opensearch 3.5.0

o/opensearch-project-opensearch-build/Dockerfiles/3.5.0_ubi9.7/Dockerfile.ais

@@ -0,0 +1,125 @@
+# Copyright OpenSearch Contributors
+# SPDX-License-Identifier: Apache-2.0
+#
+# Dockerfile for building an OpenSearch image using UBI9 for ppc64le / OCP compatibility.
+# It assumes that the working directory contains these files: an OpenSearch tarball (opensearch-ppc64le.tgz),
+# log4j2.properties, opensearch.yml, opensearch-docker-entrypoint.sh, and opensearch-onetime-setup.sh.
+#
+# Build arguments:
+#   VERSION: Required. Used to label the image.
+#   BUILD_DATE: Required. Used to label the image (e.g. 'yyyy-mm-ddThh:mm:ssZ').
+#   UID: Optional. Specify the opensearch userid. Defaults to 1000.
+#   GID: Optional. Specify the opensearch groupid. Defaults to 1000.
+#   OPENSEARCH_HOME: Optional. Specify the opensearch root directory. Defaults to /usr/share/opensearch.
+
+########################### Stage 0 ########################
+FROM registry.access.redhat.com/ubi9:latest AS linux_stage_0
+
+ARG UID=1000
+ARG GID=1000
+ARG VERSION
+ARG TEMP_DIR=/tmp/opensearch
+ARG OPENSEARCH_HOME=/usr/share/opensearch
+ARG OPENSEARCH_PATH_CONF=$OPENSEARCH_HOME/config
+ARG SECURITY_PLUGIN_DIR=$OPENSEARCH_HOME/plugins/opensearch-security
+ARG PERFORMANCE_ANALYZER_PLUGIN_CONFIG_DIR=$OPENSEARCH_PATH_CONF/opensearch-performance-analyzer
+
+# Apply CVE mitigations and install required extraction/user tools
+RUN dnf upgrade -y curl-minimal libcurl-minimal libpng && \
+    dnf install -y tar gzip shadow-utils which openssl && \
+    dnf clean all
+
+# Create an opensearch user and group, add to GID 0 (root) for OpenShift arbitrary UID compatibility
+RUN groupadd -g $GID opensearch && \
+    adduser -u $UID -g $GID -G 0 -d $OPENSEARCH_HOME opensearch && \
+    mkdir -p $TEMP_DIR $OPENSEARCH_HOME
+
+# Prepare working directory and copy artifacts
+COPY * $TEMP_DIR/
+RUN ls -l $TEMP_DIR && \
+    tar -xzpf /tmp/opensearch/opensearch-ppc64le.tgz -C $OPENSEARCH_HOME --strip-components=1 && \
+    MAJOR_VERSION_ENTRYPOINT=`echo $VERSION | cut -d. -f1` && \
+    echo $MAJOR_VERSION_ENTRYPOINT && \
+    if ! (ls $TEMP_DIR | grep -E "opensearch-docker-entrypoint-.*.x.sh" | grep $MAJOR_VERSION_ENTRYPOINT); then MAJOR_VERSION_ENTRYPOINT="default"; fi && \
+    mkdir -p $OPENSEARCH_HOME/data && chown -Rv $UID:$GID $OPENSEARCH_HOME/data && \
+    if [[ -d $SECURITY_PLUGIN_DIR ]] ; then chmod -v 750 $SECURITY_PLUGIN_DIR/tools/* ; fi && \
+    if [[ -d $PERFORMANCE_ANALYZER_PLUGIN_CONFIG_DIR ]] ; then cp -v $TEMP_DIR/performance-analyzer.properties $PERFORMANCE_ANALYZER_PLUGIN_CONFIG_DIR; fi && \
+    cp -v $TEMP_DIR/opensearch-docker-entrypoint-$MAJOR_VERSION_ENTRYPOINT.x.sh $OPENSEARCH_HOME/opensearch-docker-entrypoint.sh && \
+    cp -v $TEMP_DIR/opensearch-onetime-setup.sh $OPENSEARCH_HOME/ && \
+    cp -v $TEMP_DIR/log4j2.properties $TEMP_DIR/opensearch.yml $OPENSEARCH_PATH_CONF/ && \
+    ls -l $OPENSEARCH_HOME && \
+    rm -rf $TEMP_DIR
+
+
+########################### Stage 1 ########################
+FROM registry.access.redhat.com/ubi9:latest
+
+ARG UID=1000
+ARG GID=1000
+ARG OPENSEARCH_HOME=/usr/share/opensearch
+
+# Install tools, OpenSSL for certificate generation, and Java 21 OpenJDK.
