Remove and replace additional operations in enclave start #1289
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -28,4 +28,4 @@ | |
| "enable_phone_support": true, | ||
| "enable_v1_phone_support": false, | ||
| "enable_v2_encryption": true | ||
| } | ||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -7,93 +7,87 @@ LOG_FILE="/home/start.txt" | |
| set -x | ||
| exec &> >(tee -a "$LOG_FILE") | ||
|
|
||
| PARAMETERIZED_CONFIG="/app/conf/config-overrides.json" | ||
| OPERATOR_CONFIG="/tmp/final-config.json" | ||
|
|
||
| setup_auxiliaries() { | ||
| set -o pipefail | ||
| ulimit -n 65536 | ||
|
|
||
| # -- setup loopback device | ||
| echo "Setting up loopback device..." | ||
| ifconfig lo 127.0.0.1 | ||
|
|
||
| # -- start vsock proxy | ||
| echo "Starting vsock proxy..." | ||
| /app/vsockpx --config /app/proxies.nitro.yaml --daemon --workers $(( ( $(nproc) + 3 ) / 4 )) --log-level 3 | ||
|
|
||
| /usr/sbin/syslog-ng --verbose | ||
| } | ||
|
|
||
|
|
||
| build_parameterized_config() { | ||
| curl -s -f -o "${PARAMETERIZED_CONFIG}" -x socks5h://127.0.0.1:3305 http://127.0.0.1:27015/getConfig | ||
| REQUIRED_KEYS=("optout_base_url" "core_base_url" "api_token" "environment") | ||
| for key in "${REQUIRED_KEYS[@]}"; do | ||
| if ! jq -e "has(\"${key}\")" "${PARAMETERIZED_CONFIG}" > /dev/null; then | ||
| echo "Error: Key '${key}' is missing. Please add it to flask config server" | ||
| exit 1 | ||
| fi | ||
| done | ||
| FILTER=$(printf '. | {') | ||
|
There was a problem hiding this comment. We do this logic differently in each implementation: In GCP in Java code, in Azure in MAA attestation, and in AWS it was in make_config.py. |
||
| for key in "${REQUIRED_KEYS[@]}"; do | ||
| FILTER+="$key: .${key}, " | ||
| done | ||
| FILTER+="debug_mode: .debug_mode, " | ||
| FILTER=${FILTER%, }'}' | ||
| jq "${FILTER}" "${PARAMETERIZED_CONFIG}" > "${PARAMETERIZED_CONFIG}.tmp" && mv "${PARAMETERIZED_CONFIG}.tmp" "${PARAMETERIZED_CONFIG}" | ||
| } | ||
|
|
||
| build_operator_config() { | ||
| CORE_BASE_URL=$(jq -r ".core_base_url" < "${PARAMETERIZED_CONFIG}") | ||
| OPTOUT_BASE_URL=$(jq -r ".optout_base_url" < "${PARAMETERIZED_CONFIG}") | ||
| DEPLOYMENT_ENVIRONMENT=$(jq -r ".environment" < "${PARAMETERIZED_CONFIG}") | ||
| DEBUG_MODE=$(jq -r ".debug_mode" < "${PARAMETERIZED_CONFIG}") | ||
|
|
||
| IDENTITY_SCOPE_LOWER=$(echo "${IDENTITY_SCOPE}" | tr '[:upper:]' '[:lower:]') | ||
| DEPLOYMENT_ENVIRONMENT_LOWER=$(echo "${DEPLOYMENT_ENVIRONMENT}" | tr '[:upper:]' '[:lower:]') | ||
| DEFAULT_CONFIG="/app/conf/${IDENTITY_SCOPE_LOWER}-${DEPLOYMENT_ENVIRONMENT_LOWER}-config.json" | ||
|
|
||
| jq -s '.[0] * .[1]' "${DEFAULT_CONFIG}" "${PARAMETERIZED_CONFIG}" > "${OPERATOR_CONFIG}" | ||
|
|
||
|
There was a problem hiding this comment. we need to ensure CORE_BASE_URL is not set to random core, as this will result in operator sending token + pcr0 to overridden malicious core. Basically, updates the logic to always replace URL in config. If prod, use default prod URL otherwise allow override. This check is not done in GCP, as we attest GCP confidential compute by calling GCP endpoints. Please correct if wrong @atarassov-ttd |
||
| if [[ "$DEPLOYMENT_ENVIRONMENT" == "prod" ]]; then | ||
| if [[ "$DEBUG_MODE" == "true" ]]; then | ||
| echo "Cannot run in DEBUG_MODE in production environment. Exiting." | ||
| exit 1 | ||
| fi | ||
| fi | ||
|
|
||
| #TODO: Remove below logic after remote config management is implemented | ||
|
|
||
| if [[ "$DEPLOYMENT_ENVIRONMENT" != "prod" ]]; then | ||
| #Allow override of base URL in non-prod environments | ||
|
There was a problem hiding this comment. I tried to remove all configs we pass and keep it simple, but there are lot of intricacies This bit, can be removed once we complete remote config management, and use optour url returned by core. |
||
| CORE_PATTERN="https://core.*uidapi.com" | ||
| OPTOUT_PATTERN="https://optout.*uidapi.com" | ||
| if [[ "$DEPLOYMENT_ENVIRONMENT" == "euid" ]]; then | ||
| CORE_PATTERN="https://core.*euid.eu" | ||
| OPTOUT_PATTERN="https://optout.*euid.eu" | ||
| fi | ||
| sed -i "s#${CORE_PATTERN}#${CORE_BASE_URL}#g" "${OPERATOR_CONFIG}" | ||
| sed -i "s#${OPTOUT_PATTERN}#${OPTOUT_BASE_URL}#g" "${OPERATOR_CONFIG}" | ||
| fi | ||
|
|
||
| } | ||
|
|
||
| setup_auxiliaries | ||
| build_parameterized_config | ||
| build_operator_config | ||
|
|
||
| DEBUG_MODE=$(jq -r ".debug_mode" < "${OPERATOR_CONFIG}") | ||
| LOGBACK_CONF="./conf/logback.xml" | ||
|
|
||
| if [[ "$DEBUG_MODE" == "true" ]]; then | ||
| LOGBACK_CONF="./conf/logback-debug.xml" | ||
| fi | ||
|
|
||
| # -- set pwd to /app so we can find default configs | ||
|
|
@@ -106,7 +100,7 @@ java \ | |
| -XX:MaxRAMPercentage=95 -XX:-UseCompressedOops -XX:+PrintFlagsFinal \ | ||
| -Djava.security.egd=file:/dev/./urandom \ | ||
| -Djava.library.path=/app/lib \ | ||
| -Dvertx-config-path="${OPERATOR_CONFIG}" \ | ||
| -Dvertx.logger-delegate-factory-class-name=io.vertx.core.logging.SLF4JLogDelegateFactory \ | ||
| -Dlogback.configurationFile=${LOGBACK_CONF} \ | ||
| -Dhttp_proxy=socks5://127.0.0.1:3305 \ | ||
|
|
||
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Is this needed now? @Ian-Nara
We populate configs after processing in
uid2-operator/scripts/aws/ec2.py
Line 135 in 9b94fd5
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I think the lower() calls to these is still useful, unless I missed that in the ec2.py
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
we ensure it is lower as part of validations