Update ironbank build with latest docker context (#67504)

The file `download.json` is replaced by `hardening_manifest.yaml`, which
includes various pieces of information about the Iron Bank build.

distribution/docker/build.gradle

@@ -57,7 +57,7 @@ ext.expansions = { Architecture architecture, boolean oss, DockerBase base, bool
     buildArgs = """
 ARG BASE_REGISTRY=nexus-docker-secure.levelup-nexus.svc.cluster.local:18082
 ARG BASE_IMAGE=redhat/ubi/ubi8
-ARG BASE_TAG=8.2
+ARG BASE_TAG=8.3
 """
   }
 

distribution/docker/src/docker/Dockerfile

@@ -337,6 +337,7 @@ RUN chmod g=u /etc/passwd && \\
 
 EXPOSE 9200 9300
 
+<% if (docker_base != 'iron_bank') { %>
 LABEL org.label-schema.build-date="${build_date}" \\
   org.label-schema.license="${license}" \\
   org.label-schema.name="Elasticsearch" \\
@@ -356,8 +357,9 @@ LABEL org.label-schema.build-date="${build_date}" \\
   org.opencontainers.image.url="https://www.elastic.co/products/elasticsearch" \\
   org.opencontainers.image.vendor="Elastic" \\
   org.opencontainers.image.version="${version}"
+<% } %>
 
-<% if (docker_base == 'ubi' || docker_base == 'iron_bank') { %>
+<% if (docker_base == 'ubi') { %>
 LABEL name="Elasticsearch" \\
   maintainer="[email protected]" \\
   vendor="Elastic" \\

distribution/docker/src/docker/iron_bank/hardening_manifest.yaml

@@ -0,0 +1,53 @@
+---
+apiVersion: 1
+
+# The repository name in registry1, excluding /ironbank/
+name: "elastic/elasticsearch/elasticsearch"
+
+# List of tags to push for the repository in registry1
+# The most specific version should be the first tag and will be shown
+# on ironbank.dsop.io
+tags:
+- "${version}"
+- "latest"
+
+# Build args passed to Dockerfile ARGs
+args:
+  BASE_IMAGE: "redhat/ubi/ubi8"
+  BASE_TAG: "8.3"
+
+# Docker image labels
+labels:
+  org.opencontainers.image.title: "elasticsearch"
+  # Human-readable description of the software packaged in the image
+  org.opencontainers.image.description: "You know, for search."
+  # License(s) under which contained software is distributed
+  org.opencontainers.image.licenses: "${license}"
+  # URL to find more information on the image
+  org.opencontainers.image.url: "https://github.com/elastic/elasticsearch"
+  # Name of the distributing entity, organization or individual
+  org.opencontainers.image.vendor: "Elastic"
+  org.opencontainers.image.version: "${version}"
+  # Keywords to help with search (ex. "cicd,gitops,golang")
+  mil.dso.ironbank.image.keywords: "search,elastic,elasticsearch,java"
+  # This value can be "opensource" or "commercial"
+  mil.dso.ironbank.image.type: "commercial"
+  # Product the image belongs to for grouping multiple images
+  mil.dso.ironbank.product.name: "elasticsearch"
+
+# List of resources to make available to the offline build context
+resources:
+  - filename: "elasticsearch-${version}-linux-x86_64.tar.gz"
+    url: "<artifact_path>/elasticsearch-${version}-linux-x86_64.tar.gz"
+  - filename: "tini"
+    url: "https://github.com/krallin/tini/releases/download/v0.19.0/tini-amd64"
+    validation:
+      type: "sha256"
+      value: "93dcc18adc78c65a028a84799ecf8ad40c936fdfc5f2a57b1acda5a8117fa82c"
+
+# List of project maintainers
+maintainers:
+  - name: "Nassim Kammah"
+    email: "[email protected]"
+  - name: "Rory Hunter"
+    email: "[email protected]"

qa/os/src/test/java/org/elasticsearch/packaging/test/DockerTests.java

@@ -104,7 +104,9 @@ public void teardownTest() {
     /**
      * Checks that the Docker image can be run, and that it passes various checks.
      */
-    public void test010Install() {
+    public void test010Install() throws Exception {
+        // Wait for the container to come up, because we assert the state of some files that Elasticsearch creates on startup.
+        waitForElasticsearch(installation);
         verifyContainerInstallation(installation, distribution());
     }