Spring/spring-boot
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Add support for security options in CNB builder container config

Browse Source 
Closes gh-37479
This commit is contained in:
Scott Frederick
2023-09-20 13:30:20 -05:00
parent 4433fcd1f2
commit 7de770f6a1
15 changed files with 273 additions and 21 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
spring-boot-project/spring-boot-tools/spring-boot-maven-plugin/src/docs/asciidoc/packaging-oci-image.adoc
View File

@@ -230,6 +230,10 @@ The value must be a string in the ISO 8601 instant format, or `now` to use the c
Application contents will also be in this location in the generated image.
| `/workspace`
| `securityOptions`
| https://docs.docker.com/engine/reference/run/#security-configuration[Security options] that will be applied to the builder container, provided as an array of string values
| `["label=disable"]`
|===
NOTE: The plugin detects the target Java compatibility of the project using the compiler's plugin configuration or the `maven.compiler.target` property.

15
spring-boot-project/spring-boot-tools/spring-boot-maven-plugin/src/intTest/java/org/springframework/boot/maven/BuildImageTests.java
View File

@@ -480,6 +480,21 @@ class BuildImageTests extends AbstractArchiveIntegrationTests {
});
}
@TestTemplate
void whenBuildImageIsInvokedWithEmptySecurityOptions(MavenBuild mavenBuild) {
String testBuildId = randomString();
mavenBuild.project("build-image-security-opts")
.goals("package")
.systemProperty("spring-boot.build-image.pullPolicy", "IF_NOT_PRESENT")
.systemProperty("test-build-id", testBuildId)
.execute((project) -> {
assertThat(buildLog(project)).contains("Building image")
.contains("docker.io/library/build-image-security-opts:0.0.1.BUILD-SNAPSHOT")
.contains("Successfully built image");
removeImage("build-image-security-opts", "0.0.1.BUILD-SNAPSHOT");
});
}
@TestTemplate
void failsWhenBuildImageIsInvokedOnMultiModuleProjectWithBuildImageGoal(MavenBuild mavenBuild) {
mavenBuild.project("build-image-multi-module")

35
spring-boot-project/spring-boot-tools/spring-boot-maven-plugin/src/intTest/projects/build-image-security-opts/pom.xml Normal file
View File

@@ -0,0 +1,35 @@
<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
<modelVersion>4.0.0</modelVersion>
<groupId>org.springframework.boot.maven.it</groupId>
<artifactId>build-image-security-opts</artifactId>
<version>0.0.1.BUILD-SNAPSHOT</version>
<properties>
<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
<maven.compiler.source>@java.version@</maven.compiler.source>
<maven.compiler.target>@java.version@</maven.compiler.target>
</properties>
<build>
<plugins>
<plugin>
<groupId>@project.groupId@</groupId>
<artifactId>@project.artifactId@</artifactId>
<version>@project.version@</version>
<executions>
<execution>
<goals>
<goal>build-image-no-fork</goal>
</goals>
<configuration>
<image>
<builder>projects.registry.vmware.com/springboot/spring-boot-cnb-builder:0.0.2</builder>
<security-options/>
</image>
</configuration>
</execution>
</executions>
</plugin>
</plugins>
</build>
</project>

28
spring-boot-project/spring-boot-tools/spring-boot-maven-plugin/src/intTest/projects/build-image-security-opts/src/main/java/org/test/SampleApplication.java Normal file
View File

@@ -0,0 +1,28 @@
/*
* Copyright 2012-2023 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* https://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.test;
public class SampleApplication {
public static void main(String[] args) throws Exception {
System.out.println("Launched");
synchronized(args) {
args.wait(); // Prevent exit"
}
}
}

5
spring-boot-project/spring-boot-tools/spring-boot-maven-plugin/src/main/java/org/springframework/boot/maven/Image.java
View File

@@ -79,6 +79,8 @@ public class Image {
String applicationDirectory;
List<String> securityOptions;
/**
* The name of the created image.
* @return the image name
@@ -260,6 +262,9 @@ public class Image {
if (StringUtils.hasText(this.applicationDirectory)) {
request = request.withApplicationDirectory(this.applicationDirectory);
}
if (this.securityOptions != null) {
request = request.withSecurityOptions(this.securityOptions);
}
return request;
}

17
spring-boot-project/spring-boot-tools/spring-boot-maven-plugin/src/test/java/org/springframework/boot/maven/ImageTests.java
View File

@@ -18,6 +18,7 @@ package org.springframework.boot.maven;
import java.util.Arrays;
import java.util.Collections;
import java.util.List;
import java.util.function.Function;
import org.apache.maven.artifact.Artifact;
@@ -234,6 +235,22 @@ class ImageTests {
assertThat(request.getApplicationDirectory()).isEqualTo("/application");
}
@Test
void getBuildRequestWhenHasSecurityOptionsUsesSecurityOptions() {
Image image = new Image();
image.securityOptions = List.of("label=user:USER", "label=role:ROLE");
BuildRequest request = image.getBuildRequest(createArtifact(), mockApplicationContent());
assertThat(request.getSecurityOptions()).containsExactly("label=user:USER", "label=role:ROLE");
}
@Test
void getBuildRequestWhenHasEmptySecurityOptionsUsesSecurityOptions() {
Image image = new Image();
image.securityOptions = Collections.emptyList();
BuildRequest request = image.getBuildRequest(createArtifact(), mockApplicationContent());
assertThat(request.getSecurityOptions()).isEmpty();
}
private Artifact createArtifact() {
return new DefaultArtifact("com.example", "my-app", VersionRange.createFromVersion("0.0.1-SNAPSHOT"), "compile",
"jar", null, new DefaultArtifactHandler());