From 6d50b7abb88bb255916ef38d4ff7d4ce267f2037 Mon Sep 17 00:00:00 2001 From: Bitnami Bot Date: Thu, 9 Apr 2026 00:32:13 +0200 Subject: [PATCH] [bitnami/zookeeper] Release 3.9.5-debian-12-r2 (#92328) Signed-off-by: Bitnami Bot --- bitnami/zookeeper/3.9/debian-12/Dockerfile | 6 +- .../opt/bitnami/scripts/libzookeeper.sh | 55 +++++++++++++++---- bitnami/zookeeper/README.md | 21 +------ 3 files changed, 50 insertions(+), 32 deletions(-) diff --git a/bitnami/zookeeper/3.9/debian-12/Dockerfile b/bitnami/zookeeper/3.9/debian-12/Dockerfile index 49d166b538fd..cf019e91ff72 100644 --- a/bitnami/zookeeper/3.9/debian-12/Dockerfile +++ b/bitnami/zookeeper/3.9/debian-12/Dockerfile @@ -7,7 +7,7 @@ ARG DOWNLOADS_URL="downloads.bitnami.com/files/stacksmith" ARG TARGETARCH LABEL org.opencontainers.image.base.name="docker.io/bitnami/minideb:bookworm" \ - org.opencontainers.image.created="2026-03-12T16:51:53Z" \ + org.opencontainers.image.created="2026-04-08T22:18:22Z" \ org.opencontainers.image.description="Application packaged by Broadcom, Inc." \ org.opencontainers.image.documentation="https://github.com/bitnami/containers/tree/main/bitnami/zookeeper/README.md" \ org.opencontainers.image.source="https://github.com/bitnami/containers/tree/main/bitnami/zookeeper" \ @@ -29,7 +29,7 @@ RUN --mount=type=secret,id=downloads_url,env=SECRET_DOWNLOADS_URL \ DOWNLOADS_URL=${SECRET_DOWNLOADS_URL:-${DOWNLOADS_URL}} ; \ mkdir -p /tmp/bitnami/pkg/cache/ ; cd /tmp/bitnami/pkg/cache/ || exit 1 ; \ COMPONENTS=( \ - "wait-for-port-1.0.10-8-linux-${OS_ARCH}-debian-12" \ + "wait-for-port-1.0.10-9-linux-${OS_ARCH}-debian-12" \ "jre-11.0.30-9-1-linux-${OS_ARCH}-debian-12" \ "zookeeper-3.9.5-0-linux-${OS_ARCH}-debian-12" \ ) ; \ @@ -53,7 +53,7 @@ COPY rootfs / RUN /opt/bitnami/scripts/zookeeper/postunpack.sh ENV APP_VERSION="3.9.5" \ BITNAMI_APP_NAME="zookeeper" \ - IMAGE_REVISION="1" + IMAGE_REVISION="2" EXPOSE 2181 2888 3888 8080 diff --git a/bitnami/zookeeper/3.9/debian-12/rootfs/opt/bitnami/scripts/libzookeeper.sh b/bitnami/zookeeper/3.9/debian-12/rootfs/opt/bitnami/scripts/libzookeeper.sh index f2caf03a0bab..4bd380b9a209 100644 --- a/bitnami/zookeeper/3.9/debian-12/rootfs/opt/bitnami/scripts/libzookeeper.sh +++ b/bitnami/zookeeper/3.9/debian-12/rootfs/opt/bitnami/scripts/libzookeeper.sh @@ -601,17 +601,52 @@ zookeeper_healthcheck() { local port="$ZOO_PORT_NUMBER" if [[ "$ZOO_TLS_CLIENT_ENABLE" = true ]]; then - port="$ZOO_TLS_PORT_NUMBER" - command="openssl" - args+=("s_client" "-quiet" "-crlf" "-connect" "localhost:${port}") + if [[ "$JAVA_FIPS_MODE" = "restricted" ]]; then + # In FIPS-restricted mode OpenSSL only allows FIPS-approved algorithms and + # the legacy provider is completely disabled. Any keystore that uses RC2, + # 3DES, or a SHA-1 MAC (common in Java-generated PKCS12 and BCFKS) cannot + # be parsed by openssl pkcs12. + # Primary: use the admin HTTP server (no keystore interaction required). + # Fallback: nc on the plain clientPort (ZOO_PORT_NUMBER), which ZooKeeper + # keeps open alongside the TLS secureClientPort. + local admin_url="http://127.0.0.1:${ZOO_ADMIN_SERVER_PORT_NUMBER}/commands/ruok" + debug "Running healthcheck via admin server (FIPS mode): 'curl -sf --max-time ${ZOO_HC_TIMEOUT} ${admin_url}'" + local curl_output="" + local curl_exit_code=0 + curl_output=$(curl -sf --max-time "$ZOO_HC_TIMEOUT" "$admin_url") || curl_exit_code=$? + if [[ $curl_exit_code -eq 0 ]]; then + debug "Admin server response: ${curl_output}" + response="imok" + else + # Admin server is not available. Fall back to the plain clientPort + # (ZOO_PORT_NUMBER). Even when TLS is enabled, Bitnami's zoo.cfg always + # sets both clientPort and secureClientPort, so ZooKeeper keeps a + # plain-text listener on ZOO_PORT_NUMBER alongside the TLS one. Using + # nc avoids any keystore interaction. + warn "Admin server not reachable (exit code ${curl_exit_code}, url ${admin_url}); falling back to plain port ${ZOO_PORT_NUMBER}." + local nc_args=("-w" "$ZOO_HC_TIMEOUT" "127.0.0.1" "$ZOO_PORT_NUMBER") + if nc -help 2>&1 | grep -q "\[-q seconds\]"; then + nc_args=("-q" "1" "${nc_args[@]}") + fi + debug "Running healthcheck command (FIPS fallback): 'echo \"ruok\" | timeout ${ZOO_HC_TIMEOUT} nc ${nc_args[*]}'" + response=$(echo "ruok" | timeout "$ZOO_HC_TIMEOUT" nc "${nc_args[@]}" 2>/dev/null) + if [[ ! "$response" =~ "imok" ]]; then + error "Plain port fallback also failed (response: '${response}'). Ensure ZOO_PORT_NUMBER=${ZOO_PORT_NUMBER} is reachable or enable the admin server with ZOO_ENABLE_ADMIN_SERVER=yes." + fi + fi + else + port="$ZOO_TLS_PORT_NUMBER" + command="openssl" + args+=("s_client" "-quiet" "-crlf" "-connect" "localhost:${port}") - debug "Running healthcheck command: 'echo \"ruok\" | timeout ${ZOO_HC_TIMEOUT} ${command} ${args[*]} \ - -key <(openssl pkcs12 -in ${ZOO_TLS_CLIENT_KEYSTORE_FILE} -nodes -nocerts -passin pass:\$ZOO_TLS_CLIENT_KEYSTORE_PASSWORD) \ - -cert <(openssl pkcs12 -in ${ZOO_TLS_CLIENT_KEYSTORE_FILE} -nodes -nokeys -passin pass:\$ZOO_TLS_CLIENT_KEYSTORE_PASSWORD)'" - response=$(echo "ruok" | timeout "$ZOO_HC_TIMEOUT" "$command" "${args[@]}" \ - -key <(openssl pkcs12 -in "$ZOO_TLS_CLIENT_KEYSTORE_FILE" -nodes -nocerts -passin pass:"$ZOO_TLS_CLIENT_KEYSTORE_PASSWORD") \ - -cert <(openssl pkcs12 -in "$ZOO_TLS_CLIENT_KEYSTORE_FILE" -nodes -nokeys -passin pass:"$ZOO_TLS_CLIENT_KEYSTORE_PASSWORD") 2> /dev/null - ) + debug "Running healthcheck command: 'echo \"ruok\" | timeout ${ZOO_HC_TIMEOUT} ${command} ${args[*]} \ + -key <(openssl pkcs12 -in ${ZOO_TLS_CLIENT_KEYSTORE_FILE} -nodes -nocerts -passin pass:\$ZOO_TLS_CLIENT_KEYSTORE_PASSWORD) \ + -cert <(openssl pkcs12 -in ${ZOO_TLS_CLIENT_KEYSTORE_FILE} -nodes -nokeys -passin pass:\$ZOO_TLS_CLIENT_KEYSTORE_PASSWORD)'" + response=$(echo "ruok" | timeout "$ZOO_HC_TIMEOUT" "$command" "${args[@]}" \ + -key <(openssl pkcs12 -in "$ZOO_TLS_CLIENT_KEYSTORE_FILE" -nodes -nocerts -passin pass:"$ZOO_TLS_CLIENT_KEYSTORE_PASSWORD") \ + -cert <(openssl pkcs12 -in "$ZOO_TLS_CLIENT_KEYSTORE_FILE" -nodes -nokeys -passin pass:"$ZOO_TLS_CLIENT_KEYSTORE_PASSWORD") 2> /dev/null + ) + fi else command="nc" # Only add flag '-q' if OpenBSD netcat is used diff --git a/bitnami/zookeeper/README.md b/bitnami/zookeeper/README.md index 5239cd18d5c7..bcf3edfa5c5e 100644 --- a/bitnami/zookeeper/README.md +++ b/bitnami/zookeeper/README.md @@ -46,25 +46,7 @@ Subscribe to project updates by watching the [bitnami/containers GitHub reposito ## Get this image -The recommended way to get the Bitnami Apache ZooKeeper Docker Image is to pull the prebuilt image from the [Docker Hub Registry](https://hub.docker.com/r/bitnami/zookeeper). - -```console -docker pull bitnami/zookeeper:latest -``` - -To use a specific version, you can pull a versioned tag. You can view the [list of available versions](https://hub.docker.com/r/bitnami/zookeeper/tags/) in the Docker Hub Registry. - -```console -docker pull bitnami/zookeeper:[TAG] -``` - -If you wish, you can also build the image yourself by cloning the repository, changing to the directory containing the Dockerfile and executing the `docker build` command. Remember to replace the `APP`, `VERSION` and `OPERATING-SYSTEM` path placeholders in the example command below with the correct values. - -```console -git clone https://github.com/bitnami/containers.git -cd bitnami/APP/VERSION/OPERATING-SYSTEM -docker build -t bitnami/APP:latest . -``` +The Bitnami Apache ZooKeeper Docker image is only available to [Bitnami Secure Images](https://bitnami.com) customers. ## Using `docker-compose.yaml` @@ -241,6 +223,7 @@ You have to use 0.0.0.0 as the host for the server. More concretely, if the ID o The Bitnami Apache ZooKeeper Docker image from the [Bitnami Secure Images](https://go-vmware.broadcom.com/contact-us) catalog includes extra features and settings to configure the container with FIPS capabilities. You can configure the next environment variables: - `OPENSSL_FIPS`: whether OpenSSL runs in FIPS mode or not. `yes` (default), `no`. +- `JAVA_TOOL_OPTIONS`: controls Java FIPS mode. Use `-Djava.security.properties==/opt/bitnami/java/conf/security/java.security.restricted` (restricted), `-Djava.security.properties==/opt/bitnami/java/conf/security/java.security.relaxed` (relaxed), or `-Djava.security.properties==/opt/bitnami/java/conf/security/java.security.original` (off). ## Logging