kube-auth-proxy/Dockerfile.redhat at main · opendatahub-io/kube-auth-proxy · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
# Dockerfile.redhat - FIPS-compliant build for Red Hat environments
# TARGETPLATFORM is automatically set by docker buildx and must be declared before FROM
ARG TARGETPLATFORM

# Argument for setting the oauth2-proxy build version
ARG VERSION

# For FIPS builds with CGO, we must build on the native target platform
# because cross-compilation with CGO requires cross-compiler toolchains
# which are not readily available in the UBI base images.
FROM --platform=${TARGETPLATFORM} registry.access.redhat.com/ubi9/go-toolset:1.26 AS builder

# Switch to root for build permissions
USER root

# Copy sources
WORKDIR /workspace

# Fetch dependencies for main application
COPY go.mod go.sum ./
RUN go mod download

# Now pull in our code
COPY . .

# Re-declare TARGETPLATFORM and VERSION for use in RUN commands
# (ARGs before FROM need to be re-declared to be available in build stages)
ARG TARGETPLATFORM
ARG VERSION

# Build FIPS-compliant binaries and make sure there is at least an empty key file.
#  This is useful for GCP App Engine custom runtime builds, because
#  you cannot use multiline variables in their app.yaml, so you have to
#  build the key into the container and then tell it where it is
#  by setting OAUTH2_PROXY_JWT_KEY_FILE=/etc/ssl/private/jwt_signing_key.pem
#  in app.yaml instead.
# Set the cross compilation arguments based on the TARGETPLATFORM which is
#  automatically set by the docker engine.
RUN case ${TARGETPLATFORM} in \
         "linux/amd64")  GOARCH=amd64  ;; \
         # arm64 and arm64v8 are equivalent in go and do not require a goarm
         # https://github.com/golang/go/wiki/GoArm
         "linux/arm64" | "linux/arm/v8")  GOARCH=arm64  ;; \
         "linux/ppc64le")  GOARCH=ppc64le  ;; \
         "linux/s390x")  GOARCH=s390x  ;; \
    esac && \
    printf "Building FIPS-compliant kube-auth-proxy for arch ${GOARCH}\n" && \
    CGO_ENABLED=1 GOOS=linux GOARCH=${GOARCH} GOEXPERIMENT=strictfipsruntime \
    go build -a -tags strictfipsruntime \
    -ldflags="-X github.com/opendatahub-io/kube-auth-proxy/v1/pkg/version.VERSION=${VERSION}" \
    -o kube-auth-proxy github.com/opendatahub-io/kube-auth-proxy/v1 && \
    touch jwt_signing_key.pem

# Copy binary to FIPS-compliant runtime image
FROM --platform=${TARGETPLATFORM} registry.access.redhat.com/ubi9/ubi-minimal:latest
# Reload version
ARG VERSION

WORKDIR /
COPY --from=builder /workspace/kube-auth-proxy /bin/kube-auth-proxy
COPY --chown=1001:0 --from=builder /workspace/jwt_signing_key.pem /etc/ssl/private/jwt_signing_key.pem

# Copy license files
RUN mkdir -p /licenses
COPY --from=builder /workspace/LICENSE /licenses/LICENSE.kube-auth-proxy.txt

# Set proper permissions for non-root execution
RUN chown -R 1001:0 /etc/ssl/private && \
    chmod -R g=u /etc/ssl/private && \
    chown 1001:0 /bin/kube-auth-proxy && \
    chmod 755 /bin/kube-auth-proxy && \
    chown -R 1001:0 /licenses && \
    chmod -R 644 /licenses/*

USER 1001

LABEL org.opencontainers.image.licenses=MIT \
      org.opencontainers.image.description="A reverse proxy that provides authentication with OpenID Connect and Openshift OAuth. (FIPS-compliant)" \
      org.opencontainers.image.documentation=https://github.com/opendatahub-io/kube-auth-proxy \
      org.opencontainers.image.source=https://github.com/opendatahub-io/kube-auth-proxy \
      org.opencontainers.image.url=https://quay.io/opendatahub/kube-auth-proxy \
      org.opencontainers.image.title=kube-auth-proxy \
      org.opencontainers.image.version=${VERSION}

ENTRYPOINT ["/bin/kube-auth-proxy"]