Skip to content

SRE-4027 build: provide ZSCALER_CA_FILE arg for local docker builds #19045

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
soumagne wants to merge 1 commit into
base: master
Choose a base branch
from
+44 −1
Open

SRE-4027 build: provide ZSCALER_CA_FILE arg for local docker builds #19045

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions utils/docker/Dockerfile.el.9
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,6 +31,7 @@ ARG REPO_FILE_URL
ARG JENKINS_URL
ARG REPOS
ARG DAOS_LAB_CA_FILE_URL
ARG ZSCALER_CA_FILE

@JohnMalmberg JohnMalmberg Sep 10, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Do not make this type of change, it is not going to help you at all long term.

All access to the dockerfiles has to come from Artifactory.
If you are running your own docker host, in the lab you need to have it setup to use:
hub.daos.hpc.amslabs.hpecorp.net or it will not work reliably.

Docker is blocking most access from the corporate proxy from anonymous users. We have setup the CI docker builders to pull from alternative sources because of this and we use a trick to make it look like it is using images from the dockerhub.

Any use of HTTPS_PROXY to avoid using the internal Artifact Servers is a bug, that needs to be removed.

@soumagne soumagne Sep 10, 2026

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Just to be clear, this is not something I want to use in CI builds. I only want to use that option for my local docker builds on my laptop.

@JohnMalmberg JohnMalmberg Sep 10, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Then install the ZSCALER CA on laptop on what ever is running docker. It does not need to be in the dockerfile.

I have updated the ticket for this with how to access the internal docker hub.

@JohnMalmberg JohnMalmberg Sep 10, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I understand more of what you are trying to do now, I think.

Now when you are doing this build on your laptop, are you using any lab resources at all?

If you are not using lab resources than you use:

DAOS_LAB_CA_FILE_URl to pass your zscaler cert contents.

And then the repo-helper scripts can see of DAOS_LAB_CA_FILE_URI starts with HTTP:// or HTTPS:// and then install the CA accordingly.

If you are using LAB resources like Artifactory, then you should be able to get what you need without the Zscaler CA.

@soumagne soumagne Sep 10, 2026 •
edited
Loading

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That's right, I'm not using any of the lab resources in this case. I think I can try doing what you just proposed with DAOS_LAB_CA_FILE_URI.
Zscaler intercepts all HTTP traffic on HPE laptops so afaik there is no other solution than installing the Zscaler certificate, this is further described in https://docs.docker.com/guides/zscaler/


# Accept DAOS_HTTP_PROXY, DAOS_HTTPS_PROXY, and DAOS_NO_PROXY at build time
ARG DAOS_HTTP_PROXY
Expand Down
4 changes: 4 additions & 0 deletions utils/docker/Dockerfile.leap.15
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,6 +31,7 @@ ARG REPO_FILE_URL
ARG JENKINS_URL
ARG REPOS
ARG DAOS_LAB_CA_FILE_URL
ARG ZSCALER_CA_FILE

# Accept DAOS_HTTP_PROXY, DAOS_HTTPS_PROXY, and DAOS_NO_PROXY at build time
ARG DAOS_HTTP_PROXY
Expand Down Expand Up @@ -242,6 +243,9 @@ RUN --mount=type=bind,source=VERSION,target=/home/daos/daos/VERSION \
--mount=type=bind,source=src,target=/tmp/daos-src \
[ "$DAOS_BUILD" != "yes" ] || { \
export GOCACHE=/tmp/go-cache && \
source /etc/profile.d/lmod.sh && \
export MODULEPATH=/usr/share/modules:$MODULEPATH && \
module load gnu-openmpi && \
mkdir -p /home/daos/daos/src && \
cp -r /tmp/daos-src/. /home/daos/daos/src && \
scons --jobs $JOBS install PREFIX=/opt/daos COMPILER=$COMPILER \
Expand Down
1 change: 1 addition & 0 deletions utils/docker/Dockerfile.ubuntu
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,6 +22,7 @@ ENV DEBIAN_FRONTEND=noninteractive

# Install basic tools
ARG DAOS_LAB_CA_FILE_URL
ARG ZSCALER_CA_FILE

# Accept DAOS_NO_PROXY at build time
ARG DAOS_NO_PROXY
Expand Down
12 changes: 12 additions & 0 deletions utils/scripts/helpers/repo-helper-el9.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,6 +17,7 @@ set -uex
: "${JENKINS_URL:=}"
: "${REPOS:=}"
: "${DAOS_LAB_CA_FILE_URL:=}"
: "${ZSCALER_CA_FILE:=}"
: "${REPOSITORY_NAME:=artifactory}"

# shellcheck disable=SC2120
Expand Down Expand Up @@ -56,6 +57,17 @@ install_optional_ca() {
fi
}

install_zscaler_ca() {
ca_storage="/etc/pki/ca-trust/source/anchors/"
if [ -n "$ZSCALER_CA_FILE" ]; then
echo "$ZSCALER_CA_FILE" >> "${ca_storage}ZscalerRootCertificate-2048-SHA256.crt"
update-ca-trust
fi
}

# Install Zscaler CA if provided
install_zscaler_ca

# installs/upgrades of epel-release add repos
# Disable mirrorlist check when using local repos.
DISTRO="rocky"
Expand Down
12 changes: 12 additions & 0 deletions utils/scripts/helpers/repo-helper-leap15.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,6 +17,7 @@ set -uex
: "${JENKINS_URL:=}"
: "${REPOS:=}"
: "${DAOS_LAB_CA_FILE_URL:=}"
: "${ZSCALER_CA_FILE:=}"
: "${REPOSITORY_NAME:=artifactory}"

# shellcheck disable=SC2120
Expand Down Expand Up @@ -82,6 +83,17 @@ install_optional_ca() {
fi
}

install_zscaler_ca() {
ca_storage="/etc/pki/trust/anchors/"
if [ -n "$ZSCALER_CA_FILE" ]; then
echo "$ZSCALER_CA_FILE" >> "${ca_storage}ZscalerRootCertificate-2048-SHA256.crt"
update-ca-certificates
fi
}

# Install Zscaler CA if provided
install_zscaler_ca

# Use local repo server if present
# if a local repo server is present and the distro repo server can not
# be reached, have to bootstrap in an environment to get curl installed
Expand Down
14 changes: 13 additions & 1 deletion utils/scripts/helpers/repo-helper-ubuntu.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,8 @@ set -uex

: "${REPO_FILE_URL:=}"
: "${HTTPS_PROXY:=}"
: "${DAOS_LAB_CA_FILE_UR:=}"
: "${DAOS_LAB_CA_FILE_URL:=}"
: "${ZSCALER_CA_FILE:=}"
: "${REPOSITORY_NAME:=artifactory}"
: "${BASE_DISTRO:=24.04}"

Expand Down Expand Up @@ -58,6 +59,14 @@ install_optional_ca() {
fi
}

install_zscaler_ca() {
ca_storage="/etc/pki/ca-trust/source/anchors/"
if [ -n "$ZSCALER_CA_FILE" ]; then
echo "$ZSCALER_CA_FILE" >> "${ca_storage}ZscalerRootCertificate-2048-SHA256.crt"
update-ca-trust
fi
}

echo "APT::Get::Assume-Yes \"true\";" > /etc/apt/apt.conf.d/no-prompt
echo "APT::Install-Recommends \"false\";" > /etc/apt/apt.conf.d/no-recommends
if [ -n "$HTTPS_PROXY" ];then
Expand All @@ -72,6 +81,9 @@ if [ -n "$HTTPS_PROXY" ];then
fi
fi

# Install Zscaler CA if provided
install_zscaler_ca

# These need to be installed here until we can figure out how to
# get them installed from a local repository.
apt-get update
Expand Down
1 change: 1 addition & 0 deletions utils/scripts/install-leap15.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -67,6 +67,7 @@ dnf --nodocs install ${dnf_install_args} \
patch \
patchelf \
pciutils-devel \
procps \
python${PYTHON_VERSION//./}-devel \
rpm-build \
scons \
Expand Down
Loading