UID2-2340 Allow override for enforce_https
#329
Conversation
|
This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation. |
cYKatherine
force-pushed
the
kcc-UID2-2340-add-override-for-https
branch
from
a07d787 to
6a2dcd9
Compare
cYKatherine
force-pushed
the
kcc-UID2-2340-add-override-for-https
branch
from
516994f to
1130715
Compare
cYKatherine
force-pushed
the
kcc-UID2-2340-add-override-for-https
branch
from
3c0e5f1 to
a0076b1
Compare
cYKatherine
force-pushed
the
kcc-UID2-2340-add-override-for-https
branch
3 times, most recently
from
3a3a046 to
005e3ae
Compare
cYKatherine
force-pushed
the
kcc-UID2-2340-add-override-for-https
branch
2 times, most recently
from
ba5187c to
f825200
Compare
scripts/azure-cc/Dockerfile
Outdated
| @@ -27,7 +27,6 @@ RUN tar xzvf /app/static.tar.gz --no-same-owner --no-same-permissions && rm -f / | |||
| COPY ./entrypoint.sh /app/ | |||
| RUN chmod a+x /app/entrypoint.sh | |||
|
|
|||
| RUN adduser -D uid2-operator && mkdir -p /opt/uid2 && chmod 777 -R /opt/uid2 && mkdir -p /app && chmod 705 -R /app && mkdir -p /app/file-uploads && chmod 777 -R /app/file-uploads | |||
| USER uid2-operator | |||
| RUN mkdir -p /opt/uid2 && chmod 777 -R /opt/uid2 && mkdir -p /app && chmod 705 -R /app && mkdir -p /app/file-uploads && chmod 777 -R /app/file-uploads | |||
There was a problem hiding this comment.
We need this change because with the uid2-operator user it doesn’t have 777 access to the /tmp folder. Remove User to be consistent with gcp-oidc: https://github.com/IABTechLab/uid2-operator/blob/main/scripts/gcp-oidc/Dockerfile#L32
There was a problem hiding this comment.
Hold on.. I remember we remove user in GCP for some specific reason: not be able to read token.
If possible let's keep the uid2-operator user.
Can we update jq_inplace_update_json function to put tmp file in same folder with final_config where we should have write permission? ( See comment below )
scripts/azure-cc/entrypoint.sh
Outdated
| local file=$1 | ||
| local field=$2 | ||
| local value=$3 | ||
| jq --argjson v "$value" ".$field = \$v" "$file" > tmp.json && mv tmp.json "$file" |
There was a problem hiding this comment.
Can it work if we define a local tmp = "$file.tmp", and replace tmp.json with it?
cYKatherine
changed the title
enforce_httpsenforce_https
cYKatherine
force-pushed
the
kcc-UID2-2340-add-override-for-https
branch
from
a1f77ea to
54eb837
Compare
| local file=$1 | ||
| local field=$2 | ||
| local value=$3 | ||
| jq --argjson v "$value" ".$field = \$v" "$file" > $TMP_FINAL_CONFIG && mv $TMP_FINAL_CONFIG "$file" |
There was a problem hiding this comment.
better to move the TMP_FINAL_CONFIG path inside this function.
Please review in order of:
enforce_https#329I’ve tested it working: