diff --git a/document-manager/backend/openshift.dockerfile b/document-manager/backend/openshift.dockerfile index 2ad51a59cf..916f6ddd98 100644 --- a/document-manager/backend/openshift.dockerfile +++ b/document-manager/backend/openshift.dockerfile @@ -1,10 +1,12 @@ -FROM public.ecr.aws/bitnami/python:3.12.4 - -WORKDIR /opt/app-root/src +FROM python:3.12.4 +WORKDIR /opt/app-root/src/ # Install dependencies -RUN install_packages gcc libc6-dev libpq-dev libmagic-dev +RUN apt-get update -yqq && \ + apt-get install -y gcc libc6-dev libpq-dev libmagic-dev && \ + rm -rf /var/lib/apt/lists/* + # Install the requirements COPY ./requirements.txt . @@ -14,9 +16,13 @@ RUN pip install wheel && \ RUN apt-get purge -y --auto-remove gcc libc6-dev COPY . . +# 4. CRITICAL FOR OPENSHIFT: Fix permissions for random user execution +RUN chgrp -R 0 /opt/app-root && \ + chmod -R g=u /opt/app-root && \ + chmod +x /opt/app-root/src/app.sh ENV FLASK_APP app.py # Run the server EXPOSE 5001 9191 -ENTRYPOINT /opt/app-root/src/app.sh backend +ENTRYPOINT ["./app.sh", "backend"] diff --git a/infrastructure/helm/templates/frontend.yaml b/infrastructure/helm/templates/frontend.yaml index 8d33358d29..d6ba4b3c62 100644 --- a/infrastructure/helm/templates/frontend.yaml +++ b/infrastructure/helm/templates/frontend.yaml @@ -84,13 +84,13 @@ spec: volumeMounts: - name: vanity-tls-certs readOnly: true - mountPath: /opt/bitnami/nginx/conf/certs + mountPath: /etc/nginx/certs - name: plr-integration-volume readOnly: true - mountPath: /opt/bitnami/nginx/conf/certs/plr + mountPath: /etc/nginx/certs/plr - name: nginx-config readOnly: true - mountPath: /opt/bitnami/nginx/conf/nginx.conf + mountPath: /etc/nginx/nginx.conf subPath: nginx.conf - name: env-config readOnly: true @@ -160,27 +160,27 @@ data: #user www www; ## Default: nobody worker_processes auto; - error_log "/opt/bitnami/nginx/logs/error.log"; - pid "/opt/bitnami/nginx/tmp/nginx.pid"; + error_log "/var/log/nginx/error.log"; + pid "/tmp/nginx.pid"; events { worker_connections 1024; } http { - include mime.types; + include /etc/nginx/mime.types; default_type application/octet-stream; log_format main '$remote_addr - $remote_user [$time_local] ' '"$request" $status $body_bytes_sent "$http_referer" ' '"$http_user_agent" "$http_x_forwarded_for"'; - access_log "/opt/bitnami/nginx/logs/access.log" main; + access_log "/var/log/nginx/access.log" main; # add_header X-Frame-Options SAMEORIGIN; - client_body_temp_path "/opt/bitnami/nginx/tmp/client_body" 1 2; - proxy_temp_path "/opt/bitnami/nginx/tmp/proxy" 1 2; - fastcgi_temp_path "/opt/bitnami/nginx/tmp/fastcgi" 1 2; - scgi_temp_path "/opt/bitnami/nginx/tmp/scgi" 1 2; - uwsgi_temp_path "/opt/bitnami/nginx/tmp/uwsgi" 1 2; + client_body_temp_path "/tmp/client_body" 1 2; + proxy_temp_path "/tmp/proxy" 1 2; + fastcgi_temp_path "/tmp/fastcgi" 1 2; + scgi_temp_path "/tmp/scgi" 1 2; + uwsgi_temp_path "/tmp/uwsgi" 1 2; sendfile on; # tcp_nopush on; diff --git a/infrastructure/prime-app-ephemeral-template.yml b/infrastructure/prime-app-ephemeral-template.yml index 91f42192b1..24153f73a0 100644 --- a/infrastructure/prime-app-ephemeral-template.yml +++ b/infrastructure/prime-app-ephemeral-template.yml @@ -143,13 +143,13 @@ objects: volumeMounts: - name: vanity-tls-certs readOnly: true - mountPath: /opt/bitnami/nginx/conf/certs + mountPath: /etc/nginx/certs - name: plr-integration-volume readOnly: true - mountPath: /opt/bitnami/nginx/conf/certs/plr + mountPath: /etc/nginx/certs/plr - name: nginx-config readOnly: true - mountPath: /opt/bitnami/nginx/conf/nginx.conf + mountPath: /etc/nginx/nginx.conf subPath: nginx.conf - name: env-config readOnly: true @@ -218,27 +218,28 @@ objects: #user www www; ## Default: nobody worker_processes auto; - error_log "/opt/bitnami/nginx/logs/error.log"; - pid "/opt/bitnami/nginx/tmp/nginx.pid"; + error_log "/var/log/nginx/error.log"; + error_log "/tmp/error_fluentbit.log"; + pid "/tmp/nginx.pid"; events { worker_connections 1024; } http { - include mime.types; + include /etc/nginx/mime.types; default_type application/octet-stream; log_format main '$remote_addr - $remote_user [$time_local] ' '"$request" $status $body_bytes_sent "$http_referer" ' '"$http_user_agent" "$http_x_forwarded_for"'; - access_log "/opt/bitnami/nginx/logs/access.log" main; + access_log "/var/log/nginx/access.log" main; # add_header X-Frame-Options SAMEORIGIN; - client_body_temp_path "/opt/bitnami/nginx/tmp/client_body" 1 2; - proxy_temp_path "/opt/bitnami/nginx/tmp/proxy" 1 2; - fastcgi_temp_path "/opt/bitnami/nginx/tmp/fastcgi" 1 2; - scgi_temp_path "/opt/bitnami/nginx/tmp/scgi" 1 2; - uwsgi_temp_path "/opt/bitnami/nginx/tmp/uwsgi" 1 2; + client_body_temp_path "/tmp/client_body" 1 2; + proxy_temp_path "/tmp/proxy" 1 2; + fastcgi_temp_path "/tmp/fastcgi" 1 2; + scgi_temp_path "/tmp/scgi" 1 2; + uwsgi_temp_path "/tmp/uwsgi" 1 2; sendfile on; # tcp_nopush on; @@ -419,6 +420,7 @@ objects: } } } + # Frontend Service - apiVersion: v1 @@ -443,7 +445,8 @@ objects: port: 8890 targetPort: 8890 selector: - name: ${SVC_NAME}-frontend + app.kubernetes.io/part-of: ${SVC_NAME} + app.kubernetes.io/name: frontend # Ingress - apiVersion: networking.k8s.io/v1 kind: Ingress @@ -745,7 +748,8 @@ objects: port: 8080 targetPort: 8080 selector: - name: ${SVC_NAME}-webapi + app.kubernetes.io/name: webapi + app.kubernetes.io/part-of: ${SVC_NAME} ########################################### ### Document Manager (backend) ### diff --git a/infrastructure/prime-app-template.yml b/infrastructure/prime-app-template.yml index 774b3b00e8..c79f209dd9 100644 --- a/infrastructure/prime-app-template.yml +++ b/infrastructure/prime-app-template.yml @@ -158,13 +158,13 @@ objects: volumeMounts: - name: vanity-tls-certs readOnly: true - mountPath: /opt/bitnami/nginx/conf/certs + mountPath: /etc/nginx/certs/certs - name: plr-integration-volume readOnly: true - mountPath: /opt/bitnami/nginx/conf/certs/plr + mountPath: /etc/nginx/certs/plr - name: nginx-config readOnly: true - mountPath: /opt/bitnami/nginx/conf/nginx.conf + mountPath: /etc/nginx/nginx.conf subPath: nginx.conf - name: env-config readOnly: true @@ -259,28 +259,28 @@ objects: #user www www; ## Default: nobody worker_processes auto; - error_log "/opt/bitnami/nginx/logs/error.log"; + error_log "/var/log/nginx/error.log"; error_log "/tmp/error_fluentbit.log"; - pid "/opt/bitnami/nginx/tmp/nginx.pid"; + pid "/tmp/nginx.pid"; events { worker_connections 1024; } http { - include mime.types; + include /etc/nginx/mime.types; default_type application/octet-stream; log_format main '$remote_addr - $remote_user [$time_local] ' '"$request" $status $body_bytes_sent "$http_referer" ' '"$http_user_agent" "$http_x_forwarded_for"'; - access_log "/opt/bitnami/nginx/logs/access.log" main; + access_log "/var/log/nginx/access.log" main; # add_header X-Frame-Options SAMEORIGIN; - client_body_temp_path "/opt/bitnami/nginx/tmp/client_body" 1 2; - proxy_temp_path "/opt/bitnami/nginx/tmp/proxy" 1 2; - fastcgi_temp_path "/opt/bitnami/nginx/tmp/fastcgi" 1 2; - scgi_temp_path "/opt/bitnami/nginx/tmp/scgi" 1 2; - uwsgi_temp_path "/opt/bitnami/nginx/tmp/uwsgi" 1 2; + client_body_temp_path "/tmp/client_body" 1 2; + proxy_temp_path "/tmp/proxy" 1 2; + fastcgi_temp_path "/tmp/fastcgi" 1 2; + scgi_temp_path "/tmp/scgi" 1 2; + uwsgi_temp_path "/tmp/uwsgi" 1 2; sendfile on; # tcp_nopush on; @@ -882,8 +882,6 @@ objects: image: >- image-registry.openshift-image-registry.svc:5000/${OC_LICENSE_PLATE}-tools/prime-document-manager:${IMAGE_TAG} command: - # Script force waits migration pod execution until PostgreSQL is verified to - # be open to query connections. - /opt/app-root/src/app.sh args: - migrate diff --git a/prime-angular-frontend/ci.dockerfile b/prime-angular-frontend/ci.dockerfile index 2406ea1c45..82e89ca402 100644 --- a/prime-angular-frontend/ci.dockerfile +++ b/prime-angular-frontend/ci.dockerfile @@ -1,4 +1,4 @@ -FROM public.ecr.aws/bitnami/nginx:1.21 +FROM nginxinc/nginx-unprivileged:1.20 COPY dist/angular-frontend/browser /opt/app-root/src diff --git a/prime-angular-frontend/openshift.dockerfile b/prime-angular-frontend/openshift.dockerfile index 42afe54cea..fd924249ee 100644 --- a/prime-angular-frontend/openshift.dockerfile +++ b/prime-angular-frontend/openshift.dockerfile @@ -44,7 +44,7 @@ RUN ng build --configuration=production ######################################## ### Stage 2 - Production environment ### ######################################## -FROM public.ecr.aws/bitnami/nginx:1.20 +FROM nginxinc/nginx-unprivileged:1.20 ARG SVC_NAME ENV SVC_NAME ${SVC_NAME}