diff --git a/bitnami/zookeeper/3.9/debian-12/Dockerfile b/bitnami/zookeeper/3.9/debian-12/Dockerfile index 1d148f3b9656..244d7df141f3 100644 --- a/bitnami/zookeeper/3.9/debian-12/Dockerfile +++ b/bitnami/zookeeper/3.9/debian-12/Dockerfile @@ -7,7 +7,7 @@ ARG DOWNLOADS_URL="downloads.bitnami.com/files/stacksmith" ARG TARGETARCH LABEL org.opencontainers.image.base.name="docker.io/bitnami/minideb:bookworm" \ - org.opencontainers.image.created="2026-05-23T12:25:09Z" \ + org.opencontainers.image.created="2026-06-03T03:52:27Z" \ org.opencontainers.image.description="Application packaged by Broadcom, Inc." \ org.opencontainers.image.documentation="https://github.com/bitnami/containers/tree/main/bitnami/zookeeper/README.md" \ org.opencontainers.image.source="https://github.com/bitnami/containers/tree/main/bitnami/zookeeper" \ @@ -29,19 +29,19 @@ RUN --mount=type=secret,id=downloads_url,env=SECRET_DOWNLOADS_URL \ DOWNLOADS_URL=${SECRET_DOWNLOADS_URL:-${DOWNLOADS_URL}} ; \ mkdir -p /tmp/bitnami/pkg/cache/ ; cd /tmp/bitnami/pkg/cache/ || exit 1 ; \ COMPONENTS=( \ - "wait-for-port-1.0.10-10-linux-${OS_ARCH}-debian-12" \ + "wait-for-port-1.0.10-11-linux-${OS_ARCH}-debian-12" \ "jre-11.0.31-11-1-linux-${OS_ARCH}-debian-12" \ "zookeeper-3.9.5-0-linux-${OS_ARCH}-debian-12" \ ) ; \ for COMPONENT in "${COMPONENTS[@]}"; do \ if [ ! -f "${COMPONENT}.tar.gz" ]; then \ curl -SsLf "https://${DOWNLOADS_URL}/${COMPONENT}.tar.gz" -O ; \ - curl -SsLf "https://${DOWNLOADS_URL}/${COMPONENT}.tar.gz.sha256" -O ; \ fi ; \ - sha256sum -c "${COMPONENT}.tar.gz.sha256" ; \ + sha256sum -c "/opt/bitnami/checksums/${COMPONENT}.tar.gz.sha256" ; \ tar -zxf "${COMPONENT}.tar.gz" -C /opt/bitnami --strip-components=2 --no-same-owner ; \ - rm -rf "${COMPONENT}".tar.gz{,.sha256} ; \ - done + rm -rf "${COMPONENT}".tar.gz ; \ + done ; \ + rm -rf /opt/bitnami/checksums ; RUN apt-get update && apt-get upgrade -y && \ apt-get clean && rm -rf /var/lib/apt/lists /var/cache/apt/archives RUN chmod g+rwX /opt/bitnami @@ -53,7 +53,7 @@ COPY rootfs / RUN /opt/bitnami/scripts/zookeeper/postunpack.sh ENV APP_VERSION="3.9.5" \ BITNAMI_APP_NAME="zookeeper" \ - IMAGE_REVISION="7" + IMAGE_REVISION="8" EXPOSE 2181 2888 3888 8080 diff --git a/bitnami/zookeeper/3.9/debian-12/docker-compose.yml b/bitnami/zookeeper/3.9/debian-12/docker-compose.yml index bd78f6c250b7..1be133e1f42f 100644 --- a/bitnami/zookeeper/3.9/debian-12/docker-compose.yml +++ b/bitnami/zookeeper/3.9/debian-12/docker-compose.yml @@ -9,7 +9,7 @@ services: volumes: - 'zookeeper_data:/bitnami/zookeeper' environment: - - ALLOW_ANONYMOUS_LOGIN=yes + - ALLOW_EMPTY_PASSWORD=yes volumes: zookeeper_data: diff --git a/bitnami/zookeeper/3.9/debian-12/prebuildfs/opt/bitnami/checksums/jre-11.0.31-11-1-linux-amd64-debian-12.tar.gz.sha256 b/bitnami/zookeeper/3.9/debian-12/prebuildfs/opt/bitnami/checksums/jre-11.0.31-11-1-linux-amd64-debian-12.tar.gz.sha256 new file mode 100644 index 000000000000..99ade2098d69 --- /dev/null +++ b/bitnami/zookeeper/3.9/debian-12/prebuildfs/opt/bitnami/checksums/jre-11.0.31-11-1-linux-amd64-debian-12.tar.gz.sha256 @@ -0,0 +1 @@ +f57e392ddf7e3026a3fe3df1f7b790b815c161f8a024b8c1e0f90d2b0519f0d2 jre-11.0.31-11-1-linux-amd64-debian-12.tar.gz diff --git a/bitnami/zookeeper/3.9/debian-12/prebuildfs/opt/bitnami/checksums/jre-11.0.31-11-1-linux-arm64-debian-12.tar.gz.sha256 b/bitnami/zookeeper/3.9/debian-12/prebuildfs/opt/bitnami/checksums/jre-11.0.31-11-1-linux-arm64-debian-12.tar.gz.sha256 new file mode 100644 index 000000000000..581914b7041f --- /dev/null +++ b/bitnami/zookeeper/3.9/debian-12/prebuildfs/opt/bitnami/checksums/jre-11.0.31-11-1-linux-arm64-debian-12.tar.gz.sha256 @@ -0,0 +1 @@ +9c3f321524f50f03055d9406bd72d60e31e31b5ae9a910272e525ec9dcf1f0d1 jre-11.0.31-11-1-linux-arm64-debian-12.tar.gz diff --git a/bitnami/zookeeper/3.9/debian-12/prebuildfs/opt/bitnami/checksums/wait-for-port-1.0.10-11-linux-amd64-debian-12.tar.gz.sha256 b/bitnami/zookeeper/3.9/debian-12/prebuildfs/opt/bitnami/checksums/wait-for-port-1.0.10-11-linux-amd64-debian-12.tar.gz.sha256 new file mode 100644 index 000000000000..ab86dab7c5d1 --- /dev/null +++ b/bitnami/zookeeper/3.9/debian-12/prebuildfs/opt/bitnami/checksums/wait-for-port-1.0.10-11-linux-amd64-debian-12.tar.gz.sha256 @@ -0,0 +1 @@ +b8a9cd842e95ae16de5bbf157cc7e246c79a24d3b5b626bcce32f6904a895383 wait-for-port-1.0.10-11-linux-amd64-debian-12.tar.gz diff --git a/bitnami/zookeeper/3.9/debian-12/prebuildfs/opt/bitnami/checksums/wait-for-port-1.0.10-11-linux-arm64-debian-12.tar.gz.sha256 b/bitnami/zookeeper/3.9/debian-12/prebuildfs/opt/bitnami/checksums/wait-for-port-1.0.10-11-linux-arm64-debian-12.tar.gz.sha256 new file mode 100644 index 000000000000..3799475af672 --- /dev/null +++ b/bitnami/zookeeper/3.9/debian-12/prebuildfs/opt/bitnami/checksums/wait-for-port-1.0.10-11-linux-arm64-debian-12.tar.gz.sha256 @@ -0,0 +1 @@ +ae2e822f8c673eb66a2cadbc6dc5fe9c8c0791564751e453a04a416ab9bd6f61 wait-for-port-1.0.10-11-linux-arm64-debian-12.tar.gz diff --git a/bitnami/zookeeper/3.9/debian-12/prebuildfs/opt/bitnami/checksums/zookeeper-3.9.5-0-linux-amd64-debian-12.tar.gz.sha256 b/bitnami/zookeeper/3.9/debian-12/prebuildfs/opt/bitnami/checksums/zookeeper-3.9.5-0-linux-amd64-debian-12.tar.gz.sha256 new file mode 100644 index 000000000000..d3896488c38b --- /dev/null +++ b/bitnami/zookeeper/3.9/debian-12/prebuildfs/opt/bitnami/checksums/zookeeper-3.9.5-0-linux-amd64-debian-12.tar.gz.sha256 @@ -0,0 +1 @@ +d6fca2d1e90e636a4e2cfb93da144926123bfad8319a32b8ac3196b315f065ba zookeeper-3.9.5-0-linux-amd64-debian-12.tar.gz diff --git a/bitnami/zookeeper/3.9/debian-12/prebuildfs/opt/bitnami/checksums/zookeeper-3.9.5-0-linux-arm64-debian-12.tar.gz.sha256 b/bitnami/zookeeper/3.9/debian-12/prebuildfs/opt/bitnami/checksums/zookeeper-3.9.5-0-linux-arm64-debian-12.tar.gz.sha256 new file mode 100644 index 000000000000..6f51438effde --- /dev/null +++ b/bitnami/zookeeper/3.9/debian-12/prebuildfs/opt/bitnami/checksums/zookeeper-3.9.5-0-linux-arm64-debian-12.tar.gz.sha256 @@ -0,0 +1 @@ +8e8ec9a761332f4d0442437500f15b024f038684a0325df3c6c1e2d9237cda36 zookeeper-3.9.5-0-linux-arm64-debian-12.tar.gz diff --git a/bitnami/zookeeper/3.9/debian-12/prebuildfs/opt/bitnami/scripts/libfile.sh b/bitnami/zookeeper/3.9/debian-12/prebuildfs/opt/bitnami/scripts/libfile.sh index 1c69e0e48a5d..335c1c7c9ef7 100644 --- a/bitnami/zookeeper/3.9/debian-12/prebuildfs/opt/bitnami/scripts/libfile.sh +++ b/bitnami/zookeeper/3.9/debian-12/prebuildfs/opt/bitnami/scripts/libfile.sh @@ -139,3 +139,40 @@ wait_for_log_entry() { return 1 fi } + +######################## +# Creates a secure temporary file containing the provided secret +# Arguments: +# $1 - secret to write to the temporary file +# Returns: +# String +######################### +credential_to_temp_file() { + local secret="$1" + local tmp_file + + # Use mktemp with a specific prefix for easier debugging if something lingers + if ! tmp_file=$(mktemp "${TMPDIR:-/tmp}/at.cred.XXXXXXXX"); then + echo "Error: Failed to create temp file" >&2 + return 1 + fi + + # Restrict permissions before writing the secret + chmod 0600 "$tmp_file" + # Write secret and ensure it's flushed to disk + printf "%s" "$secret" > "$tmp_file" + # Output the filename so the caller can capture it + echo "$tmp_file" +} + +######################## +# Cleans up temporary files created by credential_to_temp_file +# Arguments: +# None +# Returns: +# None +######################### +cleanup_credentials() { + debug "Cleaning up temporary files containing credentials" + rm -rf "${TMPDIR:-/tmp}"/at.cred.* +} diff --git a/bitnami/zookeeper/3.9/debian-12/prebuildfs/opt/bitnami/scripts/libfs.sh b/bitnami/zookeeper/3.9/debian-12/prebuildfs/opt/bitnami/scripts/libfs.sh index 1337f6c2dd59..b16efabd3230 100644 --- a/bitnami/zookeeper/3.9/debian-12/prebuildfs/opt/bitnami/scripts/libfs.sh +++ b/bitnami/zookeeper/3.9/debian-12/prebuildfs/opt/bitnami/scripts/libfs.sh @@ -131,6 +131,7 @@ relativize() { # -d|--dir-mode - mode for files. # -u|--user - user # -g|--group - group +# -n|--no-dereference - do not follow symlinks (use for runtime root chown of daemon-writable dirs) # Returns: # None ######################### @@ -140,6 +141,7 @@ configure_permissions_ownership() { local file_mode="" local user="" local group="" + local follow_symlinks="yes" # Validate arguments shift 1 @@ -161,6 +163,9 @@ configure_permissions_ownership() { shift group="${1:?missing group}" ;; + -n | --no-dereference) + follow_symlinks="no" + ;; *) echo "Invalid command line flag $1" >&2 return 1 @@ -169,22 +174,29 @@ configure_permissions_ownership() { shift done + # -L: follow symlinks and emits the target path + # This is dangerous at runtime, given a co-located lower-privileged process with write access + # to the target path can redirect the chown/chmod to arbitrary paths. Example: + # Lower-privileged process run: ln -s /etc /tmp/etc + # Then, setup.sh runs: configure_permissions_ownership --dir-mode 775 /tmp + local find_L_flag=(); [[ "$follow_symlinks" == "yes" ]] && find_L_flag=("-L") + # -h: changes symlink inode ownership without touching the target. + local chown_flags=(); [[ "$follow_symlinks" == "no" ]] && chown_flags=("-h") read -r -a filepaths <<<"$paths" for p in "${filepaths[@]}"; do if [[ -e "$p" ]]; then - find -L "$p" -printf "" if [[ -n $dir_mode ]]; then - find -L "$p" -type d ! -perm "$dir_mode" -print0 | xargs -r -0 chmod "$dir_mode" + find "${find_L_flag[@]}" "$p" -not -type l -type d ! -perm "$dir_mode" -print0 | xargs -r -0 chmod "$dir_mode" fi if [[ -n $file_mode ]]; then - find -L "$p" -type f ! -perm "$file_mode" -print0 | xargs -r -0 chmod "$file_mode" + find "${find_L_flag[@]}" "$p" -not -type l -type f ! -perm "$file_mode" -print0 | xargs -r -0 chmod "$file_mode" fi if [[ -n $user ]] && [[ -n $group ]]; then - find -L "$p" -print0 | xargs -r -0 chown "${user}:${group}" + find "${find_L_flag[@]}" "$p" -print0 | xargs -r -0 chown "${chown_flags[@]}" "${user}:${group}" elif [[ -n $user ]] && [[ -z $group ]]; then - find -L "$p" -print0 | xargs -r -0 chown "${user}" + find "${find_L_flag[@]}" "$p" -print0 | xargs -r -0 chown "${chown_flags[@]}" "${user}" elif [[ -z $user ]] && [[ -n $group ]]; then - find -L "$p" -print0 | xargs -r -0 chgrp "${group}" + find "${find_L_flag[@]}" "$p" -print0 | xargs -r -0 chgrp "${chown_flags[@]}" "${group}" fi else stderr_print "$p does not exist" diff --git a/bitnami/zookeeper/3.9/debian-12/rootfs/opt/bitnami/scripts/libzookeeper.sh b/bitnami/zookeeper/3.9/debian-12/rootfs/opt/bitnami/scripts/libzookeeper.sh index 659c72a3a5bd..6c432b55a446 100644 --- a/bitnami/zookeeper/3.9/debian-12/rootfs/opt/bitnami/scripts/libzookeeper.sh +++ b/bitnami/zookeeper/3.9/debian-12/rootfs/opt/bitnami/scripts/libzookeeper.sh @@ -71,8 +71,13 @@ zookeeper_validate() { is_boolean_yes "$ZOO_ENABLE_ADMIN_SERVER" && check_conflicting_ports ZOO_PORT_NUMBER ZOO_PROMETHEUS_METRICS_PORT_NUMBER