FROM confluentinc/cp-kafka-connect-base:7.3.1

USER root

# Run updates
RUN dnf -y upgrade && dnf clean all

# Update and install find for determing SSL configuration in entrypoint
RUN dnf -y install findutils jq

# Install awscli to get secrets from AWS secrets manager
RUN dnf -y module install python39
RUN python -m pip install --upgrade pip
RUN python -m pip install awscli==1.19.58

# Install Plugin

# Install Neo4j-sink connector from ConfluentHub
ENV ELASTICSEARCH_CONNECTOR_VERSION=11.1.10
RUN confluent-hub install --no-prompt confluentinc/kafka-connect-elasticsearch:"${ELASTICSEARCH_CONNECTOR_VERSION}"

# Install Lenses secret provider
ENV LENSES_SECRET_PROVIDER_VERSION='2.1.6'
RUN wget https://github.com/lensesio/secret-provider/releases/download/${LENSES_SECRET_PROVIDER_VERSION}/secret-provider-${LENSES_SECRET_PROVIDER_VERSION}-all.jar &&\
    mkdir /usr/share/java/secret-providers/ &&\
    mv secret-provider-${LENSES_SECRET_PROVIDER_VERSION}-all.jar /usr/share/java/secret-providers/

COPY entry_point.sh /usr/local/bin/entry_point.sh
RUN chmod +x /usr/local/bin/entry_point.sh

# Copy connector config template
COPY config.template.json /tmp/

# Until new base image is released /etc/kafka is not but have to be owned by appuser
# https://github.com/confluentinc/kafka-images/issues/127
RUN chown appuser:appuser -R /etc/kafka
USER appuser

# The Elasticsearch connector does not accept hyphens, so please only use underscores for ${CONNECTOR_NAME}
ENV CONNECTOR_NAME='elasticsearch_sink'
ENV CONNECT_REST_PORT=8083
# CONNECT_GROUP_UNIQUE_IDENTIFIER should be unique for every cluster of a given connector.
# If running more than one Elasticsearch Sink connector, set this to a meaningful unique value at runtime
ENV CONNECT_GROUP_UNIQUE_IDENTIFIER='orchard'
ENV CONNECT_KEY_CONVERTER='org.apache.kafka.connect.json.JsonConverter'
ENV CONNECT_VALUE_CONVERTER='org.apache.kafka.connect.json.JsonConverter'
ENV CONNECT_INTERNAL_KEY_CONVERTER='org.apache.kafka.connect.json.JsonConverter'
ENV CONNECT_INTERNAL_VALUE_CONVERTER='org.apache.kafka.connect.json.JsonConverter'
ENV CONNECT_PLUGIN_PATH='/usr/share/java,/usr/share/confluent-hub-components/'
ENV CONNECT_SECURITY_PROTOCOL='SSL'
ENV CONNECT_CONFIG_PROVIDERS='file'
ENV CONNECT_CONFIG_PROVIDERS_FILE_CLASS='org.apache.kafka.common.config.provider.FileConfigProvider'
ENV SECRETS_MANAGER_ELASTICSEARCH_SECRET_NAME=''
ENV AWS_REGION="us-east-1"
ENV CONNECT_CONSUMER_SECURITY_PROTOCOL='SSL'
ENV CONNECT_CONSUMER_REQUEST_TIMEOUT_MS='20000'
ENV CONNECT_CONSUMER_RETRY_BACKOFF_MS='500'
ENV CONNECT_PRODUCER_MAX_REQUEST_SIZE=15728640
ENV Environment='dev'
ENV MAX_TASKS='1'
ENV FLUSH_TIMEOUT_MS='100000'
ENV READ_TIMEOUT_MS='3000'
ENV MAX_RETRIES=25
ENV RETRY_BACKOFF_MS=1000
ENV BATCH_SIZE='2000'
ENV WRITE_METHOD='UPSERT'
ENV TRANSFORMS='renameTopic'
ENV TRANSFORMS_RENAMETOPIC_TYPE='org.apache.kafka.connect.transforms.RegexRouter'
ENV TRANSFORMS_RENAMETOPIC_REGEX='.*'
ENV TRANSFORMS_RENAMETOPIC_REPLACEMENT=''

# Mitigate CVE-2021-44228
# https://msrc-blog.microsoft.com/2021/12/11/microsofts-response-to-cve-2021-44228-apache-log4j2/
ENV LOG4J_FORMAT_MSG_NO_LOOKUPS="true"

# Configure default log levels
ENV CONNECT_LOG4J_ROOT_LOGLEVEL="ERROR"
ENV CONNECT_LOG4J_LOGGERS="org.I0Itec.zkclient=ERROR,org.reflections=ERROR,org.eclipse.jetty=ERROR,kafka=ERROR,org.apache.kafka=ERROR,org.apache.zookeeper=ERROR,org.apache.kafka.connect.runtime.WorkerSinkTask=ERROR"

# For JMX Metrics - we can move this to common once it is working.
ENV JMX_PORT=9095
ENV JMX_HOSTNAME='0.0.0.0'
ENV JMX_SSL=false
ENV JMX_AUTH=false
ENV KAFKA_JMX_OPTS="-Dcom.sun.management.jmxremote=true"\
" -Dcom.sun.management.jmxremote.authenticate=$JMX_AUTH"\
" -Dcom.sun.management.jmxremote.ssl=$JMX_SSL"\
" -Dcom.sun.management.jmxremote.local.only=false"\
" -Dcom.sun.management.jmxremote.port=$JMX_PORT"\
" -Dcom.sun.management.jmxremote.rmi.port=$JMX_PORT"\
" -Djava.rmi.server.hostname=$JMX_HOSTNAME"\
" -Dcom.sun.management.jmxremote.host=$JMX_HOSTNAME"

EXPOSE ${CONNECT_REST_PORT}
EXPOSE ${JMX_PORT}

ENTRYPOINT  ["/usr/local/bin/entry_point.sh"]

#FORCE REDEPLOY:1