory to daemon
RUN chown daemon:daemon /var/spool/xrootd RUN chown daemon:daemon /var/spool/xrootd
......
...@@ -32,7 +32,7 @@ RUN sed -i "s/__EOS_CODENAME__/${EOS_CODENAME}/g" /etc/yum.repos.d/eos.repo ...@@ -32,7 +32,7 @@ RUN sed -i "s/__EOS_CODENAME__/${EOS_CODENAME}/g" /etc/yum.repos.d/eos.repo
RUN mkdir /var/tmp/eosxd-cache/ /var/tmp/eosxd-journal/ RUN mkdir /var/tmp/eosxd-cache/ /var/tmp/eosxd-journal/
RUN adduser eos-user RUN adduser eos-user && adduser eosnobody
# Docker will aggressively cache the following command, but this is fine, since # Docker will aggressively cache the following command, but this is fine, since
# these packages are not updated often. # these packages are not updated often.
...@@ -70,13 +70,9 @@ RUN createrepo ${EOSREPODIR} \ ...@@ -70,13 +70,9 @@ RUN createrepo ${EOSREPODIR} \
RUN if [ "${EOS_CODENAME}" != "diopside" ]; then yum -y --nogpg install quarkdb; else yum -y --nogpg install eos-quarkdb; fi RUN if [ "${EOS_CODENAME}" != "diopside" ]; then yum -y --nogpg install quarkdb; else yum -y --nogpg install eos-quarkdb; fi
# Generate a new forwardable keytab 'eos-test+' to replace the not-forwardable # Swap and use the forwardable keytab (installed by the eos-testkeytab package).
# one (installed by the eos-testkeytab package). # This is useful for clients who reside on a private network and tunnel through a
# This is useful to deploy EOS on Kubernetes clusters running on CERN's Cloud # Network Address Translation (NAT) device. You can remove these lines if you don't need them.
# Infrastructure; you can remove these lines if you don't need one. RUN mv -f /etc/eos.keytab.fw /etc/eos.keytab
RUN yes | xrdsssadmin -k eos-test del /etc/eos.keytab \
&& yes | xrdsssadmin -u daemon -g daemon -k eos-test+ -n 1234567890123456789 add /etc/eos.keytab \
&& chown daemon:daemon /etc/eos.keytab \
&& chmod 400 /etc/eos.keytab
ENTRYPOINT ["/bin/bash"] ENTRYPOINT ["/bin/bash"]
...@@ -32,7 +32,7 @@ RUN sed -i "s/__EOS_CODENAME__/${EOS_CODENAME}/g" /etc/yum.repos.d/eos.repo ...@@ -32,7 +32,7 @@ RUN sed -i "s/__EOS_CODENAME__/${EOS_CODENAME}/g" /etc/yum.repos.d/eos.repo
RUN mkdir /var/tmp/eosxd-cache/ /var/tmp/eosxd-journal/ RUN mkdir /var/tmp/eosxd-cache/ /var/tmp/eosxd-journal/
RUN adduser eos-user RUN adduser eos-user && adduser eosnobody
# Note: Docker will aggressively cache the following command. # Note: Docker will aggressively cache the following command.
# However, these packages don't change often # However, these packages don't change often
...@@ -88,14 +88,10 @@ RUN if [ "${EOS_CODENAME}" != "diopside" ]; then yum -y --nogpg install quarkdb; ...@@ -88,14 +88,10 @@ RUN if [ "${EOS_CODENAME}" != "diopside" ]; then yum -y --nogpg install quarkdb;
# fails. This happens on CC7 and C8. # fails. This happens on CC7 and C8.
RUN dnf -y --nogpg install xrootd-client RUN dnf -y --nogpg install xrootd-client
# Generate a new forwardable keytab 'eos-test+' to replace the not-forwardable # Swap and use the forwardable keytab (installed by the eos-testkeytab package).
# one (installed by the eos-testkeytab package). # This is useful for clients who reside on a private network and tunnel through a
# This is useful to deploy EOS on Kubernetes clusters running on CERN's Cloud # Network Address Translation (NAT) device. You can remove these lines if you don't need them.
