diff --git a/.github/workflows/build-and-test.yml b/.github/workflows/build-and-test.yml index d0621c8..3af92a1 100644 --- a/.github/workflows/build-and-test.yml +++ b/.github/workflows/build-and-test.yml @@ -64,7 +64,7 @@ jobs: with: context: . file: ./Dockerfile - platforms: linux/amd64,linux/arm64,linux/arm/v7 + platforms: linux/amd64,linux/arm64 cache-from: | type=local,src=${{ env.CACHE_PATH }} ghcr.io/cdalvaro/docker-salt-master:latest @@ -88,11 +88,11 @@ jobs: needs: build strategy: matrix: - platform: [linux/amd64, linux/arm64, linux/arm/v7] + platform: [linux/amd64, linux/arm64] env: DOCKER_CLI_EXPERIMENTAL: enabled PLATFORM: ${{ matrix.platform }} - BOOTUP_WAIT_SECONDS: 90 + BOOTUP_WAIT_SECONDS: 60 steps: - name: Checkout repository diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index a844a12..4e020ae 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -17,7 +17,7 @@ on: env: IMAGE_NAME: cdalvaro/docker-salt-master - PLATFORMS: linux/amd64,linux/arm64,linux/arm/v7 + PLATFORMS: linux/amd64,linux/arm64 CACHE_PATH: ${{ github.workspace }}/.buildx-cache EXTRA_REGISTRIES: ghcr.io quay.io diff --git a/CHANGELOG.md b/CHANGELOG.md index 9b72b29..7b73a12 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,14 +1,15 @@ # Changelog This file only reflects the changes that are made in this image. -Please refer to the [Salt 3006 Release Notes](https://docs.saltstack.com/en/latest/topics/releases/3006.html) +Please refer to the [Salt 3006.0 Release Notes](https://docs.saltstack.com/en/latest/topics/releases/3006.0.html) for the list of changes in SaltStack. **3006.0** - Upgrade `salt-master` to `3006.0` *Sulfur*. -- Upgrade `salt-bootstrap` to version `2023.04.06`. - Change Docker base image to `ubuntu:jammy-20230308`. +- Use [_onedir_](https://docs.saltproject.io/en/latest/topics/releases/3006.0.html#onedir-packaging) system for installing salt. +- Remove support for arm32 architecture. **3005.1-2_1** diff --git a/Dockerfile b/Dockerfile index 9bc56cb..c74e797 100644 --- a/Dockerfile +++ b/Dockerfile @@ -30,9 +30,7 @@ WORKDIR ${SALT_BUILD_DIR} # hadolint ignore=DL3008 RUN apt-get update \ && DEBIAN_FRONTEND=noninteractive apt-get install --yes --quiet --no-install-recommends \ - sudo ca-certificates openssl apt-transport-https wget locales openssh-client gpg \ - python3 python3-dev libpython3-dev \ - python3-pip python3-setuptools python3-wheel \ + sudo ca-certificates apt-transport-https wget locales openssh-client gpg gpg-agent \ supervisor logrotate git gettext-base tzdata inotify-tools psmisc \ && DEBIAN_FRONTEND=noninteractive update-locale LANG=C.UTF-8 LC_MESSAGES=POSIX \ locale-gen en_US.UTF-8 \ diff --git a/README.md b/README.md index 4483b0c..19be197 100644 --- a/README.md +++ b/README.md @@ -5,7 +5,6 @@ [![Docker Image Size][docker_size_badge]][docker_hub_tags] [![Architecture AMD64][arch_amd64_badge]][arch_link] [![Architecture ARM64][arch_arm64_badge]][arch_link] -[![Architecture ARM/v7][arch_arm_badge]][arch_link] # Dockerized Salt Master v3006.0 _Sulfur_ @@ -817,8 +816,6 @@ Many thanks to: [arch_amd64_badge]: https://img.shields.io/badge/arch-amd64-inactive.svg -[arch_arm_badge]: https://img.shields.io/badge/arch-arm/v7-inactive.svg - [arch_arm64_badge]: https://img.shields.io/badge/arch-arm64-inactive.svg [arch_link]: https://github.com/users/cdalvaro/packages/container/package/docker-salt-master diff --git a/assets/build/functions.sh b/assets/build/functions.sh index 8ff6f00..681283f 100755 --- a/assets/build/functions.sh +++ b/assets/build/functions.sh @@ -52,16 +52,7 @@ function exec_as_salt() } #--- FUNCTION ------------------------------------------------------------------------------------------------------- -# NAME: is_arm32 -# DESCRIPTION: Check whether the platform is ARM 32-bits or not. -#---------------------------------------------------------------------------------------------------------------------- -function is_arm32() -{ - uname -m | grep -qE 'armv7l' -} - -#--- FUNCTION ------------------------------------------------------------------------------------------------------- -# NAME: is_arm32 +# NAME: is_arm64 # DESCRIPTION: Check whether the platform is ARM 64-bits or not. #---------------------------------------------------------------------------------------------------------------------- function is_arm64() @@ -69,15 +60,6 @@ function is_arm64() uname -m | grep -qE 'arm64|aarch64' } -#--- FUNCTION ------------------------------------------------------------------------------------------------------- -# NAME: is_arm32 -# DESCRIPTION: Check whether the platform is ARM or not. -#---------------------------------------------------------------------------------------------------------------------- -function is_arm() -{ - is_arm32 || is_arm64 -} - #--- FUNCTION ------------------------------------------------------------------------------------------------------- # NAME: install_pkgs # DESCRIPTION: Install packages using apt-get install. @@ -90,6 +72,9 @@ function install_pkgs() #--- FUNCTION ------------------------------------------------------------------------------------------------------- # NAME: download # DESCRIPTION: Download the content from the given URL and save it into the specified file. +# ARGUMENTS: +# 1: URL where the file is hosted. +# 2: Filename (with path) for the downloaded file. #---------------------------------------------------------------------------------------------------------------------- function download() { @@ -97,7 +82,6 @@ function download() local FILE_NAME="$2" local WGET_ARGS=(--quiet) - is_arm32 && WGET_ARGS+=(--no-check-certificate) log_info "Downloading ${FILE_NAME} from ${URL} ..." wget ${WGET_ARGS[@]} -O "${FILE_NAME}" "${URL}" @@ -112,6 +96,9 @@ function download() #--- FUNCTION ------------------------------------------------------------------------------------------------------- # NAME: check_sha256 # DESCRIPTION: Compute the SHA256 hash for the given file and check if it matches the expected one. +# ARGUMENTS: +# 1: The file to check. +# 2: The expected SHA256 checksum. #---------------------------------------------------------------------------------------------------------------------- function check_sha256() { @@ -133,6 +120,8 @@ function check_sha256() #--- FUNCTION ------------------------------------------------------------------------------------------------------- # NAME: extract # DESCRIPTION: Extract the given .tar.gz into the current directory. +# ARGUMENTS: +# 1: The file to extract. #---------------------------------------------------------------------------------------------------------------------- function extract() { @@ -140,3 +129,20 @@ function extract() log_info "Unpacking file: ${FILE}" tar xzf "${FILE}" --strip-components 1 } + +#--- FUNCTION ------------------------------------------------------------------------------------------------------- +# NAME: add_salt_repository +# DESCRIPTION: Add salt repository to packages sources. +#---------------------------------------------------------------------------------------------------------------------- +function add_salt_repository() +{ + local arch=amd64 + is_arm64 && arch=arm64 + source /etc/os-release + + local keyring_file="/etc/apt/keyrings/salt-archive-keyring.gpg" + local root_url="https://repo.saltproject.io/salt/py3/ubuntu/${VERSION_ID:?}/${arch}" + + download "${root_url}/SALT-PROJECT-GPG-PUBKEY-2023.gpg" "${keyring_file}" + echo "deb [signed-by=${keyring_file} arch=${arch}] ${root_url}/minor/${SALT_VERSION} ${VERSION_CODENAME:?} main" > /etc/apt/sources.list.d/salt.list +} diff --git a/assets/build/install.sh b/assets/build/install.sh index c51a764..1631488 100755 --- a/assets/build/install.sh +++ b/assets/build/install.sh @@ -11,66 +11,35 @@ source "${FUNCTIONS_FILE}" log_info "Installing required packages and build dependencies ..." REQUIRED_PACKAGES=( - libssl3 zlib1g libffi7 libpcre3 libgssapi3-heimdal + binutils patchelf ) -BUILD_DEPENDENCIES=( - make gcc g++ -) +BUILD_DEPENDENCIES=() + +log_info "Adding salt repository..." +add_salt_repository apt-get update install_pkgs "${REQUIRED_PACKAGES[@]}" "${BUILD_DEPENDENCIES[@]}" # Create salt user +# https://manpages.ubuntu.com/manpages/xenial/en/man8/useradd.8.html log_info "Creating ${SALT_USER} user ..." -useradd -d "${SALT_HOME}" -ms /bin/bash -U -G root,sudo,shadow "${SALT_USER}" +useradd --home-dir "${SALT_HOME}" --create-home \ + --shell /bin/bash --user-group "${SALT_USER}" \ + --groups shadow # Set PATH exec_as_salt cat >> "${SALT_HOME}/.profile" <> /etc/ssh/ssh_config +SUPERVISOR_CONFIG_FILE=/etc/supervisor/supervisord.conf + # Configure logrotate log_info "Configuring logrotate ..." # move supervisord.log file to ${SALT_LOGS_DIR}/supervisor/ -sed -i "s|^[#]*logfile=.