Skip to content

Commit e453b12

Browse files
mstrukmstruk
authored
Update dependencies - libraries with CVEs, image versions used in examples and testsuite (#280)
Signed-off-by: Marko Strukelj <[email protected]>
1 parent 3fea88d commit e453b12

File tree

21 files changed

+119
-65
lines changed

21 files changed

+119
-65
lines changed

‎bin/build.sh

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -69,9 +69,9 @@ if [ "$arch" == 's390x' ]; then
6969
export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:/usr/lib/s390x-linux-gnu/jni
7070

7171
cd target
72-
git clone -b 23.0.5 https://github.com/keycloak/keycloak.git
72+
git clone -b 26.3.3 https://github.com/keycloak/keycloak.git
7373
cd keycloak/quarkus/container
74-
docker build . -t quay.io/keycloak/keycloak:23.0.5
74+
docker build . -t quay.io/keycloak/keycloak:26.3.3
7575
cd ../../../.. && rm -rf target/keycloak
7676

7777
docker build --target hydra-import -t strimzi-oauth-testsuite/hydra-import:latest -f ./testsuite/docker/hydra-import/Dockerfile.s390x .

‎examples/docker/kafka-oauth-strimzi/kafka/Dockerfile

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
FROM quay.io/strimzi/kafka:0.45.0-kafka-3.9.0
1+
FROM quay.io/strimzi/kafka:0.47.0-kafka-4.0.0
22

33
COPY libs/* /opt/kafka/libs/strimzi/
44
COPY config/* /opt/kafka/config/

‎examples/docker/keycloak/compose.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
services:
22

33
keycloak:
4-
image: quay.io/keycloak/keycloak:23.0.5
4+
image: quay.io/keycloak/keycloak:26.3.3
55
ports:
66
- "8080:8080"
77
- "8443:8443"

‎examples/docker/spring/Dockerfile

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
FROM registry.access.redhat.com/ubi8/openjdk-17
1+
FROM registry.access.redhat.com/ubi9/openjdk-17
22

33
ENTRYPOINT ["java", "-jar", "/usr/share/oauth/server.jar"]
44

‎examples/docker/spring/pom.xml

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@
55
<parent>
66
<groupId>org.springframework.boot</groupId>
77
<artifactId>spring-boot-starter-parent</artifactId>
8-
<version>3.4.4</version>
8+
<version>3.4.9</version>
99
<relativePath/> <!-- lookup parent from repository -->
1010
</parent>
1111

@@ -21,6 +21,15 @@
2121
<plugins.resources.version>3.1.0</plugins.resources.version>
2222
<fabric8-docker-plugin.version>0.40.2</fabric8-docker-plugin.version>
2323
</properties>
24+
<dependencyManagement>
25+
<dependencies>
26+
<dependency>
27+
<groupId>com.nimbusds</groupId>
28+
<artifactId>nimbus-jose-jwt</artifactId>
29+
<version>10.0.2</version>
30+
</dependency>
31+
</dependencies>
32+
</dependencyManagement>
2433
<dependencies>
2534
<dependency>
2635
<groupId>org.springframework.boot</groupId>

‎examples/docker/strimzi-kafka-image/Dockerfile

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
FROM quay.io/strimzi/kafka:0.45.0-kafka-3.9.0
1+
FROM quay.io/strimzi/kafka:0.47.0-kafka-4.0.0
22

33
COPY target/libs/* /opt/kafka/libs/oauth/
44
ENV CLASSPATH /opt/kafka/libs/oauth/*

‎examples/docker/strimzi-kafka-image/README.md

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,12 @@
11
Strimzi Kafka Image with SNAPSHOT Strimzi Kafka OAuth
22
=====================================================
33

4-
This is a build of a Docker image based on `quay.io/strimzi/kafka:0.45.0-kafka-3.9.0` with added most recently locally built SNAPSHOT version of Strimzi Kafka OAuth libraries.
4+
This is a build of a Docker image based on `quay.io/strimzi/kafka:0.47.0-kafka-4.0.0` with added most recently locally built SNAPSHOT version of Strimzi Kafka OAuth libraries.
55

66
This image adds a `/opt/kafka/libs/oauth` directory, and copies the latest jars for OAuth support in it.
77
Then it puts this directory as the first directory on the classpath.
88

9-
The result is that the specific version of Strimzi Kafka OAuth jars and their dependencies is used, because they appear on the classpath before the ones that are part of `quay.io/strimzi/kafka:0.45.0-kafka-3.9.0` which are located in the `/opt/kafka/libs` directory.
9+
The result is that the specific version of Strimzi Kafka OAuth jars and their dependencies is used, because they appear on the classpath before the ones that are part of `quay.io/strimzi/kafka:0.47.0-kafka-4.0.0` which are located in the `/opt/kafka/libs` directory.
1010

1111

1212
Building
@@ -79,9 +79,9 @@ Deploying
7979

8080
In order for the operator to use your Kafka image, you have to replace the Kafka image coordinates in `packaging/install/cluster-operator/060-Deployment-strimzi-cluster-operator.yaml` in your `strimzi-kafka-operator` project.
8181

82-
This image builds the kafka-3.9.0 replacement image, so we need to replace all occurrences where kafka-3.9.0 is referred to into the proper coordinates to our image:
82+
This image builds the kafka-3.9.1 replacement image, so we need to replace all occurrences where kafka-3.9.1 is referred to into the proper coordinates to our image:
8383

84-
sed -Ei "s#quay.io/strimzi/kafka:latest-kafka-3.9.0#${DOCKER_REG}/strimzi/kafka:latest-kafka-3.9.0-oauth#" \
84+
sed -Ei "s#quay.io/strimzi/kafka:latest-kafka-3.9.1#${DOCKER_REG}/strimzi/kafka:latest-kafka-3.9.1-oauth#" \
8585
packaging/install/cluster-operator/060-Deployment-strimzi-cluster-operator.yaml
8686

8787

@@ -94,11 +94,11 @@ You can now deploy Strimzi Kafka Operator following instructions in [HACKING.md]
9494

9595
## Via Helm
9696

97-
You can also run the operator via its Helm chart and set the `kafka.image.registry` property to your local registry. As an example, if you've built and tagged the image as `local.dev/strimzi/kafka:0.45.0-kafka-3.9.0`. You can run it using the operator as:
97+
You can also run the operator via its Helm chart and set the `kafka.image.registry` property to your local registry. As an example, if you've built and tagged the image as `local.dev/strimzi/kafka:0.47.0-kafka-3.9.1`. You can run it using the operator as:
9898

9999
helm repo add strimzi https://strimzi.io/charts/ --force-update
100100
helm upgrade -i -n strimzi strimzi strimzi/strimzi-kafka-operator \
101-
--version 0.45.0 \
101+
--version 0.47.0 \
102102
--set watchNamespaces="{default}" \
103103
--set generateNetworkPolicy=false \
104104
--set kafka.image.registry="local.dev" \

‎examples/kubernetes/kafka-oauth-authz-metrics-client.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -40,7 +40,7 @@ metadata:
4040
spec:
4141
containers:
4242
- name: kafka-client-shell
43-
image: quay.io/strimzi/kafka:latest-kafka-3.9.0
43+
image: quay.io/strimzi/kafka:latest-kafka-3.9.1
4444
command:
4545
- /bin/sh
4646
env:

‎examples/kubernetes/keycloak-postgres.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,7 @@ metadata:
2727
spec:
2828
containers:
2929
- name: keycloak
30-
image: quay.io/keycloak/keycloak:23.0.5
30+
image: quay.io/keycloak/keycloak:26.3.3
3131
args: ["-v", "start", "--import-realm", "--features=token-exchange,authorization,scripts"]
3232
env:
3333
- name: KEYCLOAK_ADMIN

‎oauth-common/src/test/java/io/strimzi/kafka/oauth/jsonpath/CustomCheckTest.java

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -226,4 +226,40 @@ public void testPerformance() throws Exception {
226226
System.out.printf("Ran query on %d unique tokens in %d ms :: '%s'%n", tokens.size(), System.currentTimeMillis() - time, parsedQuery);
227227
}
228228
}
229+
230+
@Ignore
231+
@Test
232+
public void testComplexQuery() throws Exception {
233+
String jsonString = "{\n" +
234+
" \"exp\" : 1756844595,\n" +
235+
" \"iat\" : 1756844295,\n" +
236+
" \"jti\" : \"trrtcc:92eb0ba2-8c4f-e829-abed-2a54a77f0020\",\n" +
237+
" \"iss\" : \"http://keycloak:8080/realms/kafka-authz\",\n" +
238+
" \"aud\" : [ \"kafka\", \"account\" ],\n" +
239+
" \"sub\" : \"7b3b2198-d44f-4786-8a2b-e896af230e2b\",\n" +
240+
" \"typ\" : \"Bearer\",\n" +
241+
" \"azp\" : \"team-b-client\",\n" +
242+
" \"acr\" : \"1\",\n" +
243+
" \"realm_access\" : {\n" +
244+
" \"roles\" : [ \"offline_access\", \"Dev Team B\" ]\n" +
245+
" },\n" +
246+
" \"resource_access\" : {\n" +
247+
" \"kafka\" : {\n" +
248+
" \"roles\" : [ \"kafka-user\" ]\n" +
249+
" },\n" +
250+
" \"account\" : {\n" +
251+
" \"roles\" : [ \"manage-account\", \"manage-account-links\", \"view-profile\" ]\n" +
252+
" }\n" +
253+
" },\n" +
254+
" \"scope\" : \"email profile\",\n" +
255+
" \"email_verified\" : false,\n" +
256+
" \"preferred_username\" : \"service-account-team-b-client\"\n" +
257+
"}\n";
258+
259+
String query = "@.typ == 'Bearer' && @.iss == 'http://keycloak:8080/realms/kafka-authz' && 'kafka' in @.aud && 'kafka-user' in @.resource_access.kafka.roles";
260+
261+
JsonNode json = JSONUtil.readJSON(jsonString, JsonNode.class);
262+
JsonPathFilterQuery q = JsonPathFilterQuery.parse(query);
263+
Assert.assertTrue(q.matches(json));
264+
}
229265
}

0 commit comments

Comments
 (0)