Operator version 3.1.0

Dockerfile

@@ -23,8 +23,8 @@ ENV LANG en_US.UTF-8
 ENV JAVA_HOME /usr/local/java
 ENV PATH /operator:$JAVA_HOME/bin:$PATH
 
-ENV JAVA_VERSION 14.0.2
-ENV JAVA_URL https://download.java.net/java/GA/jdk14.0.2/205943a0976c4ed48cb16f1043c5c647/12/GPL/openjdk-14.0.2_linux-x64_bin.tar.gz
+ENV JAVA_VERSION 15
+ENV JAVA_URL https://download.java.net/java/GA/jdk15/779bf45e88a44cbd9ea6621d33e33db1/36/GPL/openjdk-15_linux-x64_bin.tar.gz
 
 # Install Java and make the operator run with a non-root user id (1000 is the `oracle` user)
 RUN set -eux; \
@@ -43,17 +43,17 @@ RUN set -eux; \
         alternatives --install "/usr/bin/$base" "$base" "$bin" 20000; \
     done; \
     java -Xshare:dump; \
-    groupadd -g 1000 oracle; \
-    useradd -d /operator -M -s /bin/bash -g 1000 -u 1000 oracle; \
-    mkdir -p /operator/lib; \
-    mkdir /logs; \
-    chown -R 1000:1000 /operator /logs
+    useradd -d /operator -M -s /bin/bash -g root -u 1000 oracle; \
+    mkdir -m 775 /operator; \
+    mkdir -m 775 /logs; \
+    mkdir /operator/lib; \
+    chown -R oracle:root /operator /logs
 
-USER 1000
+USER oracle
 
-COPY src/scripts/* /operator/
-COPY operator/target/weblogic-kubernetes-operator.jar /operator/weblogic-kubernetes-operator.jar
-COPY operator/target/lib/*.jar /operator/lib/
+COPY --chown=oracle:root src/scripts/* /operator/
+COPY --chown=oracle:root operator/target/weblogic-kubernetes-operator.jar /operator/weblogic-kubernetes-operator.jar
+COPY --chown=oracle:root operator/target/lib/*.jar /operator/lib/
 
 HEALTHCHECK --interval=1m --timeout=10s \
   CMD /operator/livenessProbe.sh

README.md

@@ -17,8 +17,8 @@ Oracle is finding ways for organizations using WebLogic Server to run important
 The fastest way to experience the operator is to follow the [Quick Start guide](https://oracle.github.io/weblogic-kubernetes-operator/quickstart/), or you can peruse our [documentation](https://oracle.github.io/weblogic-kubernetes-operator), read our [blogs](https://blogs.oracle.com/weblogicserver/updated-weblogic-kubernetes-support-with-operator-20), or try out the [samples](https://oracle.github.io/weblogic-kubernetes-operator/samples/).
 
 ***
-The [current release of the operator](https://github.com/oracle/weblogic-kubernetes-operator/releases) is 3.0.3.
-This release was published on November 9, 2020.
+The [current release of the operator](https://github.com/oracle/weblogic-kubernetes-operator/releases) is 3.1.0.
+This release was published on November 13, 2020.
 ***
 
 # Documentation

SECURITY.md

@@ -0,0 +1,18 @@
+# Reporting Security Vulnerabilities
+
+Oracle values the independent security research community and believes that responsible disclosure of security vulnerabilities helps us ensure the security and privacy of all our users.
+
+Please do NOT raise a GitHub Issue to report a security vulnerability. If you believe you have found a security vulnerability, please submit a report to secalert_us@oracle.com preferably with a proof of concept. We provide additional information on [how to report security vulnerabilities to Oracle](https://www.oracle.com/corporate/security-practices/assurance/vulnerability/reporting.html) which includes public encryption keys for secure email.
+
+We ask that you do not use other channels or contact project contributors directly. 
+
+Non-vulnerability related security issues such as new great new ideas for security features are welcome on GitHub Issues. 
+
+## Security Updates, Alerts and Bulletins
+
+Security updates will be released on a regular cadence. Many of our projects will typically release security fixes in conjunction with the [Oracle Critical Patch Update](https://www.oracle.com/security-alerts/) program. Security updates are released on the Tuesday closest to the 17th day of January, April, July and October. A pre-release announcement will be published on the Thursday preceding each release. Additional information, including past advisories, is available on our [Security Alerts](https://www.oracle.com/security-alerts/) page.
+
+## Security-Related Information
+
+We will provide security related information such as a threat model, considerations for secure use, or any known security issues in our documentation. Please note that labs and sample code are intended to demonstrate a concept and may not be sufficiently hardened for production use.
+

buildDockerImage.sh

@@ -33,7 +33,7 @@ while getopts "t:" optname; do
   esac
 done
 
-IMAGE_NAME=${name:-oracle/weblogic-kubernetes-operator:3.0.3}
+IMAGE_NAME=${name:-oracle/weblogic-kubernetes-operator:3.1.0}
 SCRIPTPATH="$( cd "$(dirname "$0")" > /dev/null 2>&1 ; pwd -P )"
 
 # Proxy settings

buildtime-reports/pom.xml

@@ -8,7 +8,7 @@
     <parent>
         <artifactId>operator-parent</artifactId>
         <groupId>oracle.kubernetes</groupId>
-        <version>3.0.3</version>
+        <version>3.1.0</version>
     </parent>
 
     <artifactId>buildtime-reports</artifactId>
@@ -60,14 +60,9 @@
         </dependency>
         <dependency>
             <groupId>${project.groupId}</groupId>
-            <artifactId>operator-integration-tests</artifactId>
-            <version>${project.version}</version>
-        </dependency>
-        <dependency>
-            <groupId>${project.groupId}</groupId>
-            <artifactId>new-integration-tests</artifactId>
+            <artifactId>integration-tests</artifactId>
             <version>${project.version}</version>
         </dependency>
     </dependencies>
 
-</project>
+</project>

docs-source/content/_index.md

@@ -23,8 +23,8 @@ using the operator to deploy and run a WebLogic domain container-packaged web ap
 ***
 #### Current production release
 
-The [current release of the operator](https://github.com/oracle/weblogic-kubernetes-operator/releases) is 3.0.3.
-This release was published on November 9, 2020. See the operator prerequisites and supported environments [here]({{< relref "/userguide/introduction/introduction#operator-prerequisites" >}}).
+The [current release of the operator](https://github.com/oracle/weblogic-kubernetes-operator/releases) is 3.1.0.
+This release was published on November 13, 2020. See the operator prerequisites and supported environments [here]({{< relref "/userguide/introduction/introduction#operator-prerequisites" >}}).
 
 ***
 

docs-source/content/faq/namespace-management.md

@@ -6,11 +6,11 @@ weight: 1
 description: "Considerations for managing namespaces while the operator is running."
 ---
 
-Each operator deployment manages a number of Kubernetes Namespaces. For more information, see [Operator Helm configuration values]({{< relref "/userguide/managing-operators/using-the-operator/using-helm#operator-helm-configuration-values" >}}). A number of Kubernetes resources
-must be present in a namespace before any WebLogic domain custom resources can be successfully
-deployed into it.
+Each operator deployment manages a number of Kubernetes namespaces. For more information, see [Operator Helm configuration values]({{< relref "/userguide/managing-operators/using-the-operator/using-helm#operator-helm-configuration-values" >}}). A number of Kubernetes resources
+must be present in a namespace before any WebLogic Server instances can be successfully
+started.
 Those Kubernetes resources are created either as part of the installation
-of the operator's Helm chart, or created by the operator at runtime.
+of a release of the operator's Helm chart, or created by the operator.
 