*|logfile=${SALT_LOGS_DIR}/supervisor/supervisord.log ;|" /etc/supervisor/supervisord.conf +sed -i "s|^[#]*logfile=.*|logfile=${SALT_LOGS_DIR}/supervisor/supervisord.log ;|" "${SUPERVISOR_CONFIG_FILE}" # fix "unknown group 'syslog'" error preventing logrotate from functioning sed -i "s|^su root syslog$|su root root|" /etc/logrotate.conf @@ -93,13 +64,20 @@ sed -i "s|^su root syslog$|su root root|" /etc/logrotate.conf # Configure supervisor log_info "Configuring supervisor ..." +# run supervisord as root +if grep -E "^user=" "${SUPERVISOR_CONFIG_FILE}"; then + sed -i "s|^user=.*|user=root|" "${SUPERVISOR_CONFIG_FILE}" +else + sed -i "s|^\[supervisord\]\$|[supervisord]\nuser=root|" "${SUPERVISOR_CONFIG_FILE}" +fi + # configure supervisord to start salt-master cat > /etc/supervisor/conf.d/salt-master.conf < Checking salt-master version ..." -docker-exec salt-master --versions -EXPECTED_VERSION="$(cat VERSION) (Sulfur)" -CURRENT_VERSION="$(docker-exec salt-master --version)" -check_equal "${CURRENT_VERSION}" "salt-master ${EXPECTED_VERSION%%-*}" "salt-master --version" +output=$(docker-exec salt-master --versions) +echo "${output}" + +# shellcheck disable=SC2016 +CURRENT_VERSION="$(echo -n "${output}" | grep -Ei 'salt: ([^\s]+)' | awk '{print $2}')" +EXPECTED_VERSION="$(cat VERSION)" +check_equal "${CURRENT_VERSION%%-*}" "${EXPECTED_VERSION%%-*}" "salt-master version" # Test image calling healthcheck echo "==> Executing healthcheck ..." diff --git a/tests/gpg/test.sh b/tests/gpg/test.sh index d224302..f360b42 100755 --- a/tests/gpg/test.sh +++ b/tests/gpg/test.sh @@ -14,8 +14,8 @@ trap cleanup EXIT # Run test instance echo "==> Starting docker-salt-master (${PLATFORM}) config ..." start_container_and_wait \ - --volume "${SCRIPT_PATH}/roots/":/home/salt/data/srv/:ro \ - --volume "${SCRIPT_PATH}/keys/":/home/salt/data/keys/ \ + --volume "${SCRIPT_PATH}/roots":/home/salt/data/srv:ro \ + --volume "${SCRIPT_PATH}/keys":/home/salt/data/keys \ || error "container started" ok "container started" diff --git a/tests/lib/common.sh b/tests/lib/common.sh index a1b9da2..f3a57ce 100644 --- a/tests/lib/common.sh +++ b/tests/lib/common.sh @@ -171,8 +171,8 @@ EOF --env PUID="$(id -u)" --env PGID="$(id -g)" \ --env SALT_LOG_LEVEL='info' \ --platform "${PLATFORM}" ${DOCKER_ARGS[@]} \ - --volume "${LOGS_DIR}/":/home/salt/data/logs/ \ - --volume "${SCRIPT_PATH}/config/":/home/salt/data/config/:ro \ + --volume "${LOGS_DIR}":/home/salt/data/logs \ + --volume "${SCRIPT_PATH}/config":/home/salt/data/config:ro \ "${IMAGE_NAME}" || return 1 echo "==> Waiting ${BOOTUP_WAIT_SECONDS} seconds for the container to be ready ..." diff --git a/tests/salt-api/test.sh b/tests/salt-api/test.sh index ae19446..43a8c46 100755 --- a/tests/salt-api/test.sh +++ b/tests/salt-api/test.sh @@ -51,11 +51,15 @@ ok "container started" # Test salt-api authentication echo "==> Getting salt-api token ..." -SALTAPI_TOKEN=$(curl -sSk "${SALTAPI_URL%/}/login" \ +CURL_OUTPUT="$(curl -sSk "${SALTAPI_URL%/}/login" \ -H "Accept: application/x-yaml" \ -d username="${SALTAPI_USER}" \ -d password="${SALTAPI_PASS}" \ - -d eauth="${SALTAPI_EAUTH}" | grep 'token:' | cut -d' ' -f 4) + -d eauth="${SALTAPI_EAUTH}")" +echo "${CURL_OUTPUT}" + +SALTAPI_TOKEN= +SALTAPI_TOKEN="$(echo -n "${CURL_OUTPUT}" | grep -Ei 'token: ([^\s]+)' | awk '{print $2}')" [ -n "${SALTAPI_TOKEN}" ] || error "salt-api token" ok "salt-api token" @@ -89,11 +93,15 @@ ok "container started" # Test salt-api authentication echo "==> Getting salt-api token (pass via file) ..." -SALTAPI_TOKEN=$(curl -sSk "${SALTAPI_URL%/}/login" \ +CURL_OUTPUT="$(curl -sSk "${SALTAPI_URL%/}/login" \ -H "Accept: application/x-yaml" \ -d username="${SALTAPI_USER}" \ -d password="${SALTAPI_PASS}" \ - -d eauth="${SALTAPI_EAUTH}" | grep 'token:' | cut -d' ' -f 4) + -d eauth="${SALTAPI_EAUTH}")" +echo "${CURL_OUTPUT}" + +SALTAPI_TOKEN= +SALTAPI_TOKEN="$(echo -n "${CURL_OUTPUT}" | grep -Ei 'token: ([^\s]+)' | awk '{print $2}')" [ -n "${SALTAPI_TOKEN}" ] || error "salt-api token" ok "salt-api token"