# Infrastructure; you can remove these lines if you don't need one. RUN mv -f /etc/eos.keytab.fw /etc/eos.keytab
RUN yes | xrdsssadmin -k eos-test del /etc/eos.keytab \
&& yes | xrdsssadmin -u daemon -g daemon -k eos-test+ -n 1234567890123456789 add /etc/eos.keytab \
&& chown daemon:daemon /etc/eos.keytab \
&& chmod 400 /etc/eos.keytab
# Change owner of /var/spool/xrootd directory to daemon # Change owner of /var/spool/xrootd directory to daemon
RUN chown daemon:daemon /var/spool/xrootd RUN chown daemon:daemon /var/spool/xrootd
......
...@@ -26,7 +26,7 @@ COPY eos-docker/xrootd-fwd-proxy.cfg /etc/xrootd/ ...@@ -26,7 +26,7 @@ COPY eos-docker/xrootd-fwd-proxy.cfg /etc/xrootd/
RUN mkdir /var/tmp/eosxd-cache/ /var/tmp/eosxd-journal/ RUN mkdir /var/tmp/eosxd-cache/ /var/tmp/eosxd-journal/
RUN adduser eos-user RUN adduser eos-user && adduser eosnobody
# Docker will aggressively cache the following command, but this is fine, since # Docker will aggressively cache the following command, but this is fine, since
# these packages are not updated often. # these packages are not updated often.
...@@ -79,13 +79,9 @@ RUN echo -e "export EOS_COVERAGE_REPORT=1" >> /etc/sysconfig/eos ...@@ -79,13 +79,9 @@ RUN echo -e "export EOS_COVERAGE_REPORT=1" >> /etc/sysconfig/eos
RUN mkdir -p /root/rpmbuild/BUILD/ \ RUN mkdir -p /root/rpmbuild/BUILD/ \
&& cp -r --preserve /usr/src/debug/eos-* /root/rpmbuild/BUILD/ && cp -r --preserve /usr/src/debug/eos-* /root/rpmbuild/BUILD/
# Generate a new forwardable keytab 'eos-test+' to replace the not-forwardable # Swap and use the forwardable keytab (installed by the eos-testkeytab package).
# one (installed by the eos-testkeytab package). # This is useful for clients who reside on a private network and tunnel through a
# This is useful to deploy EOS on Kubernetes clusters running on CERN's Cloud # Network Address Translation (NAT) device. You can remove these lines if you don't need them.
# Infrastructure; you can remove these lines if you don't need one. RUN mv -f /etc/eos.keytab.fw /etc/eos.keytab
RUN yes | xrdsssadmin -k eos-test del /etc/eos.keytab \
&& yes | xrdsssadmin -u daemon -g daemon -k eos-test+ -n 1234567890123456789 add /etc/eos.keytab \
&& chown daemon:daemon /etc/eos.keytab \
&& chmod 400 /etc/eos.keytab
ENTRYPOINT ["/bin/bash"] ENTRYPOINT ["/bin/bash"]
...@@ -34,7 +34,7 @@ RUN sed -i "s/__EOS_CODENAME__/${EOS_CODENAME}/g" /etc/yum.repos.d/eos.repo ...@@ -34,7 +34,7 @@ RUN sed -i "s/__EOS_CODENAME__/${EOS_CODENAME}/g" /etc/yum.repos.d/eos.repo
RUN mkdir /var/tmp/eosxd-cache/ /var/tmp/eosxd-journal/ RUN mkdir /var/tmp/eosxd-cache/ /var/tmp/eosxd-journal/
RUN adduser eos-user RUN adduser eos-user && adduser eosnobody
# Note: Docker will aggressively cache the following command. # Note: Docker will aggressively cache the following command.
# However, these packages don't change often # However, these packages don't change often
...@@ -90,14 +90,10 @@ RUN if [ "${EOS_CODENAME}" != "diopside" ]; then yum -y --nogpg install quarkdb; ...@@ -90,14 +90,10 @@ RUN if [ "${EOS_CODENAME}" != "diopside" ]; then yum -y --nogpg install quarkdb;
# fails. This happens on CC7 and C8. # fails. This happens on CC7 and C8.
RUN dnf -y --nogpg install xrootd-client RUN dnf -y --nogpg install xrootd-client
# Generate a new forwardable keytab 'eos-test+' to replace the not-forwardable # Swap and use the forwardable keytab (installed by the eos-testkeytab package).
# one (installed by the eos-testkeytab package). # This is useful for clients who reside on a private network and tunnel through a
# This is useful to deploy EOS on Kubernetes clusters running on CERN's Cloud # Network Address Translation (NAT) device. You can remove these lines if you don't need them.
# Infrastructure; you can remove these lines if you don't need one. RUN mv -f /etc/eos.keytab.fw /etc/eos.keytab
RUN yes | xrdsssadmin -k eos-test del /etc/eos.keytab \
&& yes | xrdsssadmin -u daemon -g daemon -k eos-test+ -n 1234567890123456789 add /etc/eos.keytab \
&& chown daemon:daemon /etc/eos.keytab \
&& chmod 400 /etc/eos.keytab
# Change owner of /var/spool/xrootd directory to daemon # Change owner of /var/spool/xrootd directory to daemon
RUN chown daemon:daemon /var/spool/xrootd RUN chown daemon:daemon /var/spool/xrootd
......
...@@ -32,7 +32,7 @@ RUN sed -i "s/__EOS_CODENAME__/${EOS_CODENAME}/g" /etc/yum.repos.d/eos.repo ...@@ -32,7 +32,7 @@ RUN sed -i "s/__EOS_CODENAME__/${EOS_CODENAME}/g" /etc/yum.repos.d/eos.repo
RUN mkdir /var/tmp/eosxd-cache/ /var/tmp/eosxd-journal/ RUN mkdir /var/tmp/eosxd-cache/ /var/tmp/eosxd-journal/
RUN adduser eos-user RUN adduser eos-user && adduser eosnobody
# Docker will aggressively cache the following command, but this is fine, since # Docker will aggressively cache the following command, but this is fine, since
# these packages are not updated often. # these packages are not updated often.
...@@ -83,14 +83,10 @@ RUN if [ "${EOS_CODENAME}" != "diopside" ]; then yum -y --nogpg install quarkdb; ...@@ -83,14 +83,10 @@ RUN if [ "${EOS_CODENAME}" != "diopside" ]; then yum -y --nogpg install quarkdb;
# fails. This happens on CC7 and C8. # fails. This happens on CC7 and C8.
RUN yum install -y --nogpg install xrootd-client-4.11.3 RUN yum install -y --nogpg install xrootd-client-4.11.3
# Generate a new forwardable keytab 'eos-test+' to replace the not-forwardable # Swap and use the forwardable keytab (installed by the eos-testkeytab package).
# one (installed by the eos-testkeytab package). # This is useful for clients who reside on a private network and tunnel through a
# This is useful to deploy EOS on Kubernetes clusters running on CERN's Cloud # Network Address Translation (NAT) device. You can remove these lines if you don't need them.
# Infrastructure; you can remove these lines if you don't need one. RUN mv -f /etc/eos.keytab.fw /etc/eos.keytab
RUN yes | xrdsssadmin -k eos-test del /etc/eos.keytab \
&& yes | xrdsssadmin -u daemon -g daemon -k eos-test+ -n 1234567890123456789 add /etc/eos.keytab \
&& chown daemon:daemon /etc/eos.keytab \
&& chmod 400 /etc/eos.keytab
# Change owner of /var/spool/xrootd directory to daemon # Change owner of /var/spool/xrootd directory to daemon
RUN chown daemon:daemon /var/spool/xrootd RUN chown daemon:daemon /var/spool/xrootd
......
...@@ -21,7 +21,7 @@ COPY eos-docker/fstfmd.dict /var/eos/md/ ...@@ -21,7 +21,7 @@ COPY eos-docker/fstfmd.dict /var/eos/md/
RUN mkdir /var/tmp/eosxd-cache/ /var/tmp/eosxd-journal/ RUN mkdir /var/tmp/eosxd-cache/ /var/tmp/eosxd-journal/
RUN adduser eos-user RUN adduser eos-user && adduser eosnobody
ENV DEBIAN_FRONTEND noninteractive ENV DEBIAN_FRONTEND noninteractive
......