 This FAQ describes some considerations to be aware of when you manage the namespaces while the operator is running. For example:
 
@@ -22,12 +22,15 @@ This FAQ describes some considerations to be aware of when you manage the namesp
 For others, see [Common Mistakes and Solutions]({{< relref "/userguide/managing-operators/using-the-operator/using-helm#common-mistakes-and-solutions" >}}).
 
 {{% notice note %}}
-There can be multiple operators in a Kubernetes cluster, and in that case, you must ensure that their respective lists of `domainNamespaces` do not overlap.
+There can be multiple operators in a Kubernetes cluster, and in that case, you must ensure that the namespaces managed by these operators do not overlap.
 {{% /notice %}}
 
 #### Check the namespaces that the operator manages
-You can find the list of the namespaces that the operator manages using the `helm get values` command.
-For example, the following command shows all the values of the operator release `weblogic-operator`; the `domainNamespaces` list contains `default` and `ns1`.
+Prior to version 3.1.0, the operator supported specifying the namespaces that it would manage only through a list.
+Now, the operator supports a list of namespaces, a label selector, or a regular expression matching namespace names.
+
+For operators that specify namespaces by a list, you can find the list of the namespaces using the `helm get values` command.
+For example, the following command shows all the values of the operator release `weblogic-operator`; the `domainNamespaces` list contains `default` and `ns1`:
 
 ```
 $ helm get values weblogic-operator
@@ -40,7 +43,8 @@ elkIntegrationEnabled: false
 externalDebugHttpPort: 30999
 externalRestEnabled: false
 externalRestHttpsPort: 31001
-image: oracle/weblogic-kubernetes-operator:3.0.3
+image: oracle/weblogic-kubernetes-operator:3.1.0
+>>>>>>> origin/master
 imagePullPolicy: IfNotPresent
 internalDebugHttpPort: 30999
 istioEnabled: false
@@ -49,7 +53,19 @@ logStashImage: logstash:6.6.0
 remoteDebugNodePortEnabled: false
 serviceAccount: default
 suspendOnDebugStartup: false
+```
+
+For operators that select namespaces with a selector, simply list namespaces using that selector:
+
+```
+$ kubectl get ns --selector="weblogic-operator=enabled"
+```
+
+For operators that select namespaces with a regular expression matching the name, you can use a combination of `kubectl`
+and any command-line tool that can process the regular expression, such as `grep`:
 
+```
+$ kubectl get ns -o go-template='{{range .items}}{{.metadata.name}}{{"\n"}}{{end}}' | grep "^weblogic"
 ```
 
 If you don't know the release name of the operator, you can use `helm list` to list all the releases for a specified namespace or all namespaces:
@@ -59,30 +75,25 @@ $ helm list --namespace <namespace>
 $ helm list --all-namespaces
 ```
 
-#### Add a Kubernetes Namespace to the operator
-If you want an operator deployment to manage a namespace, you need to add the namespace to the operator's `domainNamespaces` list. Note that the namespace has to already exist, for example, using the `kubectl create` command.
+#### Add a Kubernetes namespace to the operator
+When the operator is configured to manage a list of namespaces and you want the operator to manage an additional namespace,
+you need to add the namespace to the operator's `domainNamespaces` list. Note that this namespace has to already exist, for example,
+using the `kubectl create` command.
 
-Adding a namespace to the `domainNamespaces` list tells the operator deployment or runtime
-to initialize the necessary Kubernetes resources for the namespace so that the operator is ready to run and monitor WebLogic Server instances in that namespace.
+Adding a namespace to the `domainNamespaces` list tells the operator to initialize the necessary
+Kubernetes resources so that the operator is ready to manage WebLogic Server instances in that namespace.
 
-When the operator is running and managing the `default` namespace, the following example Helm command adds the namespace `ns1` to the `domainNamespaces` list, where `weblogic-operator` is the release name of the operator, and `kubernetes/charts/weblogic-operator` is the location of the operator's Helm charts.
+When the operator is managing the `default` namespace, the following example Helm command adds the namespace `ns1` to the `domainNamespaces` list, where `weblogic-operator` is the release name of the operator, and `kubernetes/charts/weblogic-operator` is the location of the operator's Helm charts:
 
 ```
 $ helm upgrade \
+  weblogic-operator \
+  kubernetes/charts/weblogic-operator \
   --reuse-values \
   --set "domainNamespaces={default,ns1}" \
-  --wait \
-  --force \
-  weblogic-operator \
-  kubernetes/charts/weblogic-operator
+  --wait
 ```
 
-{{% notice note %}}
-Changes to the `domainNamespaces` list might not be picked up by the operator right away because the operator
-monitors the changes to the setting periodically. The operator becomes ready to manage Domains in
-a namespace only after the required `configmap` (namely `weblogic-scripts-cm`) is initialized in the namespace.
-{{% /notice %}}
-
 You can verify that the operator has initialized a namespace by confirming the existence of the required `configmap` resource.
 
 ```
@@ -99,14 +110,28 @@ NAME                 DATA      AGE
 weblogic-scripts-cm   14        12m
 ```
 
-####  Delete a Kubernetes Namespace from the operator
-When you no longer want a namespace to be managed by the operator, you need to remove it from
-the operator's `domainNamespaces` list, so that the corresponding Kubernetes resources that are
+For operators configured to select managed namespaces through the use of a label selector or regular expression,
+you simply need to create a namespace with the appropriate labels or with a name that matches the expression, respectively.
+
+If you did not choose to enable the value, `enableClusterRoleBinding`, then the operator will not have the necessary
+permissions to manage the namespace. You can do this by performing a `helm upgrade` with the values used when installing the 
+Helm release:
+
+```
+$ helm upgrade \
+  weblogic-operator \
+  kubernetes/charts/weblogic-operator \
+  --reuse-values
+```
+
+####  Delete a Kubernetes namespace from the operator
+When the operator is configured to manage a list of namespaces and you no longer want a namespace to be managed by the operator, you need to remove it from
+the operator's `domainNamespaces` list, so that the resources that are
 associated with the namespace can be cleaned up.
 
 While the operator is running and managing the `default` and `ns1` namespaces, the following example Helm
 command removes the namespace `ns1` from the `domainNamespaces` list, where `weblogic-operator` is the release
-name of the operator, and `kubernetes/charts/weblogic-operator` is the location of the operator Helm charts.
+name of the operator, and `kubernetes/charts/weblogic-operator` is the location of the operator Helm charts:
 
