diff --git a/.github/workflows/kb_beta_release.yml b/.github/workflows/kb_beta_release.yml new file mode 100644 index 00000000..6a2650b3 --- /dev/null +++ b/.github/workflows/kb_beta_release.yml @@ -0,0 +1,70 @@ +name: kb_beta_release + +# Publishes a single, explicitly-pinned killbill/killbill: docker image for beta / release-candidate versions +# (e.g. 0.25.1), without touching KAUI and `latest` tag (hence named "beta" release: it only ever publishes an +# explicit, pinned version tag and never promotes/updates `latest`). +# +# Unlike release.yml, this workflow does not reuse the already-published killbill/base:latest or +# killbill/killbill:latest images as parents, and it does not publish any intermediate killbill/base:beta-* image to +# Docker Hub either. Instead, it uses a single dedicated, self-contained multi-stage Dockerfile +# (docker/templates/killbill/beta/Dockerfile.template, stages: base -> shell -> final) so that: +# - branch-local changes (e.g. a Tomcat/JDK bump on a branch such as java2x) are actually baked into the resulting +# image, instead of silently falling back to whatever is currently published under :latest on Docker Hub, and +# - no intermediate image is ever published publicly - only the final killbill/killbill: tag is pushed. +# +# Ansible/ansible-galaxy note: the base stage still installs Tomcat/Java/KPM via this repo's own ansible roles +# (same as release.yml), to keep user/group/permissions/ACL setup identical to a normal release image rather than +# hand-rolling it differently here. +# +# IMPORTANT - killbill-cloud git ref used for the ansible roles: the base stage fetches the ansible roles fresh from +# GitHub via `ansible-galaxy install git+...,` - it does NOT use this workflow run's own checkout for that. Rather +# than a separate input, this workflow uses ${{ github.ref_name }}, i.e. whatever branch you pick in the +# "Use workflow from" selector above. +# +# Concretely: if you pick "java2x" there, make sure your ansible/Dockerfile changes on java2x are already committed +# AND pushed to origin/java2x before running this. Uncommitted or unpushed local changes will NOT be picked up, since +# the clone happens fresh from GitHub. +on: + workflow_dispatch: + inputs: + killbill_version: + description: 'Kill Bill version to release (must already be published to Maven Central, e.g. 0.25.1)' + required: true + nexus_repository: + description: 'Nexus repository for KPM' + required: true + default: 'maven2' + +jobs: + docker: + name: Publish killbill/killbill beta/RC image + runs-on: ubuntu-latest + steps: + - name: Checkout code + uses: actions/checkout@v7 + - name: Set up QEMU + uses: docker/setup-qemu-action@v4 + - name: Set up Docker Buildx + uses: docker/setup-buildx-action@v4 + - name: Login to Docker Hub + uses: docker/login-action@v4 + with: + username: ${{ secrets.DOCKERHUB_USERNAME }} + password: ${{ secrets.DOCKERHUB_TOKEN }} + + # Bake the pinned Kill Bill version into the Dockerfile (same __VERSION__ substitution dockerTemplate.sh does for + # docker/templates/killbill/tagged/Dockerfile.template), then build+push the final stage only. + # The `base` and `shell` (See "stage" in the template) intermediate stages are never pushed. They exist purely + # inside this one buildx invocation's build graph. + - name: Build and push killbill beta/RC image + run: | + cd docker/templates/killbill + sed -e "s/__VERSION__/${{ github.event.inputs.killbill_version }}/" beta/Dockerfile.template > beta/Dockerfile + sed -e "s/__VERSION__/${{ github.event.inputs.killbill_version }}/" tagged/kpm.yml.template > tagged/kpm.yml + docker buildx build --push --platform=linux/arm64,linux/amd64 --no-cache \ + --target final \ + -t killbill/killbill:${{ github.event.inputs.killbill_version }} \ + -f beta/Dockerfile \ + --build-arg KILLBILL_CLOUD_REF=${{ github.ref_name }} \ + --build-arg NEXUS_REPOSITORY=${{ github.event.inputs.nexus_repository }} \ + . diff --git a/ansible/roles/tomcat/tasks/install.yml b/ansible/roles/tomcat/tasks/install.yml index dd617ec1..f9a71bf8 100644 --- a/ansible/roles/tomcat/tasks/install.yml +++ b/ansible/roles/tomcat/tasks/install.yml @@ -38,14 +38,14 @@ # We don't use the xml module to avoid a dependency on lxml - name: Set tomcat_version ansible.builtin.set_fact: - tomcat_version: "{{ tomcat_metadata.content | regex_findall('(9.0.*)', '\\1') | last }}" + tomcat_version: "{{ tomcat_metadata.content | regex_findall('(11.0.*)', '\\1') | last }}" when: tomcat_version is undefined tags: install - name: Install Tomcat become: true ansible.builtin.unarchive: - src: "http://archive.apache.org/dist/tomcat/tomcat-9/v{{ tomcat_version }}/bin/apache-tomcat-{{ tomcat_version }}.tar.gz" + src: "http://archive.apache.org/dist/tomcat/tomcat-11/v{{ tomcat_version }}/bin/apache-tomcat-{{ tomcat_version }}.tar.gz" remote_src: true dest: "{{ tomcat_install_dir }}" owner: "{{ tomcat_owner }}" diff --git a/ansible/roles/tomcat/tasks/main.yml b/ansible/roles/tomcat/tasks/main.yml index 984a05b5..2aa8f12c 100644 --- a/ansible/roles/tomcat/tasks/main.yml +++ b/ansible/roles/tomcat/tasks/main.yml @@ -27,8 +27,9 @@ mode: "{{ item.mode }}" owner: "{{ tomcat_owner }}" group: "{{ tomcat_group }}" - # If the files already exist, don't clobber them - force: false + # Preserve existing user-managed files, except setenv.sh: its JVM + # hostname must be refreshed when the inventory/configuration changes. + force: "{{ item.force | default(false) }}" with_items: - src: tomcat/conf name: context.xml @@ -42,6 +43,7 @@ name: setenv.sh mode: u=rwx,g=rx,o=rx dest: "{{ catalina_base }}/bin" + force: true - src: tomcat/conf name: web.xml mode: u=rw,g=r,o=r diff --git a/ansible/roles/tomcat/tasks/native.yml b/ansible/roles/tomcat/tasks/native.yml index 48639f0b..340684e5 100644 --- a/ansible/roles/tomcat/tasks/native.yml +++ b/ansible/roles/tomcat/tasks/native.yml @@ -93,7 +93,6 @@ - --prefix={{ catalina_home }} - --with-apr={{ tomcat_apr_config_path }} - --with-java-home={{ java_home }} - - --with-ssl=yes chdir: "{{ tomcat_workspace.path }}/native" changed_when: false tags: native diff --git a/ansible/templates/tomcat/conf/web.xml.j2 b/ansible/templates/tomcat/conf/web.xml.j2 index c851684d..ea6bc6d0 100644 --- a/ansible/templates/tomcat/conf/web.xml.j2 +++ b/ansible/templates/tomcat/conf/web.xml.j2 @@ -1,9 +1,9 @@ - + xsi:schemaLocation="https://jakarta.ee/xml/ns/jakartaee + https://jakarta.ee/xml/ns/jakartaee/web-app_6_1.xsd" + version="6.1"> default diff --git a/docker/README.adoc b/docker/README.adoc index dfab12d7..5b205c1e 100644 --- a/docker/README.adoc +++ b/docker/README.adoc @@ -10,7 +10,7 @@ toc::[] [[available-images]] ## Available images -* `killbill/base:latest`: Shared base image with Tomcat and KPM inside Ubuntu 20.04 LTS. It also contains Ansible and our playbooks from https://github.com/killbill/killbill-cloud. It starts Tomcat on startup. +* `killbill/base:latest`: Shared base image with Tomcat and KPM inside Ubuntu 24.04 LTS. It also contains Ansible and our playbooks from https://github.com/killbill/killbill-cloud. It starts Tomcat on startup. * `killbill/killbill:latest`: Empty base Kill Bill image. Includes the `killbill-flyway` utility. It runs `kpm install` on startup. If no custom `kpm.yml` file is specified, the latest version of Kill Bill is downloaded. * `killbill/killbill:0.X.Y`: Image with a specific version of Kill Bill installed. * `killbill/kaui:latest`: Empty base Kaui image. It runs `kpm install` on startup. If no custom `kpm.yml` file is specified, the latest version of Kaui is downloaded. diff --git a/docker/templates/base/latest/Dockerfile b/docker/templates/base/latest/Dockerfile index f7061da9..4d230a3f 100644 --- a/docker/templates/base/latest/Dockerfile +++ b/docker/templates/base/latest/Dockerfile @@ -11,6 +11,7 @@ ENV PYTHONIOENCODING=utf8 # https://github.com/moby/moby/issues/4032 ARG DEBIAN_FRONTEND=noninteractive RUN apt-get update && \ + apt-get upgrade -y && \ apt-get install --no-install-recommends -y \ ansible \ # https://github.com/tianon/docker-brew-ubuntu-core/issues/59 @@ -23,7 +24,7 @@ RUN apt-get update && \ libapr1 \ mysql-client \ net-tools \ - openjdk-11-jdk-headless \ + openjdk-21-jdk-headless \ python3-lxml \ sudo \ unzip \ @@ -32,7 +33,7 @@ RUN apt-get update && \ rm -rf /var/lib/apt/lists/* # Configure default JAVA_HOME path -RUN ln -s java-11-openjdk-$(dpkg --print-architecture) /usr/lib/jvm/default-java +RUN ln -s java-21-openjdk-$(dpkg --print-architecture) /usr/lib/jvm/default-java ENV JAVA_HOME=/usr/lib/jvm/default-java ENV JSSE_HOME=$JAVA_HOME/jre/ diff --git a/docker/templates/build/Dockerfile b/docker/templates/build/Dockerfile index 30904388..e1825560 100644 --- a/docker/templates/build/Dockerfile +++ b/docker/templates/build/Dockerfile @@ -1,4 +1,4 @@ -FROM ubuntu:20.04 +FROM ubuntu:24.04 LABEL maintainer="killbilling-users@googlegroups.com" USER root