Skip to content

Commit

Permalink
manage - oidcng - myconext: Use old cacert entrypoint update script
Browse files Browse the repository at this point in the history
This reverts the new cacert update script, which leads to errors when
restarting a container. See also: adoptium/containers#612
  • Loading branch information
quartje committed Aug 19, 2024
1 parent feeb53d commit dca906d
Show file tree
Hide file tree
Showing 6 changed files with 129 additions and 6 deletions.
30 changes: 30 additions & 0 deletions roles/manage/files/__cacert_entrypoint.sh
Original file line number Diff line number Diff line change
@@ -0,0 +1,30 @@
#!/usr/bin/env sh
# Converted to POSIX shell to avoid the need for bash in the image

set -e

# Opt-in is only activated if the environment variable is set
if [ -n "$USE_SYSTEM_CA_CERTS" ]; then

# Copy certificates from /certificates to the system truststore, but only if the directory exists and is not empty.
# The reason why this is not part of the opt-in is because it leaves open the option to mount certificates at the
# system location, for whatever reason.
if [ -d /certificates ] && [ -n "$(ls -A /certificates 2>/dev/null)" ]; then
cp -a /certificates/* /usr/local/share/ca-certificates/
fi

CACERT="$JAVA_HOME/lib/security/cacerts"

# JDK8 puts its JRE in a subdirectory
if [ -f "$JAVA_HOME/jre/lib/security/cacerts" ]; then
CACERT="$JAVA_HOME/jre/lib/security/cacerts"
fi

# OpenJDK images used to create a hook for `update-ca-certificates`. Since we are using an entrypoint anyway, we
# might as well just generate the truststore and skip the hooks.
update-ca-certificates

trust extract --overwrite --format=java-cacerts --filter=ca-anchors --purpose=server-auth "$CACERT"
fi

exec "$@"
14 changes: 13 additions & 1 deletion roles/manage/tasks/main.yml
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,7 @@
mode: "0644"

- name: copy invite certificate
copy:
ansible.builtin.copy:
src: "{{ inventory_dir }}/files/certs/invite/public_key.pem"
dest: "/opt/openconext/manage/public_invite_key.pem"
owner: root
Expand All @@ -40,6 +40,14 @@
- manage-api-users.yml
notify: restart manageserver

- name: Place old __cacert_entrypoint.sh script
ansible.builtin.copy:
src: "__cacert_entrypoint.sh"
dest: "/opt/openconext/manage"
owner: "root"
group: "root"
mode: "0755"

- name: copy metadata configuration
ansible.builtin.template:
src: "metadata_configuration/{{ item }}.schema.json.j2"
Expand Down Expand Up @@ -81,6 +89,10 @@
- source: /opt/openconext/manage/mongoca.pem
target: /certificates/mongoca.crt
type: bind
- source: /opt/openconext/manage/__cacert_entrypoint.sh
target: /__cacert_entrypoint.sh
type: bind

command: "java -jar /app.jar -Xmx512m --spring.config.location=./config/"
etc_hosts:
host.docker.internal: host-gateway
Expand Down
30 changes: 30 additions & 0 deletions roles/myconext/files/__cacert_entrypoint.sh
Original file line number Diff line number Diff line change
@@ -0,0 +1,30 @@
#!/usr/bin/env sh
# Converted to POSIX shell to avoid the need for bash in the image

set -e

# Opt-in is only activated if the environment variable is set
if [ -n "$USE_SYSTEM_CA_CERTS" ]; then

# Copy certificates from /certificates to the system truststore, but only if the directory exists and is not empty.
# The reason why this is not part of the opt-in is because it leaves open the option to mount certificates at the
# system location, for whatever reason.
if [ -d /certificates ] && [ -n "$(ls -A /certificates 2>/dev/null)" ]; then
cp -a /certificates/* /usr/local/share/ca-certificates/
fi

CACERT="$JAVA_HOME/lib/security/cacerts"

# JDK8 puts its JRE in a subdirectory
if [ -f "$JAVA_HOME/jre/lib/security/cacerts" ]; then
CACERT="$JAVA_HOME/jre/lib/security/cacerts"
fi

# OpenJDK images used to create a hook for `update-ca-certificates`. Since we are using an entrypoint anyway, we
# might as well just generate the truststore and skip the hooks.
update-ca-certificates

trust extract --overwrite --format=java-cacerts --filter=ca-anchors --purpose=server-auth "$CACERT"
fi

exec "$@"
18 changes: 14 additions & 4 deletions roles/myconext/tasks/main.yml
Original file line number Diff line number Diff line change
Expand Up @@ -84,6 +84,14 @@
group: "root"
mode: "0750"

- name: Place old __cacert_entrypoint.sh script
ansible.builtin.copy:
src: "__cacert_entrypoint.sh"
dest: "/opt/openconext/myconext"
owner: "root"
group: "root"
mode: "0755"

- name: Create and start the server container
community.docker.docker_container:
name: myconextserver
Expand All @@ -92,7 +100,7 @@
restart_policy: "always"
state: started
env:
USE_SYSTEM_CA_CERTS: "true"
USE_SYSTEM_CA_CERTS: "1"
TZ: "{{ timezone }}"
networks:
- name: "loadbalancer"
Expand All @@ -103,8 +111,11 @@
- source: /opt/openconext/certs/mongoca.crt
target: /certificates/mongoca.crt
type: bind
entrypoint: /__cacert_entrypoint.sh
command: 'java -jar /app.jar -Xmx256M --spring.config.location=./config/'
- source: /opt/openconext/myconext/__cacert_entrypoint.sh
target: /__cacert_entrypoint.sh
type: bind
entrypoint: ["sh","/__cacert_entrypoint.sh"]
command: ["java" , "-jar" , "/app.jar" , "-Xmx256M" , "--spring.config.location=./config/"]
etc_hosts:
host.docker.internal: host-gateway
healthcheck:
Expand All @@ -113,7 +124,6 @@
timeout: 10s
retries: 3
start_period: 10s
notify: restart myconextserver

- name: Create the client container
community.docker.docker_container:
Expand Down
30 changes: 30 additions & 0 deletions roles/oidcng/files/__cacert_entrypoint.sh
Original file line number Diff line number Diff line change
@@ -0,0 +1,30 @@
#!/usr/bin/env sh
# Converted to POSIX shell to avoid the need for bash in the image

set -e

# Opt-in is only activated if the environment variable is set
if [ -n "$USE_SYSTEM_CA_CERTS" ]; then

# Copy certificates from /certificates to the system truststore, but only if the directory exists and is not empty.
# The reason why this is not part of the opt-in is because it leaves open the option to mount certificates at the
# system location, for whatever reason.
if [ -d /certificates ] && [ -n "$(ls -A /certificates 2>/dev/null)" ]; then
cp -a /certificates/* /usr/local/share/ca-certificates/
fi

CACERT="$JAVA_HOME/lib/security/cacerts"

# JDK8 puts its JRE in a subdirectory
if [ -f "$JAVA_HOME/jre/lib/security/cacerts" ]; then
CACERT="$JAVA_HOME/jre/lib/security/cacerts"
fi

# OpenJDK images used to create a hook for `update-ca-certificates`. Since we are using an entrypoint anyway, we
# might as well just generate the truststore and skip the hooks.
update-ca-certificates

trust extract --overwrite --format=java-cacerts --filter=ca-anchors --purpose=server-auth "$CACERT"
fi

exec "$@"
13 changes: 12 additions & 1 deletion roles/oidcng/tasks/main.yml
Original file line number Diff line number Diff line change
Expand Up @@ -80,6 +80,14 @@
notify:
- "restart oidcng"

- name: Place old __cacert_entrypoint.sh script
ansible.builtin.copy:
src: "__cacert_entrypoint.sh"
dest: "/opt/openconext/oidcng"
owner: "root"
group: "root"
mode: "0755"

- name: Create and start the server container
community.docker.docker_container:
name: oidcngserver
Expand All @@ -94,9 +102,12 @@
- source: "{{ oidcng_dir }}"
target: /config/
type: bind
- source: /opt/openconext/manage/mongoca.pem
- source: /opt/openconext/certs/mongoca.crt
target: /certificates/mongoca.crt
type: bind
- source: /opt/openconext/oidcng/__cacert_entrypoint.sh
target: /__cacert_entrypoint.sh
type: bind
command: "java -jar /app.jar -Xmx512m --spring.config.location=./config/"
etc_hosts:
host.docker.internal: host-gateway
Expand Down

0 comments on commit dca906d

Please sign in to comment.