Feature 11037 Installation of ingress controller in OSM community installer

[osm/devops.git] / docker / Keystone / Dockerfile

diff --git a/docker/Keystone/Dockerfile b/docker/Keystone/Dockerfile
index 9c0dc1e..b00b384 100644 (file)
--- a/docker/Keystone/Dockerfile
+++ b/docker/Keystone/Dockerfile
@@ -14,7 +14,7 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 #######################################################################################
-FROM ubuntu:20.04
+FROM ubuntu:22.04
 
 ARG APT_PROXY
 RUN if [ ! -z $APT_PROXY ] ; then \
@@ -24,41 +24,65 @@ RUN if [ ! -z $APT_PROXY ] ; then \
 
 EXPOSE 5000
 
-WORKDIR /keystone
+WORKDIR /app
 
-COPY scripts/start.sh /keystone/start.sh
+COPY scripts/start.sh /app/start.sh
 
 RUN DEBIAN_FRONTEND=noninteractive apt-get update && \
     DEBIAN_FRONTEND=noninteractive apt-get upgrade -y && \
     DEBIAN_FRONTEND=noninteractive apt-get autoremove -y && \
     DEBIAN_FRONTEND=noninteractive apt-get install -y software-properties-common && \
-    add-apt-repository -y cloud-archive:victoria && \
+    add-apt-repository -y cloud-archive:antelope && \
     DEBIAN_FRONTEND=noninteractive apt-get update && \
     DEBIAN_FRONTEND=noninteractive apt-get dist-upgrade -y && \
     DEBIAN_FRONTEND=noninteractive apt-get install -y \
     apache2=2.4.* \
-    keystone=2:18.0.* \
-    libapache2-mod-wsgi-py3=4.6.* \
-    python3-pip=20.0.* \
-    build-essential=12.8* \
-    python3-dev=3.8.* \
-    libldap2-dev=2.4.* \
+    keystone=2:23.0.* \
+    libapache2-mod-wsgi-py3=4.9.* \
+    python3-pip=22.0.* \
+    build-essential=12.9* \
+    python3-dev=3.10.* \
+    libldap2-dev=2.5.* \
     libsasl2-dev=2.1.* \
-    libssl-dev=1.1.* \
-    libffi-dev=3.3* \
+    libssl-dev=3.0.* \
+    libffi-dev=3.4* \
     libxml2-dev=2.9.* \
     libxslt1-dev=1.1.* \
     zlib1g-dev=1:1.2.* \
-    ldap-utils=2.4.* \
-    curl=7.68.* \
+    ldap-utils=2.5.* \
+    curl=7.81.* \
     net-tools=1.60* \
     mysql-client=8.0.* \
-    dnsutils=1:9.16.* && \
+    dnsutils=1:9.18.* && \
     rm -rf /var/lib/apt/lists/* && \
     chmod +x start.sh
 
-RUN pip3 install -U pip==21.3.1 && \
-    pip3 install python-ldap==3.2.0 ldappool==3.0.0 python-openstackclient==5.7.0
+RUN pip3 install python-ldap==3.2.0 ldappool==3.0.0 python-openstackclient==6.2.0
+
+# Creating the user for the app
+RUN groupadd -g 1000 appuser && \
+    useradd -u 1000 -g 1000 -d /app appuser && \
+    usermod -a -G keystone appuser && \
+    usermod -a -G adm appuser && \
+    chown -R appuser:appuser /app && \
+    chown root:keystone /etc/keystone && \
+    chmod 770 /etc/keystone && \
+    chown root:keystone /etc/ssl/certs && \
+    chmod 770 /etc/ssl/certs && \
+    chown root:keystone /etc/apache2/apache2.conf && \
+    chmod 664 /etc/apache2/apache2.conf && \
+    sed -i 's/Listen 80/Listen 8080/g' /etc/apache2/ports.conf && \
+    chown root:keystone /var/spool && \
+    chmod 775 /var/spool && \
+    chmod 770 /var/log/apache2 && \
+    chmod 660 /var/log/apache2/* && \
+    chmod 770 /var/log/keystone && \
+    chown root:keystone /var/run/apache2 && \
+    chmod 775 /var/run/apache2 && \
+    mkdir -p /etc/sudoers.d && \
+    echo "%appuser ALL= NOPASSWD: /sbin/service apache2 *" > /etc/sudoers.d/appuser
+
+USER appuser
 
 # database
 ENV DB_HOST                 keystone-db