...@@ -21,7 +21,7 @@ COPY eos-docker/fstfmd.dict /var/eos/md/ ...@@ -21,7 +21,7 @@ COPY eos-docker/fstfmd.dict /var/eos/md/
RUN mkdir /var/tmp/eosxd-cache/ /var/tmp/eosxd-journal/ RUN mkdir /var/tmp/eosxd-cache/ /var/tmp/eosxd-journal/
RUN adduser eos-user RUN adduser eos-user && adduser eosnobody
ENV DEBIAN_FRONTEND noninteractive ENV DEBIAN_FRONTEND noninteractive
......
...@@ -26,7 +26,7 @@ COPY eos-docker/xrootd-fwd-proxy.cfg /etc/xrootd/ ...@@ -26,7 +26,7 @@ COPY eos-docker/xrootd-fwd-proxy.cfg /etc/xrootd/
RUN mkdir /var/tmp/eosxd-cache/ /var/tmp/eosxd-journal/ RUN mkdir /var/tmp/eosxd-cache/ /var/tmp/eosxd-journal/
RUN adduser eos-user RUN adduser eos-user && adduser eosnobody
# Docker will aggressively cache the following command, but this is fine, since # Docker will aggressively cache the following command, but this is fine, since
# these packages are not updated often. # these packages are not updated often.
...@@ -62,13 +62,9 @@ RUN createrepo ${EOSREPODIR} \ ...@@ -62,13 +62,9 @@ RUN createrepo ${EOSREPODIR} \
eos-archive eos-client eos-fuse eos-fusex eos-ns-inspect eos-server eos-test eos-testkeytab \ eos-archive eos-client eos-fuse eos-fusex eos-ns-inspect eos-server eos-test eos-testkeytab \
&& yum clean all && yum clean all
# Generate a new forwardable keytab 'eos-test+' to replace the not-forwardable # Swap and use the forwardable keytab (installed by the eos-testkeytab package).
# one (installed by the eos-testkeytab package). # This is useful for clients who reside on a private network and tunnel through a
# This is useful to deploy EOS on Kubernetes clusters running on CERN's Cloud # Network Address Translation (NAT) device. You can remove these lines if you don't need them.
# Infrastructure; you can remove these lines if you don't need one. RUN mv -f /etc/eos.keytab.fw /etc/eos.keytab
RUN yes | xrdsssadmin -k eos-test del /etc/eos.keytab \
&& yes | xrdsssadmin -u daemon -g daemon -k eos-test+ -n 1234567890123456789 add /etc/eos.keytab \
&& chown daemon:daemon /etc/eos.keytab \
&& chmod 400 /etc/eos.keytab
ENTRYPOINT ["/bin/bash"] ENTRYPOINT ["/bin/bash"]
...@@ -34,14 +34,10 @@ RUN sed -i "s|/usr/bin/xrdcp|/opt/eos/xrootd/bin/xrdcp|g" /etc/xrd.cf.fst ...@@ -34,14 +34,10 @@ RUN sed -i "s|/usr/bin/xrdcp|/opt/eos/xrootd/bin/xrdcp|g" /etc/xrd.cf.fst
# Install some much needed utility: please bloat with care! # Install some much needed utility: please bloat with care!
RUN yum -y --nogpg install nano redis && yum clean all && rm -rf /var/cache/yum RUN yum -y --nogpg install nano redis && yum clean all && rm -rf /var/cache/yum
# Generate a new forwardable keytab 'eos-test+' to replace the not-forwardable # Swap and use the forwardable keytab (installed by the eos-testkeytab package).
# one (installed by the eos-testkeytab package). This is mmostly useful to deploy EOS # This is useful for clients who reside on a private network and tunnel through a
# on containerized envoronments; you can remove these lines if you don't need one. # Network Address Translation (NAT) device. You can remove these lines if you don't need them.
# @todo review: what about not installing eos-testkeytab at all? RUN mv -f /etc/eos.keytab.fw /etc/eos.keytab
RUN yes | xrdsssadmin -k eos-test del /etc/eos.keytab \
&& yes | xrdsssadmin -u daemon -g daemon -k eos-test+ -n 1234567890123456789 add /etc/eos.keytab \
&& chown daemon:daemon /etc/eos.keytab \
&& chmod 400 /etc/eos.keytab
# Change owner of /var/spool/xrootd directory to daemon # Change owner of /var/spool/xrootd directory to daemon
RUN chown daemon:daemon /var/spool/xrootd RUN chown daemon:daemon /var/spool/xrootd
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment