Skip to content

Commit ffcebf4

Browse files
IBMRobIBMRob
authored
12.0.1.0-r4 update (#169)
1 parent 336002b commit ffcebf4

23 files changed

+2149
-420
lines changed

‎README.md

Lines changed: 16 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -14,8 +14,7 @@ For information of building images with IBM MQ Advanced please refer to [IBM App
1414

1515
The IBM App Connect operator now supports a single image which includes both the ACE server runtime as well as an MQ client. This readme will describe how you can build an equivalent image.
1616

17-
A pre-built developer edition image can be found at dockerhub - [ibmcom/ace-server](https://hub.docker.com/r/ibmcom/ace-server)
18-
A pre-built production edition image can be found on IBM Entitled Registry - [Obtaining the IBM App Connect Enterprise server image from the IBM Cloud Container Registry](https://www.ibm.com/docs/en/app-connect/11.0.0?topic=aciccd-obtaining-app-connect-enterprise-server-image-from-cloud-container-registry)
17+
Pre-built developer and production edition image can be found on IBM Container Registry - [Obtaining the IBM App Connect Enterprise server image from the IBM Cloud Container Registry](https://www.ibm.com/support/knowledgecenter/en/SSTTDS_11.0.0/com.ibm.ace.icp.doc/certc_install_obtaininstallationimageser.html)
1918

2019

2120
## Building a container image
@@ -28,7 +27,19 @@ Choose if you want to have an image with just App Connect Enterprise or an image
2827

2928
### Building a container image which contains an IBM Service provided fix for ACE
3029

31-
You may have been provided with a fix for App Connect Enterprise by IBM Support, this fix will have a name of the form `12.0.X.Y-ACE-LinuxX64-TF12345.tar.gz`. In order to apply this fix follow these steps.
30+
You may have been provided with a fix for App Connect Enterprise by IBM Support, this fix will have a name of the form `12.0.X.Y-ACE-LinuxX64-TF12345.tar.gz`. This fix can be used to create a container image in one of two different ways:
31+
32+
#### Installation during container image build
33+
This method builds a new container image derived from an existing ACE container image and applies the ifix using the standard `mqsifixinst.sh` script. The ifix image can be built from any existing ACE container image, e.g. `ace-only`, `ace-mqclient`, or another ifix image. Simply build `Dockerfile.ifix` passing in the full `BASE_IMAGE` name and the `IFIX_ID` arguments set:
34+
35+
```bash
36+
docker build -t ace-server:12.0.x.y-r1-tfit12345 --build-arg BASE_IMAGE=ace-server:12.0.x.y-1 --build-arg IFIX_ID=12.0.X.Y-ACE-LinuxX64-TFIT12345 --file ubi/Dockerfile.ifix path/to/folder/containing/ifix
37+
```
38+
39+
#### Pre-applying the fix to the ACE install image
40+
This method applies the ifix directly to the ACE installation image that is consumed to make the full container image. **NB**: Only follow these instructions if you have been instructed by IBM Support to "manually install" the ifix, or that the above method is not applicable to your issue. If you follow these instructions then the ifix ID will _not_ appear in the output of `mqsiservice -v`.
41+
42+
In order to apply this fix manually follow these steps.
3243
- On a local system extract the App Connect Enterprise archive
3344
`tar -xvf ace-12.0.1.0.tar.gz`
3445
- Extract the fix package into expanded App Connect Enterprise installation
@@ -103,6 +114,8 @@ In the `sample` folder there is an example on how to build a server image with a
103114
- **ACE_ADMIN_SERVER_CERT** - Set this to your Integration Server SSL certificate.
104115
- **ACE_ADMIN_SERVER_KEY** - Set this to your Integration Server SSL key certificate.
105116

117+
- **FORCE_FLOW_HTTPS** - Set to 'true' and the *.key and *.crt present in `/home/aceuser/httpsNodeCerts/` are used to force all your flows to use https
118+
106119
## How to dynamically configure the ACE Integration Server
107120

108121
To enable dynamic configuration of the ACE Integration Server, this setup supports configuration injected into the image as files.

‎ace_config_bar_overrides.sh

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,10 @@ fi
1414
if ls /home/aceuser/initial-config/bar_overrides/*.properties >/dev/null 2>&1; then
1515
for propertyFile in /home/aceuser/initial-config/bar_overrides/*.properties
1616
do
17-
mqsiapplybaroverride -b /home/aceuser/initial-config/bars/barfile.bar -p $propertyFile -r
18-
echo $propertyFile >> /home/aceuser/initial-config/bar_overrides/logs.txt
17+
for bar in /home/aceuser/initial-config/bars/*.bar
18+
do
19+
mqsiapplybaroverride -b $bar -p $propertyFile -r
20+
echo $propertyFile >> /home/aceuser/initial-config/bar_overrides/logs.txt
21+
done
1922
done
20-
fi
23+
fi

‎ace_config_webusers.sh

Lines changed: 77 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -25,23 +25,87 @@ VIEWERUSERSFILE=/home/aceuser/initial-config/webusers/viewer-users.txt
2525
if [ -s $ADMINUSERSFILE ] || [ -s $OPERATORUSERSFILE ] || [ -s $EDITORUSERSFILE ] || [ -s $AUDITUSERSFILE ] || [ -s $VIEWERUSERSFILE ]; then
2626
OUTPUT=$(mqsichangeauthmode -w /home/aceuser/ace-server -s active -m file 2>&1)
2727
logAndExitIfError $? "${OUTPUT}"
28+
fi
2829

29-
OUTPUT=$(mqsichangefileauth -w /home/aceuser/ace-server -r admin -p all+ 2>&1)
30-
logAndExitIfError $? "${OUTPUT}"
31-
OUTPUT=$(mqsichangefileauth -w /home/aceuser/ace-server -r admin -o Data -p all+ 2>&1)
32-
logAndExitIfError $? "${OUTPUT}"
30+
if [ -f $ADMINUSERSFILE ]; then
31+
if [ -s $ADMINUSERSFILE ]; then
32+
if [ -r $ADMINUSERSFILE ]; then
33+
OUTPUT=$(mqsichangefileauth -w /home/aceuser/ace-server -r admin -p all+ 2>&1)
34+
logAndExitIfError $? "${OUTPUT}"
35+
36+
OUTPUT=$(mqsichangefileauth -w /home/aceuser/ace-server -r admin -o Data -p all+ 2>&1)
37+
logAndExitIfError $? "${OUTPUT}"
38+
else
39+
log "ERROR: $ADMINUSERSFILE is not readable"
40+
exit 66
41+
fi
42+
else
43+
log "ERROR: $ADMINUSERSFILE is empty"
44+
exit 67
45+
fi
46+
fi
3347

34-
OUTPUT=$(mqsichangefileauth -w /home/aceuser/ace-server -r operator -p read+,write-,execute+ 2>&1)
35-
logAndExitIfError $? "${OUTPUT}"
36-
37-
OUTPUT=$(mqsichangefileauth -w /home/aceuser/ace-server -r editor -p read+,write+,execute- 2>&1)
38-
logAndExitIfError $? "${OUTPUT}"
48+
if [ -f $OPERATORUSERSFILE ]; then
49+
if [ -s $OPERATORUSERSFILE ]; then
50+
if [ -r $OPERATORUSERSFILE ]; then
51+
OUTPUT=$(mqsichangefileauth -w /home/aceuser/ace-server -r operator -p read+,write-,execute+ 2>&1)
52+
logAndExitIfError $? "${OUTPUT}"
53+
else
54+
log "ERROR: $OPERATORUSERSFILE is not readable"
55+
exit 66
56+
fi
57+
else
58+
log "ERROR: $OPERATORUSERSFILE is empty"
59+
exit 67
60+
fi
61+
fi
3962

40-
OUTPUT=$(mqsichangefileauth -w /home/aceuser/ace-server -r audit -p read+,write-,execute- 2>&1)
41-
logAndExitIfError $? "${OUTPUT}"
63+
if [ -f $EDITORUSERSFILE ]; then
64+
if [ -s $EDITORUSERSFILE ]; then
65+
if [ -r $EDITORUSERSFILE ]; then
66+
OUTPUT=$(mqsichangefileauth -w /home/aceuser/ace-server -r editor -p read+,write+,execute- 2>&1)
67+
logAndExitIfError $? "${OUTPUT}"
68+
else
69+
log "ERROR: $EDITORUSERSFILE is not readable"
70+
exit 66
71+
fi
72+
else
73+
log "ERROR: $EDITORUSERSFILE is empty"
74+
exit 67
75+
fi
76+
fi
4277

43-
OUTPUT=$(mqsichangefileauth -w /home/aceuser/ace-server -r viewer -p read+,write-,execute- 2>&1)
44-
logAndExitIfError $? "${OUTPUT}"
78+
if [ -f $AUDITUSERSFILE ]; then
79+
if [ -s $AUDITUSERSFILE ]; then
80+
if [ -r $AUDITUSERSFILE ]; then
81+
OUTPUT=$(mqsichangefileauth -w /home/aceuser/ace-server -r audit -p read+,write-,execute- 2>&1)
82+
logAndExitIfError $? "${OUTPUT}"
83+
else
84+
log "ERROR: $AUDITUSERSFILE is not readable"
85+
exit 66
86+
fi
87+
else
88+
log "ERROR: $AUDITUSERSFILE is empty"
89+
exit 67
90+
fi
91+
fi
92+
93+
if [ -f $VIEWERUSERSFILE ]; then
94+
if [ -s $VIEWERUSERSFILE ]; then
95+
if [ -r $VIEWERUSERSFILE ]; then
96+
OUTPUT=$(mqsichangefileauth -w /home/aceuser/ace-server -r viewer -p read+,write-,execute- 2>&1)
97+
logAndExitIfError $? "${OUTPUT}"
98+
else
99+
log "ERROR: $VIEWERUSERSFILE is not readable"
100+
exit 66
101+
fi
102+
else
103+
log "ERROR: $VIEWERUSERSFILE is empty"
104+
exit 67
105+
fi
106+
fi
107+
108+
if [ -s $ADMINUSERSFILE ] || [ -s $OPERATORUSERSFILE ] || [ -s $EDITORUSERSFILE ] || [ -s $AUDITUSERSFILE ] || [ -s $VIEWERUSERSFILE ]; then
45109

46110
OLDIFS=${IFS}
47111

‎ace_forceflowhttps.sh

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
#!/bin/bash
2+
3+
# © Copyright IBM Corporation 2021.
4+
#
5+
# All rights reserved. This program and the accompanying materials
6+
# are made available under the terms of the Eclipse Public License v2.0
7+
# which accompanies this distribution, and is available at
8+
# http://www.eclipse.org/legal/epl-v20.html
9+
10+
if [ -z "$MQSI_VERSION" ]; then
11+
source /opt/ibm/ace-12/server/bin/mqsiprofile
12+
fi
13+
14+
SCRIPT_DIR=$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )
15+
source ${SCRIPT_DIR}/ace_config_logging.sh
16+
17+
log "Creating force flows to be https keystore"
18+
19+
if [ -f /home/aceuser/ace-server/https-keystore.p12 ]; then
20+
OUTPUT=$(rm /home/aceuser/ace-server/https-keystore.p12 2>&1)
21+
logAndExitIfError $? "${OUTPUT}"
22+
fi
23+
24+
IFS=$'\n'
25+
KEYTOOL=/opt/ibm/ace-12/common/jdk/jre/bin/keytool
26+
if [ ! -f "$KEYTOOL" ]; then
27+
KEYTOOL=/opt/ibm/ace-12/common/jre/bin/keytool
28+
fi
29+
30+
if [ ! -f /home/aceuser/httpsNodeCerts/*.key ]; then
31+
log "No keystore files found at location /home/aceuser/httpsNodeCerts/*.key cannot create Force Flows HTTPS keystore"
32+
exit 1
33+
fi
34+
35+
for keyfile in `ls /home/aceuser/httpsNodeCerts/*.key`; do
36+
if [ -s "${keyfile}" ]; then
37+
if [ -z "${1}" ]; then
38+
log "No keystore password defined"
39+
exit 1
40+
fi
41+
42+
filename=$(basename ${keyfile})
43+
dirname=$(dirname ${keyfile})
44+
alias=$(echo ${filename} | sed -e 's/\.key$'//)
45+
certfile=${dirname}/${alias}.crt
46+
passphrasefile=${dirname}/${alias}.pass
47+
48+
if [ ! -f ${certfile} ]; then
49+
log "Certificate file ${certfile} not found."
50+
exit 1
51+
fi
52+
53+
OUTPUT=$(openssl pkcs12 -export -in ${certfile} -inkey ${keyfile} -out /home/aceuser/ace-server/https-keystore.p12 -name ${alias} -password pass:${1} 2>&1)
54+
logAndExitIfError $? "${OUTPUT}"
55+
56+
log "Setting https keystore password"
57+
cmd="mqsisetdbparms -w /home/aceuser/ace-server -n brokerHTTPSKeystore::password -u anything -p \"${1}\" 2>&1"
58+
OUTPUT=`eval "$cmd"`
59+
echo $OUTPUT
60+
61+
fi
62+
done
63+
64+
log "Force flows to be https keystore creation complete"

0 commit comments

Comments
 (0)