+# OpenSearch 3.5.0 requires JDK 21; JDK 25 removes APIs used by 3.5.0 Gradle plugins.
+# Note: java-21-openjdk-crypto-adapter is x86_64-only and not available on ppc64le;
+#       FIPS approved-only mode is disabled anyway via OPENSEARCH_JAVA_OPTS below.
+RUN dnf upgrade -y curl-minimal libcurl-minimal libpng && \
+    dnf install -y tar gzip shadow-utils which openssl \
+    java-21-openjdk \
+    java-21-openjdk-devel \
+    java-21-openjdk-headless && \
+    dnf clean all
+
+# Point JAVA_HOME and PATH to the system installed OpenJDK (ppc64le has no bundled JDK)
+ENV JAVA_HOME=/usr/lib/jvm/java-21-openjdk
+ENV PATH=$OPENSEARCH_HOME/bin:$JAVA_HOME/bin:$PATH
+
+# Create opensearch user and add to root group (GID 0) for OpenShift arbitrary UID compatibility
+RUN groupadd -g $GID opensearch && \
+    adduser -u $UID -g $GID -G 0 -d $OPENSEARCH_HOME opensearch
+
+# Copy unpacked OpenSearch tree from Stage 0
+COPY --from=linux_stage_0 --chown=$UID:0 $OPENSEARCH_HOME $OPENSEARCH_HOME
+WORKDIR $OPENSEARCH_HOME
+
+# Add k-NN lib directory to library loading path variable
+ENV LD_LIBRARY_PATH="$OPENSEARCH_HOME/plugins/opensearch-knn/lib"
+
+# Disable FIPS approved-only mode to allow standard passwords
+ENV OPENSEARCH_JAVA_OPTS="-Dorg.bouncycastle.fips.approved_only=false"
+
+# Run setup scripts
+ARG DISABLE_INSTALL_DEMO_CONFIG=true
+ARG DISABLE_SECURITY_PLUGIN=false
+RUN ./opensearch-onetime-setup.sh
+
+# OpenShift restricted-v2 compatibility:
+# Set full group ownership (GID 0) and permissions AFTER all setup scripts finish
+RUN chown -R $UID:0 $OPENSEARCH_HOME && \
+    chmod -R g+rwX $OPENSEARCH_HOME && \
+    find $OPENSEARCH_HOME -type d -exec chmod g+x {} \; && \
+    chmod g+rwX $OPENSEARCH_HOME/opensearch-docker-entrypoint.sh && \
+    chmod g+rwX $OPENSEARCH_HOME/opensearch-onetime-setup.sh
+
+# Change to unprivileged user
+USER $UID
+
+# Expose ports: 9200 (HTTP), 9300 (Transport), 9600 (Performance Analyzer Agent), 9650 (Root Cause Analysis)
+EXPOSE 9200 9300 9600 9650
+
+ARG VERSION
+ARG BUILD_DATE
+ARG NOTES
+
+# Metadata Labels
+LABEL org.label-schema.schema-version="1.0" \
+  org.label-schema.name="opensearch" \
+  org.label-schema.version="$VERSION" \
+  org.label-schema.url="https://opensearch.org" \
+  org.label-schema.vcs-url="https://github.com/opensearch-project/OpenSearch" \
+  org.label-schema.license="Apache-2.0" \
+  org.label-schema.vendor="OpenSearch" \
+  org.label-schema.description="$NOTES" \
+  org.label-schema.build-date="$BUILD_DATE"
+
+ENTRYPOINT ["./opensearch-docker-entrypoint.sh"]
+CMD ["opensearch"]

o/opensearch-project-opensearch-build/Dockerfiles/3.5.0_ubi9.7/Dockerfile.build-env

@@ -0,0 +1,94 @@
+FROM registry.access.redhat.com/ubi9/ubi
+
+# Set working directory
+WORKDIR /opensearch-build
+
+# Apply CVE mitigations before installing any other packages.
+RUN yum upgrade -y curl-minimal libcurl-minimal libpng && yum clean all
+
+# Install system dependencies
+RUN yum install -y --allowerasing \
+    git \
+    gcc \
+    gcc-c++ \
+    gcc-gfortran \
+    make \
+    patch \
+    tar \
+    unzip \
+    zip \
+    which \
+    curl \
+    jq \
+    python3 \
+    python3-devel \
+    python3-pip \
+    bzip2-devel \
+    zlib-devel \
+    openssl-devel \
+    libffi-devel \
+    xz-devel \
+    rpm-build \
+    && yum clean all
+
+# Install yq v4 (required by assemble scripts)
+RUN curl -fsSL "https://github.com/mikefarah/yq/releases/latest/download/yq_linux_ppc64le" \
+    -o /usr/local/bin/yq && chmod +x /usr/local/bin/yq
+
+# Install JDK 21 (required by OpenSearch 3.5.0; JDK 25 removes APIs used by 3.5.0 Gradle plugins).
+RUN yum install -y \
+    java-21-openjdk-devel && \
+    yum upgrade -y \
+    java-21-openjdk \
+    java-21-openjdk-devel \
+    java-21-openjdk-headless && \
+    yum clean all
+
+# Set Java environment
+ENV JAVA_HOME=/usr/lib/jvm/java-21-openjdk
+ENV PATH=$JAVA_HOME/bin:$PATH
+ENV GRADLE_USER_HOME=/root/.gradle
+
+# Pre-cache all Gradle distributions used by 3.5.0 components to avoid
+# network timeouts during the build (each component's gradlew would otherwise
+# download its own distribution at build time).
+# Versions needed (verified from gradle-wrapper.properties in each 3.5.0.0 tag):
+#   9.2.1 - OpenSearch core (OpenSearch/3.5.0), cross-cluster-replication
+#   9.2.0 - all other components: common-utils, job-scheduler, security,
+#            ml-commons, k-NN, alerting, index-management, neural-search,
+#            ltr, observability, reporting
+RUN for version in 9.2.1 9.2.0; do \
+        mkdir -p /root/.gradle/wrapper/dists/gradle-${version}-all && \
+        curl -fsSL "https://services.gradle.org/distributions/gradle-${version}-all.zip" \
+            -o /tmp/gradle-${version}-all.zip && \
+        HASH=$(sha256sum /tmp/gradle-${version}-all.zip | cut -d' ' -f1) && \
+        DEST="/root/.gradle/wrapper/dists/gradle-${version}-all/${HASH}" && \
+        mkdir -p "${DEST}" && \
+        mv /tmp/gradle-${version}-all.zip "${DEST}/gradle-${version}-all.zip" && \
+        touch "${DEST}/gradle-${version}-all.zip.ok"; \
+    done
+
+# Install Maven
+RUN MAVEN_URL=$(curl -s https://maven.apache.org/download.cgi \
+        | grep -Eo '["\047].*.bin.tar.gz["\047]' | tr -d "\"'" | uniq | head -n 1) && \
+    mkdir -p /usr/local/apache-maven && \
+    curl -s "$MAVEN_URL" | tar xzf - --strip-components=1 -C /usr/local/apache-maven && \
+    ln -sfn /usr/local/apache-maven/bin/mvn /usr/local/bin/mvn
+
+# Install pipenv (pin setuptools+virtualenv to avoid packaging incompatibility with pipenv 2023.6.12)
+# Also install PyYAML into the system Python so that inline scripts can import yaml
+RUN python3 -m pip install --upgrade pip && \
+    python3 -m pip install --ignore-installed \
+        "setuptools==67.8.0" \
+        "virtualenv==20.24.5" \
+        "pipenv==2023.6.12" \
+        "PyYAML>=6.0.2"
+
+# Copy the build repo
+COPY . .
+
+# Pre-install Python dependencies
+RUN python3 -m pipenv install --deploy --ignore-pipfile
+
+# Set default command
+CMD ["/bin/bash"]