 ```
 $ helm upgrade \
@@ -116,24 +141,19 @@ $ helm upgrade \
   --force \
   weblogic-operator \
   kubernetes/charts/weblogic-operator
-
 ```
 
-#### Recreate a previously deleted Kubernetes Namespace
+For operators configured to select managed namespaces through the use of a label selector or regular expression,
+you simply need to delete the namespace. For the label selector option, you can also adjust the labels on the namespace
+so that the namespace no longer matches the selector.
+
+#### Recreate a previously deleted Kubernetes namespace
 
-If you need to delete a namespace (and the resources in it) and then recreate it,
+When the operator is configured to manage a list of namespaces and if you need to delete a namespace (and the resources in it) and then recreate it,
 remember to remove the namespace from the operator's `domainNamespaces` list
 after you delete the namespace, and add it back to the `domainNamespaces` list after you recreate the namespace
 using the `helm upgrade` commands that were illustrated previously.
 
-{{% notice note %}}
-Make sure that you wait a sufficient period of time between deleting and recreating the
-namespace because it takes time for the resources in a namespace to go away after the namespace is deleted.
-In addition, as mentioned above, changes to the `domainNamespaces` setting is monitored by the operator
-periodically, and the operator becomes ready to manage Domains only after the required domain
-`configmap` (namely `weblogic-scripts-cm`) is initialized in the namespace.
-{{% /notice %}}
-
 If a domain custom resource is created before the namespace is ready, you might see that the introspector job pod
 fails to start, with a warning like the following, when you review the description of the introspector pod.
 Note that `domain1` is the name of the domain in the following example output.
@@ -142,7 +162,7 @@ Note that `domain1` is the name of the domain in the following example output.
 Events:
   Type     Reason                 Age               From               Message
   ----     ------                 ----              ----               -------
-  Normal   Scheduled              1m                default-scheduler  Successfully assigned domain1-introspect-domain-job-bz6rw to slc16ffk
+  Normal   Scheduled              1m                default-scheduler  Successfully assigned domain1-introspector-bz6rw to slc16ffk
 
   Normal   SuccessfulMountVolume  1m                kubelet, slc16ffk  MountVolume.SetUp succeeded for volume "weblogic-credentials-volume"
 

docs-source/content/faq/oci-fss-pv.md

@@ -53,7 +53,7 @@ Init Containers:
     Command:
       sh
       -c
-      chown -R 1000:1000 /shared
+      chown -R 1000:0 /shared
     State:          Terminated
       Reason:       Error
       Exit Code:    1
@@ -85,7 +85,7 @@ spec:
       initContainers:
         - name: fix-pvc-owner
           image: %WEBLOGIC_IMAGE%
-          command: ["sh", "-c", "chown 1000:1000 %DOMAIN_ROOT_DIR%/. && find %DOMAIN_ROOT_DIR%/. -maxdepth 1 ! -name '.snapshot' ! -name '.' -print0 | xargs -r -0 chown -R 1000:1000"]
+          command: ["sh", "-c", "chown 1000:0 %DOMAIN_ROOT_DIR%/. && find %DOMAIN_ROOT_DIR%/. -maxdepth 1 ! -name '.snapshot' ! -name '.' -print0 | xargs -r -0 chown -R 1000:0"]
           volumeMounts:
           - name: weblogic-sample-domain-storage-volume
             mountPath: %DOMAIN_ROOT_DIR%

docs-source/content/faq/oci-lb.md

@@ -79,7 +79,7 @@ but initially the external IP is shown as `<pending>`.
 $ kubectl -n bob get svc
 NAME                                   TYPE           CLUSTER-IP      EXTERNAL-IP   PORT(S)                       AGE
 bobs-bookstore-admin-server            ClusterIP      None            <none>        8888/TCP,7001/TCP,30101/TCP   9d
-bobs-bookstore-admin-server-external   NodePort       10.96.224.13    <none>        7001:32401/TCP                9d
+bobs-bookstore-admin-server-ext        NodePort       10.96.224.13    <none>        7001:32401/TCP                9d
 bobs-bookstore-cluster-cluster-1       ClusterIP      10.96.86.113    <none>        8888/TCP,8001/TCP,31111/TCP   9d
 bobs-bookstore-managed-server1         ClusterIP      None            <none>        8888/TCP,8001/TCP,31111/TCP   9d
 bobs-bookstore-managed-server2         ClusterIP      None            <none>        8888/TCP,8001/TCP,31111/TCP   9d
@@ -93,7 +93,7 @@ external IP address will be displayed:
 $ kubectl -n bob get svc
 NAME                                   TYPE           CLUSTER-IP      EXTERNAL-IP       PORT(S)                       AGE
 bobs-bookstore-admin-server            ClusterIP      None            <none>            8888/TCP,7001/TCP,30101/TCP   9d
-bobs-bookstore-admin-server-external   NodePort       10.96.224.13    <none>            7001:32401/TCP                9d
+bobs-bookstore-admin-server-ext        NodePort       10.96.224.13    <none>            7001:32401/TCP                9d
 bobs-bookstore-cluster-cluster-1       ClusterIP      10.96.86.113    <none>            8888/TCP,8001/TCP,31111/TCP   9d
 bobs-bookstore-managed-server1         ClusterIP      None            <none>            8888/TCP,8001/TCP,31111/TCP   9d
 bobs-bookstore-managed-server2         ClusterIP      None            <none>            8888/TCP,8001/TCP,31111/TCP   9d