From 2eb282d577206fc83c88c489c23fbd43979dde06 Mon Sep 17 00:00:00 2001
From: Yuxiang Zhu <yuxzhu@redhat.com>
Date: Mar 22 2019 06:52:05 +0000
Subject: Update OpenShift Dockerfile to conform C3I


1. Install app from source without building RPM to make it easier to build an image on OpenShift.
2. Install dependencies from official Fedora repo rather than PyPI
to comply Fedora policies.
3. Bump up Fedora version to 29.

---

diff --git a/conf/resultsdb.conf b/conf/resultsdb.conf
index 5bce8fe..3b283f5 100644
--- a/conf/resultsdb.conf
+++ b/conf/resultsdb.conf
@@ -8,6 +8,7 @@ WSGISocketPrefix run/wsgi
     WSGIScriptReloading On
     Order deny,allow
     Allow from all
+    Require all granted
 </Directory>
 
 #Alias /resultsdb/static /var/www/resultsdb/resultsdb/static
@@ -15,4 +16,5 @@ WSGISocketPrefix run/wsgi
 #<Directory /var/www/resultsdb/resultsdb/static>
 #Order allow,deny
 #Allow from all
+#Require all granted
 #</Directory>
diff --git a/conf/settings.py.example b/conf/settings.py.example
index f633a7d..216b6f4 100644
--- a/conf/settings.py.example
+++ b/conf/settings.py.example
@@ -44,6 +44,7 @@ AUTH_MODULE = None
 
 # OIDC Configuration
 OIDC_ADMINS = []
+import os
 OIDC_CLIENT_SECRETS = os.getcwd() + '/conf/oauth2_client_secrets.json'
 OIDC_AUD = 'My-Client-ID'
 OIDC_SCOPE = 'https://pagure.io/taskotron/resultsdb/access'
diff --git a/openshift/Dockerfile b/openshift/Dockerfile
index cd5eddc..953271c 100644
--- a/openshift/Dockerfile
+++ b/openshift/Dockerfile
@@ -1,10 +1,9 @@
 # This will produce an image to be used in Openshift
 # Build should be triggered from repo root like:
 # docker build -f openshift/Dockerfile \
-#              --tag <IMAGE_TAG> \
-#              --build-arg resultsdb_rpm=<RESULTSDB_RPM> ./
+#              --tag <IMAGE_TAG>
 
-FROM fedora:28
+FROM registry.fedoraproject.org/f29/httpd:latest
 LABEL \
     name="ResultsDB application" \
     vendor="ResultsDB developers" \
@@ -13,24 +12,33 @@ LABEL \
     usage="https://pagure.io/taskotron/resultsdb/blob/develop/f/openshift/README.md" \
     build-date=""
 
-# The caller should build a resultsdb RPM package used and then pass it in this arg.
-# Accept both a URL or a local path relative to the build context.
-ARG resultsdb_rpm
-ADD $resultsdb_rpm /tmp
+USER root
+COPY ./resultsdb.spec /opt/app-root/src/resultsdb/resultsdb.spec
 
-RUN dnf -y update \
-    && dnf -y install --setopt=tsflags=nodocs \
-        python-psycopg2 \
-        httpd \
-        mod_wsgi \
-        /tmp/$(basename $resultsdb_rpm) \
-    && dnf clean all \
-    && rm -f /tmp/$(basename $resultsdb_rpm)
+# install dependencies defined in RPM spec file
+RUN dnf -y install findutils rpm-build python3-pip python3-mod_wsgi python3-psycopg2 \
+    && rpm --query --requires --specfile ./resultsdb/resultsdb.spec | xargs -d '\n' dnf -y install
 
-EXPOSE 5001/tcp
-VOLUME ["/etc/resultsdb", "/etc/httpd/conf.d"]
-ENTRYPOINT ["mod_wsgi-express", "start-server", "/usr/share/resultsdb/resultsdb.wsgi"]
-CMD [\
+COPY . /opt/app-root/src/resultsdb/
+# install using --no-deps option to ensure nothing comes from PyPi
+RUN pip3 install --no-deps ./resultsdb
+
+# config files
+RUN install -d /usr/share/resultsdb/conf \
+    && install -p -m 0644 ./resultsdb/conf/resultsdb.conf /usr/share/resultsdb/conf/ \
+    && install -p -m 0644 ./resultsdb/conf/resultsdb.wsgi /usr/share/resultsdb/ \
+    && install -d /etc/resultsdb \
+    && install -p -m 0644 ./resultsdb/conf/settings.py.example /etc/resultsdb/settings.py \
+    && install -p -m 0644 ./resultsdb/conf/resultsdb.conf /etc/httpd/conf.d/
+
+# clean up
+RUN rm -rf /opt/app-root/src/resultsdb \
+    && dnf -y autoremove findutils rpm-build \
+    && dnf clean all
+
+# EXPOSE 5001/tcp
+EXPOSE 5001
+CMD ["mod_wsgi-express-3", "start-server", "/usr/share/resultsdb/resultsdb.wsgi", \
     "--user", "apache", "--group", "apache", \
     "--port", "5001", "--threads", "5", \
     "--include-file", "/etc/httpd/conf.d/resultsdb.conf", \
@@ -39,3 +47,4 @@ CMD [\
     "--access-log", \
     "--startup-log" \
 ]
+USER 1001:0
diff --git a/openshift/README.md b/openshift/README.md
index 6819eab..cfc0516 100644
--- a/openshift/README.md
+++ b/openshift/README.md
@@ -6,16 +6,11 @@ build argument:
 
 ```bash
 $ docker build -f openshift/Dockerfile \
-               --tag <IMAGE_TAG> \
-               --build-arg resultsdb_rpm=<RESULTSDB_RPM> ./
+               --tag <IMAGE_TAG>
 ```
 
 `IMAGE_TAG` is the tag to be applied on the image built.
 
-`RESULTSDB_RPM` is either the URL of the ResultsDB rpm, or the relative path of
-that rpm *within* the build context.
-
-
 Using the container image
 =========================