replace public.ecr.aws/bitnami images due to Bitnami image removal from ECR Public

document-manager/backend/openshift.dockerfile

@@ -1,10 +1,12 @@
-FROM public.ecr.aws/bitnami/python:3.12.4
-
-WORKDIR /opt/app-root/src
+FROM python:3.12.4
 
+WORKDIR /opt/app-root/src/
 
 # Install dependencies
-RUN install_packages gcc libc6-dev libpq-dev libmagic-dev
+RUN apt-get update -yqq && \
+    apt-get install -y gcc libc6-dev libpq-dev libmagic-dev && \
+    rm -rf /var/lib/apt/lists/*
+
 
 # Install the requirements
 COPY ./requirements.txt .
@@ -14,9 +16,13 @@
 RUN apt-get purge -y --auto-remove gcc libc6-dev
 
 COPY . .
+# 4. CRITICAL FOR OPENSHIFT: Fix permissions for random user execution
+RUN chgrp -R 0 /opt/app-root && \
+    chmod -R g=u /opt/app-root && \
+    chmod +x /opt/app-root/src/app.sh
 
 ENV FLASK_APP app.py
 
 # Run the server
 EXPOSE 5001 9191
-ENTRYPOINT /opt/app-root/src/app.sh backend
+ENTRYPOINT ["./app.sh", "backend"]

infrastructure/helm/templates/frontend.yaml

@@ -84,13 +84,13 @@ spec:
           volumeMounts:
           - name: vanity-tls-certs
             readOnly: true
-            mountPath: /opt/bitnami/nginx/conf/certs
+            mountPath: /etc/nginx/certs
           - name: plr-integration-volume
             readOnly: true
-            mountPath: /opt/bitnami/nginx/conf/certs/plr
+            mountPath: /etc/nginx/certs/plr
           - name: nginx-config
             readOnly: true
-            mountPath: /opt/bitnami/nginx/conf/nginx.conf
+            mountPath: /etc/nginx/nginx.conf
             subPath: nginx.conf
           - name: env-config
             readOnly: true
@@ -160,27 +160,27 @@ data:
     #user              www www;  ## Default: nobody
 
     worker_processes  auto;
-    error_log         "/opt/bitnami/nginx/logs/error.log";
-    pid               "/opt/bitnami/nginx/tmp/nginx.pid";
+    error_log         "/var/log/nginx/error.log";
+    pid               "/tmp/nginx.pid";
 
     events {
         worker_connections  1024;
     }
 
     http {
-        include       mime.types;
+        include       /etc/nginx/mime.types;
         default_type  application/octet-stream;
         log_format    main '$remote_addr - $remote_user [$time_local] '
                           '"$request" $status  $body_bytes_sent "$http_referer" '
                           '"$http_user_agent" "$http_x_forwarded_for"';
-        access_log    "/opt/bitnami/nginx/logs/access.log" main;
+        access_log    "/var/log/nginx/access.log" main;
         # add_header    X-Frame-Options SAMEORIGIN;
 
-        client_body_temp_path  "/opt/bitnami/nginx/tmp/client_body" 1 2;
-        proxy_temp_path        "/opt/bitnami/nginx/tmp/proxy" 1 2;
-        fastcgi_temp_path      "/opt/bitnami/nginx/tmp/fastcgi" 1 2;
-        scgi_temp_path         "/opt/bitnami/nginx/tmp/scgi" 1 2;
-        uwsgi_temp_path        "/opt/bitnami/nginx/tmp/uwsgi" 1 2;
+        client_body_temp_path  "/tmp/client_body" 1 2;
+        proxy_temp_path        "/tmp/proxy" 1 2;
+        fastcgi_temp_path      "/tmp/fastcgi" 1 2;
+        scgi_temp_path         "/tmp/scgi" 1 2;
+        uwsgi_temp_path        "/tmp/uwsgi" 1 2;
 
         sendfile           on;
         # tcp_nopush         on;

infrastructure/prime-app-ephemeral-template.yml

@@ -143,13 +143,13 @@ objects:
             volumeMounts:
             - name: vanity-tls-certs
               readOnly: true
-              mountPath: /opt/bitnami/nginx/conf/certs
+              mountPath: /etc/nginx/certs
             - name: plr-integration-volume
               readOnly: true
-              mountPath: /opt/bitnami/nginx/conf/certs/plr
+              mountPath: /etc/nginx/certs/plr
             - name: nginx-config
               readOnly: true
-              mountPath: /opt/bitnami/nginx/conf/nginx.conf
+              mountPath: /etc/nginx/nginx.conf
               subPath: nginx.conf
             - name: env-config
               readOnly: true
@@ -218,27 +218,28 @@ objects:
       #user              www www;  ## Default: nobody
 
       worker_processes  auto;
-      error_log         "/opt/bitnami/nginx/logs/error.log";
-      pid               "/opt/bitnami/nginx/tmp/nginx.pid";
+      error_log         "/var/log/nginx/error.log";
+      error_log         "/tmp/error_fluentbit.log";
+      pid               "/tmp/nginx.pid";
 
       events {
           worker_connections  1024;
       }
 
       http {
-          include       mime.types;
+          include       /etc/nginx/mime.types;
           default_type  application/octet-stream;
           log_format    main '$remote_addr - $remote_user [$time_local] '
                             '"$request" $status  $body_bytes_sent "$http_referer" '
                             '"$http_user_agent" "$http_x_forwarded_for"';
-          access_log    "/opt/bitnami/nginx/logs/access.log" main;
+          access_log    "/var/log/nginx/access.log" main;
           # add_header    X-Frame-Options SAMEORIGIN;
 
-          client_body_temp_path  "/opt/bitnami/nginx/tmp/client_body" 1 2;
-          proxy_temp_path        "/opt/bitnami/nginx/tmp/proxy" 1 2;
-          fastcgi_temp_path      "/opt/bitnami/nginx/tmp/fastcgi" 1 2;
-          scgi_temp_path         "/opt/bitnami/nginx/tmp/scgi" 1 2;
-          uwsgi_temp_path        "/opt/bitnami/nginx/tmp/uwsgi" 1 2;
+          client_body_temp_path  "/tmp/client_body" 1 2;
+          proxy_temp_path        "/tmp/proxy" 1 2;
+          fastcgi_temp_path      "/tmp/fastcgi" 1 2;
+          scgi_temp_path         "/tmp/scgi" 1 2;
+          uwsgi_temp_path        "/tmp/uwsgi" 1 2;
 
           sendfile           on;
           # tcp_nopush         on;
@@ -419,6 +420,7 @@ objects:
           }
         }
       }
+
 
 #   Frontend Service
 - apiVersion: v1
@@ -443,7 +445,8 @@ objects:
         port: 8890
         targetPort: 8890
     selector:
-      name: ${SVC_NAME}-frontend
+      app.kubernetes.io/part-of: ${SVC_NAME} 
+      app.kubernetes.io/name: frontend
 #   Ingress
 - apiVersion: networking.k8s.io/v1
   kind: Ingress
@@ -745,7 +748,8 @@ objects:
         port: 8080
         targetPort: 8080
     selector:
-      name: ${SVC_NAME}-webapi
+      app.kubernetes.io/name: webapi
+      app.kubernetes.io/part-of: ${SVC_NAME}
 
 ###########################################
 ###      Document Manager (backend)     ###

infrastructure/prime-app-template.yml

@@ -158,13 +158,13 @@ objects:
             volumeMounts:
             - name: vanity-tls-certs
               readOnly: true
-              mountPath: /opt/bitnami/nginx/conf/certs
+              mountPath: /etc/nginx/certs/certs
             - name: plr-integration-volume
               readOnly: true
-              mountPath: /opt/bitnami/nginx/conf/certs/plr
+              mountPath: /etc/nginx/certs/plr
             - name: nginx-config
               readOnly: true
-              mountPath: /opt/bitnami/nginx/conf/nginx.conf
+              mountPath: /etc/nginx/nginx.conf
               subPath: nginx.conf
             - name: env-config
               readOnly: true
@@ -259,28 +259,28 @@ objects:
       #user              www www;  ## Default: nobody
 
       worker_processes  auto;
-      error_log         "/opt/bitnami/nginx/logs/error.log";
+      error_log         "/var/log/nginx/error.log";
       error_log         "/tmp/error_fluentbit.log";
-      pid               "/opt/bitnami/nginx/tmp/nginx.pid";
+      pid               "/tmp/nginx.pid";
 
       events {
           worker_connections  1024;
       }
 
       http {
-          include       mime.types;
+          include       /etc/nginx/mime.types;
           default_type  application/octet-stream;
           log_format    main '$remote_addr - $remote_user [$time_local] '
                             '"$request" $status  $body_bytes_sent "$http_referer" '
                             '"$http_user_agent" "$http_x_forwarded_for"';
-          access_log    "/opt/bitnami/nginx/logs/access.log" main;
+          access_log    "/var/log/nginx/access.log" main;
           # add_header    X-Frame-Options SAMEORIGIN;
 
-          client_body_temp_path  "/opt/bitnami/nginx/tmp/client_body" 1 2;
-          proxy_temp_path        "/opt/bitnami/nginx/tmp/proxy" 1 2;
-          fastcgi_temp_path      "/opt/bitnami/nginx/tmp/fastcgi" 1 2;
-          scgi_temp_path         "/opt/bitnami/nginx/tmp/scgi" 1 2;
-          uwsgi_temp_path        "/opt/bitnami/nginx/tmp/uwsgi" 1 2;
+          client_body_temp_path  "/tmp/client_body" 1 2;
+          proxy_temp_path        "/tmp/proxy" 1 2;
+          fastcgi_temp_path      "/tmp/fastcgi" 1 2;
+          scgi_temp_path         "/tmp/scgi" 1 2;
+          uwsgi_temp_path        "/tmp/uwsgi" 1 2;
 
           sendfile           on;
           # tcp_nopush         on;
@@ -882,8 +882,6 @@ objects:
           image: >-
             image-registry.openshift-image-registry.svc:5000/${OC_LICENSE_PLATE}-tools/prime-document-manager:${IMAGE_TAG}
           command:
-            # Script force waits migration pod execution until PostgreSQL is verified to
-            # be open to query connections.
             - /opt/app-root/src/app.sh
           args:
             - migrate

prime-angular-frontend/ci.dockerfile

@@ -1,4 +1,4 @@
-FROM public.ecr.aws/bitnami/nginx:1.21
+FROM nginxinc/nginx-unprivileged:1.20
 
 COPY dist/angular-frontend/browser /opt/app-root/src
 

prime-angular-frontend/openshift.dockerfile

@@ -44,7 +44,7 @@ RUN ng build --configuration=production
 ########################################
 ### Stage 2 - Production environment ###
 ########################################
-FROM public.ecr.aws/bitnami/nginx:1.20
+FROM nginxinc/nginx-unprivileged:1.20
 ARG SVC_NAME
 ENV SVC_NAME ${SVC_NAME}