Skip to content

support arm for shibboleth-idp #89674

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed

Conversation

jakelandis
Copy link
Contributor

@jakelandis jakelandis commented Aug 26, 2022

Work in progress.

diff from fork: jakelandis/shibboleth-idp-dockerized@7f8b92b...master

To test on arm device

  1. update the platform (I will clean up how we build the image)
  2. ./gradlew :x-pack:qa:saml-idp-tests:javaRestTest --info

Note - I think we have some outstanding clean up issues with these running containers, so it might fail if not starting from a clean slate. Just run again (or manually clean up the running docker instances).

Also note ... building from a linux base image instead of the upstream image i forked since we will eventually want to update/upgrade and the upstream image appears to no longer be getting updates.


task buildShibbolethImage(type: Exec) {
workingDir "shibboleth-idp"
commandLine 'docker', 'buildx', 'build', '-t', 'elastic/shibboleth-idp:test', '.', '--platform', 'linux/amd64' //change to linux/arm64v8 to test
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

change here to test arm

@mark-vieira
Copy link
Contributor

This worked for me after a changed a couple of things:

  1. First I had to pass linux/arm64/v8 as the --platform
  2. I had to change the condition on TARGETARCH to check for arm64 instead of arm64v8.

I think we don't actually have to worry about (1). Passing --platform should actually only be necessary when overriding the default, which is to use the host platform. Second, I think we might have to change the TARGETARCH stuff anyway, as that is coming from buildx and I don't think we want to rely on that. As I mentioned before, we don't have to worry about multi-arch images here, we'll just build for the host platform and by default, Docker already handles this transparently. The only thing we need to handle explicitly is downloading any architecture-specific binaries within the Dockerfile, which in our case is just the JDK. That said, we could simplify that even further by just using a base image with a JDK already installed, like one of the official openjdk images, which are already multi-arch. That way we don't deal with architecture at all, and when the image is built locally, it automatically targest the host architecture.

@jakelandis
Copy link
Contributor Author

Thanks Mark ! These pointers make sense and will work on adopting these.

@jakelandis
Copy link
Contributor Author

superseded by: #91216

@jakelandis jakelandis closed this Oct 31, 2022
jakelandis added a commit that referenced this pull request Nov 3, 2022
We currently use unicon/shibboleth-idp:3.4.2 to help test our SAML integration.
That container is no longer actively supported and does not support
ARM architectures.

This commit is a partial clone from Unicon/shibboleth-idp-dockerized 3.4.3.

Changes from upstream include:

    Use openjdk:11.0.16-jre as the base image for support for ARM architectures
    Handle missing keystore download from Jetty
    Fix URL paths for artifacts to download

Changes to this repository include:

    Copied required Jetty configuration files from upstream project
    Updates to docker compose
    Placed the missing keystore Jetty downloads in a separate location (jetty-custom)

The final result is a bit messy. Mixing cloned files with custom files and mixing
Jetty and IDP concerns. However, it is not much messier than prior and now
that we control building the image we can more easily upgrade shibboleth IDP
The upgrade to the latest version is fairly involved and as such we will need to
deviate more from the clone which should allow some additional clean up.

part of: #71378
related: #91144
supersedes: #89674
jakelandis added a commit to jakelandis/elasticsearch that referenced this pull request Nov 3, 2022
We currently use unicon/shibboleth-idp:3.4.2 to help test our SAML integration.
That container is no longer actively supported and does not support
ARM architectures.

This commit is a partial clone from Unicon/shibboleth-idp-dockerized 3.4.3.

Changes from upstream include:

    Use openjdk:11.0.16-jre as the base image for support for ARM architectures
    Handle missing keystore download from Jetty
    Fix URL paths for artifacts to download

Changes to this repository include:

    Copied required Jetty configuration files from upstream project
    Updates to docker compose
    Placed the missing keystore Jetty downloads in a separate location (jetty-custom)

The final result is a bit messy. Mixing cloned files with custom files and mixing
Jetty and IDP concerns. However, it is not much messier than prior and now
that we control building the image we can more easily upgrade shibboleth IDP
The upgrade to the latest version is fairly involved and as such we will need to
deviate more from the clone which should allow some additional clean up.

part of: elastic#71378
related: elastic#91144
supersedes: elastic#89674
elasticsearchmachine pushed a commit that referenced this pull request Nov 3, 2022
We currently use unicon/shibboleth-idp:3.4.2 to help test our SAML integration.
That container is no longer actively supported and does not support
ARM architectures.

This commit is a partial clone from Unicon/shibboleth-idp-dockerized 3.4.3.

Changes from upstream include:

    Use openjdk:11.0.16-jre as the base image for support for ARM architectures
    Handle missing keystore download from Jetty
    Fix URL paths for artifacts to download

Changes to this repository include:

    Copied required Jetty configuration files from upstream project
    Updates to docker compose
    Placed the missing keystore Jetty downloads in a separate location (jetty-custom)

The final result is a bit messy. Mixing cloned files with custom files and mixing
Jetty and IDP concerns. However, it is not much messier than prior and now
that we control building the image we can more easily upgrade shibboleth IDP
The upgrade to the latest version is fairly involved and as such we will need to
deviate more from the clone which should allow some additional clean up.

part of: #71378
related: #91144
supersedes: #89674
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants