Run pods as non-root user
Summary of changes:
sdc-cassandra-init
Added user sdc (in base image base_sdc-cqlsh - https://gerrit.onap.org/r/103436)
Run entrypoint as user sdc
Moved relevant files from /root/ to /home/sdc/
sdc-backend-init
Added user sdc (in base image base_sdc-python - https://gerrit.onap.org/r/103436)
Run entrypoint as user sdc
Moved relevant files from /root/ to /home/sdc/
sdc-backend
Run entrypoint as user jetty
Moved relevant files from /root/ to /var/lib/jetty/
Moved cadi & cert files from /opt/app/jetty to /var/lib/jetty/
Moved ready_probe from /var/lib/read-probe.sh to /var/lib/jetty/read-probe.sh
sdc-frontend
Run entrypoint as user jetty
Moved relevant files from /root/ to /var/lib/jetty/
Moved ready_probe from /var/lib/read-probe.sh to /var/lib/jetty/read-probe.sh
sdc-onboard-backend-docker
Run entrypoint as user jetty
Moved relevant files from /root/ to /var/lib/jetty/
Moved ready_probe from /var/lib/read-probe.sh to /var/lib/jetty/read-probe.sh
sdc-onboard-db-init-docker
Run entrypoint as user sdc
Added user sdc (in base image base_sdc-cqlsh - https://gerrit.onap.org/r/103436)
Moved relevant files from /root/ to /home/sdc/
Signed-off-by: MichaelMorris <michael.morris@est.tech>
Issue-ID: SDC-2798
Change-Id: I85be320a4a5e1cc5aeebbb98c4484d5d6fd06dfc
diff --git a/catalog-be/src/main/resources/cadi.properties b/catalog-be/src/main/resources/cadi.properties
index 0d6aee1..bbce361 100644
--- a/catalog-be/src/main/resources/cadi.properties
+++ b/catalog-be/src/main/resources/cadi.properties
@@ -13,7 +13,7 @@
csp_domain=PROD
# Add Absolute path to Keyfile
-cadi_keyfile=/opt/app/jetty/base/be/etc/keyfile
+cadi_keyfile=/var/lib/jetty/opt/be/etc/keyfile
# This is required to accept Certificate Authentication from Certman certificates.
@@ -31,7 +31,7 @@
# Default TrustStore - REQUIRED for changing PROTOCOL Defaults for DME2
# Read https://wiki.web.att.com/pages/viewpage.action?pageId=574623569#URGENT:SolvingSSL2-3/TLSv1removalissues-Up-to-dateTruststore
# Add Absolute path to truststore2018.jks
-cadi_truststore=/opt/app/jetty/base/be/etc/cadi_truststore.jks
+cadi_truststore=/var/lib/jetty/base/be/etc/cadi_truststore.jks
# Note: This is the ONLY password that doesn't have to be encrypted. All Java's TrustStores are this passcode by default, because they are public certs
cadi_truststore_password=changeit
@@ -52,4 +52,4 @@
cadi_longitude=-96.800451
aaf_root_ns=com.att.aaf
-aaf_api_version=2.0
\ No newline at end of file
+aaf_api_version=2.0
diff --git a/catalog-be/src/main/resources/config/configuration.yaml b/catalog-be/src/main/resources/config/configuration.yaml
index 482bea1..8dfe646 100644
--- a/catalog-be/src/main/resources/config/configuration.yaml
+++ b/catalog-be/src/main/resources/config/configuration.yaml
@@ -111,7 +111,7 @@
username: asdc_user
password: Aa1234%^!
ssl: true
- truststorePath : /opt/app/jetty/base/be/config/.truststore
+ truststorePath : /var/lib/jetty/opt/base/be/config/.truststore
truststorePassword : Aa123456
keySpaces:
- { name: dox, replicationStrategy: NetworkTopologyStrategy, replicationInfo: ['DC-sdc-iltlv650', '1']}
@@ -816,7 +816,7 @@
password: XyCUPhFx9u70aklYGo6OiA==
aftDme2SslEnable: true
aftDme2ClientIgnoreSslConfig: false
- aftDme2ClientKeystore: /opt/app/jetty/base/be/config/.truststore
+ aftDme2ClientKeystore: /var/lib/jetty/opt/base/be/config/.truststore
aftDme2ClientKeystorePassword: XyCUPhFx9u70aklYGo6OiA==
aftDme2ClientSslCertAlias: certman
@@ -850,7 +850,7 @@
password: XyCUPhFx9u70aklYGo6OiA==
aftDme2SslEnable: true
aftDme2ClientIgnoreSslConfig: false
- aftDme2ClientKeystore: /opt/app/jetty/base/be/config/.truststore
+ aftDme2ClientKeystore: /var/lib/jetty/opt/jetty/base/be/config/.truststore
aftDme2ClientKeystorePassword: XyCUPhFx9u70aklYGo6OiA==
aftDme2ClientSslCertAlias: certman
@@ -901,9 +901,9 @@
cadiFilterParams:
hostname: 192.168.33.10
csp_domain: PROD
- cadi_keyfile: /opt/app/jetty/base/be/config/catalog-be/keyfile
+ cadi_keyfile: /var/lib/jetty/opt/base/be/config/catalog-be/keyfile
cadi_loglevel: DEBUG
- cadi_truststore: /opt/app/jetty/base/be/config/.truststore
+ cadi_truststore: /var/lib/jetty/opt/base/be/config/.truststore
cadi_truststore_password: enc:XyCUPhFx9u70aklYGo6OiA==
#aaf_url: https://aaf.onap.org/service=?
aaf_id: aaf@sdc.onap.org
@@ -918,4 +918,4 @@
# This configuration entry lists all node type names prefix that shall be allowed on SDC.
definedResourceNamespace:
- - org.openecomp.resource.
\ No newline at end of file
+ - org.openecomp.resource.
diff --git a/catalog-be/src/main/resources/config/distribution-engine-configuration.yaml b/catalog-be/src/main/resources/config/distribution-engine-configuration.yaml
index 1817ecb..65a41e4 100644
--- a/catalog-be/src/main/resources/config/distribution-engine-configuration.yaml
+++ b/catalog-be/src/main/resources/config/distribution-engine-configuration.yaml
@@ -61,7 +61,7 @@
readTimeoutMs: 5000
connectTimeoutMs: 1000
clientCertificate:
- keyStore: /opt/app/jetty/base/be/etc/non-prod.jks
+ keyStore: /var/lib/jetty/opt/base/be/etc/non-prod.jks
keyStorePassword: hmXYcznAljMSisdy8zgcag==
headers:
X-FromAppId: asdc