ZOO_ADMIN_SERVER_PORT_NUMBER # ZooKeeper client-server authentication validations - if is_boolean_yes "$ZOO_ENABLE_AUTH" && is_boolean_yes $ZOO_FIPS_MODE; then - print_validation_error "The ZOO_ENABLE_AUTH environment variable configures authentication using SASL/Digest-MD5 which is incompatible with FIPS. Set the environment variable ZOO_FIPS_MODE=no to disable FIPS in ZooKeeper." + if is_boolean_yes "$ALLOW_EMPTY_PASSWORD"; then + warn "You set the environment variable ALLOW_EMPTY_PASSWORD=${ALLOW_EMPTY_PASSWORD}. For safety reasons, do not use this flag in a production environment." + elif ! is_boolean_yes "$ZOO_ENABLE_AUTH"; then + print_validation_error "ZooKeeper authentication is disabled. Set the environment variable ALLOW_EMPTY_PASSWORD=yes to allow starting ZooKeeper without authentication. This is only recommended for development environments." + fi + if (is_boolean_yes "$ZOO_ENABLE_AUTH" || is_boolean_yes "$ZOO_ENABLE_QUORUM_AUTH") && is_boolean_yes $ZOO_FIPS_MODE; then + print_validation_error "The ZOO_ENABLE_AUTH and ZOO_ENABLE_QUORUM_AUTH environment variables configure authentication using SASL/Digest-MD5 which is incompatible with FIPS. Set the environment variable ZOO_FIPS_MODE=no to disable FIPS in ZooKeeper." fi # ZooKeeper server-server authentication validations @@ -191,6 +196,7 @@ zookeeper_initialize() { ######################### zookeeper_generate_conf() { cp "${ZOO_CONF_DIR}/zoo_sample.cfg" "$ZOO_CONF_FILE" + chmod 600 "$ZOO_CONF_FILE" echo >>"$ZOO_CONF_FILE" zookeeper_conf_set "$ZOO_CONF_FILE" tickTime "$ZOO_TICK_TIME" @@ -246,6 +252,7 @@ zookeeper_generate_conf() { # If TLS in enable if is_boolean_yes "$ZOO_TLS_CLIENT_ENABLE"; then + remove_in_file "$ZOO_CONF_FILE" "^clientPort=.*" false zookeeper_conf_set "$ZOO_CONF_FILE" client.secure true zookeeper_conf_set "$ZOO_CONF_FILE" ssl.clientAuth "$ZOO_TLS_CLIENT_AUTH" zookeeper_conf_set "$ZOO_CONF_FILE" secureClientPort "$ZOO_TLS_PORT_NUMBER" @@ -323,7 +330,9 @@ zookeeper_enable_client_server_authentication() { info "Enabling authentication..." zookeeper_conf_set "$filename" authProvider.1 org.apache.zookeeper.server.auth.SASLAuthenticationProvider - zookeeper_conf_set "$filename" requireClientAuthScheme sasl + zookeeper_conf_set "$filename" sessionRequireClientSASLAuth true + zookeeper_conf_set enforce.auth.enabled true + zookeeper_conf_set enforce.auth.schemes sasl } ######################## @@ -467,6 +476,9 @@ zookeeper_configure_acl() { done acl_string="${acl_string#,}" + # Restrict the bootstrap instance to loopback to eliminate the race window where + # unauthenticated external clients can reach :2181 + zookeeper_conf_set "$ZOO_CONF_FILE" clientPortAddress "127.0.0.1" zookeeper_start_bg for path in / /zookeeper /zookeeper/quota; do @@ -475,6 +487,7 @@ zookeeper_configure_acl() { done zookeeper_stop + remove_in_file "$ZOO_CONF_FILE" "^clientPortAddress=.*" false mv "${ZOO_LOG_DIR}/zookeeper.out" "${ZOO_LOG_DIR}/zookeeper.out.firstboot" } @@ -598,7 +611,6 @@ is_zookeeper_not_running() { zookeeper_healthcheck() { local command="" local args=() - local port="$ZOO_PORT_NUMBER" if [[ "$ZOO_TLS_CLIENT_ENABLE" = true ]]; then if [[ "$JAVA_FIPS_MODE" = "restricted" || "$JAVA_FIPS_MODE" = "relaxed" ]]; then @@ -611,45 +623,31 @@ zookeeper_healthcheck() { # file-store loader. openssl s_client cannot open /dev/fd file descriptors # created by process substitution (-key <(...) -cert <(...)), making the # standard TLS healthcheck unreliable. - # For both modes: primary check via the admin HTTP server (no keystore - # interaction). Fallback: nc on the plain clientPort (ZOO_PORT_NUMBER), which - # ZooKeeper keeps open alongside the TLS secureClientPort. - local admin_url="http://127.0.0.1:${ZOO_ADMIN_SERVER_PORT_NUMBER}/commands/ruok" - debug "Running healthcheck via admin server (FIPS mode): 'curl -sf --max-time ${ZOO_HC_TIMEOUT} ${admin_url}'" - local curl_output="" - local curl_exit_code=0 - curl_output=$(curl -sf --max-time "$ZOO_HC_TIMEOUT" "$admin_url") || curl_exit_code=$? - if [[ $curl_exit_code -eq 0 ]]; then - debug "Admin server response: ${curl_output}" - response="imok" + # For both modes: check via the admin HTTP server (no keystore + # interaction) if admin server is enabled. Otherwise, simply check there's + # a process listening using pgrep + if is_boolean_yes "$ZOO_ENABLE_ADMIN_SERVER"; then + local admin_url="http://127.0.0.1:${ZOO_ADMIN_SERVER_PORT_NUMBER}/commands/ruok" + debug "Running healthcheck via admin server (FIPS mode): 'curl -sf --max-time ${ZOO_HC_TIMEOUT} ${admin_url}'" + local curl_output="" + local curl_exit_code=0 + curl_output=$(curl -sf --max-time "$ZOO_HC_TIMEOUT" "$admin_url") || curl_exit_code=$? + if [[ $curl_exit_code -eq 0 ]]; then + debug "Admin server response: ${curl_output}" + response="imok" + fi else - # Admin server is not available. Fall back to the plain clientPort - # (ZOO_PORT_NUMBER). Even when TLS is enabled, Bitnami's zoo.cfg always - # sets both clientPort and secureClientPort, so ZooKeeper keeps a - # plain-text listener on ZOO_PORT_NUMBER alongside the TLS one. Using - # nc avoids any keystore interaction. - warn "Admin server not reachable (exit code ${curl_exit_code}, url ${admin_url}); falling back to plain port ${ZOO_PORT_NUMBER}." - local nc_args=("-w" "$ZOO_HC_TIMEOUT" "127.0.0.1" "$ZOO_PORT_NUMBER") - if nc -help 2>&1 | grep -q "\[-q seconds\]"; then - nc_args=("-q" "1" "${nc_args[@]}") - fi - debug "Running healthcheck command (FIPS fallback): 'echo \"ruok\" | timeout ${ZOO_HC_TIMEOUT} nc ${nc_args[*]}'" - response=$(echo "ruok" | timeout "$ZOO_HC_TIMEOUT" nc "${nc_args[@]}" 2>/dev/null) - if [[ ! "$response" =~ "imok" ]]; then - error "Plain port fallback also failed (response: '${response}'). Ensure ZOO_PORT_NUMBER=${ZOO_PORT_NUMBER} is reachable or enable the admin server with ZOO_ENABLE_ADMIN_SERVER=yes." - fi + pgrep -f "^" >/dev/null && response="imok" fi else - port="$ZOO_TLS_PORT_NUMBER" command="openssl" - args+=("s_client" "-quiet" "-crlf" "-connect" "localhost:${port}") - + args+=("s_client" "-quiet" "-crlf" "-connect" "localhost:${ZOO_TLS_PORT_NUMBER}") debug "Running healthcheck command: 'echo \"ruok\" | timeout ${ZOO_HC_TIMEOUT} ${command} ${args[*]} \ - -key <(openssl pkcs12 -in ${ZOO_TLS_CLIENT_KEYSTORE_FILE} -nodes -nocerts -passin pass:\$ZOO_TLS_CLIENT_KEYSTORE_PASSWORD) \ - -cert <(openssl pkcs12 -in ${ZOO_TLS_CLIENT_KEYSTORE_FILE} -nodes -nokeys -passin pass:\$ZOO_TLS_CLIENT_KEYSTORE_PASSWORD)'" + -key <(openssl pkcs12 -in ${ZOO_TLS_CLIENT_KEYSTORE_FILE} -nodes -nocerts -passin env:ZOO_TLS_CLIENT_KEYSTORE_PASSWORD) \ + -cert <(openssl pkcs12 -in ${ZOO_TLS_CLIENT_KEYSTORE_FILE} -nodes -nokeys -passin env:ZOO_TLS_CLIENT_KEYSTORE_PASSWORD)'" response=$(echo "ruok" | timeout "$ZOO_HC_TIMEOUT" "$command" "${args[@]}" \ - -key <(openssl pkcs12 -in "$ZOO_TLS_CLIENT_KEYSTORE_FILE" -nodes -nocerts -passin pass:"$ZOO_TLS_CLIENT_KEYSTORE_PASSWORD") \ - -cert <(openssl pkcs12 -in "$ZOO_TLS_CLIENT_KEYSTORE_FILE" -nodes -nokeys -passin pass:"$ZOO_TLS_CLIENT_KEYSTORE_PASSWORD") 2> /dev/null + -key <(openssl pkcs12 -in "$ZOO_TLS_CLIENT_KEYSTORE_FILE" -nodes -nocerts -passin env:ZOO_TLS_CLIENT_KEYSTORE_PASSWORD) \ + -cert <(openssl pkcs12 -in "$ZOO_TLS_CLIENT_KEYSTORE_FILE" -nodes -nokeys -passin env:ZOO_TLS_CLIENT_KEYSTORE_PASSWORD) 2> /dev/null ) fi else @@ -658,7 +656,7 @@ zookeeper_healthcheck() { if nc -help 2>&1 | grep -q "\[-q seconds\]"; then args+=("-q" "1") fi - args+=("-w" "$ZOO_HC_TIMEOUT" "localhost" "$port") + args+=("-w" "$ZOO_HC_TIMEOUT" "localhost" "$ZOO_PORT_NUMBER") debug "Running healthcheck command: 'echo \"ruok\" | timeout ${ZOO_HC_TIMEOUT} ${command} ${args[*]}'" response=$(echo "ruok" | timeout "$ZOO_HC_TIMEOUT" "$command" "${args[@]}") fi diff --git a/bitnami/zookeeper/3.9/debian-12/rootfs/opt/bitnami/scripts/zookeeper-env.sh b/bitnami/zookeeper/3.9/debian-12/rootfs/opt/bitnami/scripts/zookeeper-env.sh index d4344ed4e03b..6d774fdb671a 100644 --- a/bitnami/zookeeper/3.9/debian-12/rootfs/opt/bitnami/scripts/zookeeper-env.sh +++ b/bitnami/zookeeper/3.9/debian-12/rootfs/opt/bitnami/scripts/zookeeper-env.sh @@ -69,6 +69,7 @@ zookeeper_env_vars=( JVMFLAGS ZOO_HEAP_SIZE ZOO_ENABLE_AUTH + ALLOW_EMPTY_PASSWORD ZOO_CLIENT_USER ZOO_SERVER_USERS ZOO_CLIENT_PASSWORD @@ -162,6 +163,7 @@ export ZOO_HEAP_SIZE="${ZOO_HEAP_SIZE:-1024}" # Client-server authentication export ZOO_ENABLE_AUTH="${ZOO_ENABLE_AUTH:-no}" +export ALLOW_EMPTY_PASSWORD="${ALLOW_EMPTY_PASSWORD:-no}" export ZOO_CLIENT_USER="${ZOO_CLIENT_USER:-}" export ZOO_SERVER_USERS="${ZOO_SERVER_USERS:-}" export ZOO_CLIENT_PASSWORD="${ZOO_CLIENT_PASSWORD:-}" diff --git a/bitnami/zookeeper/README.md b/bitnami/zookeeper/README.md index df226131191e..018e39baf9ae 100644 --- a/bitnami/zookeeper/README.md +++ b/bitnami/zookeeper/README.md @@ -123,6 +123,7 @@ You can adjust the instance using the variables below. | `JVMFLAGS` | Default JVMFLAGS for the ZooKeeper process. | `nil` | | `ZOO_HEAP_SIZE` | Size in MB for the Java Heap options (Xmx and XMs). This env var is ignored if Xmx an Xms are configured via `JVMFLAGS`. | `1024` | | `ZOO_ENABLE_AUTH` | Enable ZooKeeper auth. It uses SASL/Digest-MD5. | `no` | +| `ALLOW_EMPTY_PASSWORD` | Allow auth-less access | `no` | | `ZOO_CLIENT_USER` | User that will use ZooKeeper clients to auth. | `nil` | | `ZOO_SERVER_USERS` | Comma, semicolon or whitespace separated list of user to be created. | `nil` | | `ZOO_CLIENT_PASSWORD` | Password that will use ZooKeeper clients to auth. | `nil` | diff --git a/bitnami/zookeeper/docker-compose-cluster.yml b/bitnami/zookeeper/docker-compose-cluster.yml index 28e06b3c78dd..0dda790a9a7b 100644 --- a/bitnami/zookeeper/docker-compose-cluster.yml +++ b/bitnami/zookeeper/docker-compose-cluster.yml @@ -10,7 +10,7 @@ services: - zookeeper_data:/bitnami environment: - ZOO_SERVER_ID=1 - - ALLOW_ANONYMOUS_LOGIN=yes + - ALLOW_EMPTY_PASSWORD=yes - ZOO_SERVERS=zookeeper:2888:3888,zookeeper2:2888:3888,zookeeper3:2888:3888 zookeeper2: image: docker.io/bitnami/zookeeper:3.9 @@ -20,7 +20,7 @@ services: - zookeeper2_data:/bitnami environment: - ZOO_SERVER_ID=2 - - ALLOW_ANONYMOUS_LOGIN=yes + - ALLOW_EMPTY_PASSWORD=yes - ZOO_SERVERS=zookeeper:2888:3888,zookeeper2:2888:3888,zookeeper3:2888:3888 zookeeper3: image: docker.io/bitnami/zookeeper:3.9 @@ -30,7 +30,7 @@ services: - zookeeper3_data:/bitnami environment: - ZOO_SERVER_ID=3 - - ALLOW_ANONYMOUS_LOGIN=yes + - ALLOW_EMPTY_PASSWORD=yes - ZOO_SERVERS=zookeeper:2888:3888,zookeeper2:2888:3888,zookeeper3:2888:3888 volumes: diff --git a/bitnami/zookeeper/docker-compose.yml b/bitnami/zookeeper/docker-compose.yml index bd78f6c250b7..1be133e1f42f 100644 --- a/bitnami/zookeeper/docker-compose.yml +++ b/bitnami/zookeeper/docker-compose.yml @@ -9,7 +9,7 @@ services: volumes: - 'zookeeper_data:/bitnami/zookeeper' environment: - - ALLOW_ANONYMOUS_LOGIN=yes + - ALLOW_EMPTY_PASSWORD=yes volumes: zookeeper_data: