Skip to content

Security Review Changes to aks files #7

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
mriccell merged 2 commits into from
Aug 12, 2021
Merged

Security Review Changes to aks files #7

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
a4cd1dd
Security Review Changes to aks files
jacobt123 Aug 10, 2021
b305741
Modified usage function and Copyright
jacobt123 Aug 10, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 6 additions & 5 deletions weblogic-azure-aks/src/main/arm/scripts/buildWLSDockerImage.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,18 +1,19 @@
# Copyright (c) 2021, Oracle Corporation and/or its affiliates.
# Copyright (c) 2019, 2020, Oracle Corporation and/or its affiliates.
# Licensed under the Universal Permissive License v 1.0 as shown at https://oss.oracle.com/licenses/upl.

#Function to output message to StdErr
function echo_stderr() {
echo "$@" >&2
}

# PENDING(edburns): load <azureACRPassword> and <ocrSSOPSW> from filesystem, from a file that is guaranteed to be secured as required
function load_parameters_from_file() {
# read <azureACRPassword> and <ocrSSOPSW> from stdin
function read_sensitive_parameters_from_stdin() {
read azureACRPassword ocrSSOPSW
}

#Function to display usage message
function usage() {
echo_stdout "./buildWLSDockerImage.sh <wlsImagePath> <azureACRServer> <azureACRUserName> <imageTag> <appPackageUrls> <ocrSSOUser> <wlsClusterSize>"
echo_stdout "<azureACRPassword> <ocrSSOPSW> ./buildWLSDockerImage.sh <wlsImagePath> <azureACRServer> <azureACRUserName> <imageTag> <appPackageUrls> <ocrSSOUser> <wlsClusterSize>"
if [ $1 -eq 1 ]; then
exit 1
fi
Expand Down Expand Up @@ -243,7 +244,7 @@ export ocrLoginServer="container-registry.oracle.com"
export wdtDownloadURL="https://github.com/oracle/weblogic-deploy-tooling/releases/download/release-1.9.7/weblogic-deploy.zip"
export witDownloadURL="https://github.com/oracle/weblogic-image-tool/releases/download/release-1.9.11/imagetool.zip"

load_parameters_from_file
read_sensitive_parameters_from_stdin

validate_inputs

Expand Down
47 changes: 29 additions & 18 deletions weblogic-azure-aks/src/main/arm/scripts/invokeSetupWLSDomain.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,24 +1,16 @@
# Copyright (c) 2021, Oracle Corporation and/or its affiliates.
# Copyright (c) 2019, 2020, Oracle Corporation and/or its affiliates.
# Licensed under the Universal Permissive License v 1.0 as shown at https://oss.oracle.com/licenses/upl.

echo "Script starts"

#Function to output message to stdout
function echo_stderr() {
echo "$@" >&2
>&2 echo "$@"
echo "$@" >>stdout
}

function echo_stdout() {
echo "$@" >&2
echo "$@"
echo "$@" >>stdout
}

# PENDING(edburns): write some of the parameters to file. Others are passed directly to the script.
function write_parameters_to_file() {
}


#Function to display usage message
function usage() {
echo_stdout "./invokeSetupWLSDomain.sh ..."
Expand All @@ -27,13 +19,32 @@ function usage() {
fi
}

#Function to validate input
function validate_input() {

}

validate_input
# Main script
export script="${BASH_SOURCE[0]}"
export scriptDir="$(cd "$(dirname "${script}")" && pwd)"

export ocrSSOUser=${1}
ocrSSOPSW=${2}
export aksClusterRGName=${3}
export aksClusterName=${4}
export wlsImageTag=${5}
export acrName=${6}
export wlsDomainName=${7}
export wlsDomainUID=${8}
export wlsUserName=${9}
wlsPassword=${10}
wdtRuntimePassword=${11}
export wlsCPU=${12}
export wlsMemory=${13}
export managedServerPrefix=${14}
export appReplicas=${15}
export appPackageUrls=${16}
export currentResourceGroup=${17}
export scriptURL=${18}
export storageAccountName=${19}
export wlsClusterSize=${20}

echo ${ocrSSOPSW} ${wlsPassword} ${wdtRuntimePassword} | bash ./setupWLSDomain.sh ${ocrSSOUser} ${aksClusterRGName} ${aksClusterName} ${wlsImageTag} ${acrName} ${wlsDomainName} ${wlsDomainUID} ${wlsUserName} ${wlsCPU} ${wlsMemory} ${managedServerPrefix} ${appReplicas} ${appPackageUrls} ${currentResourceGroup} ${scriptURL} ${storageAccountName} ${wlsClusterSize}

# invoke the setupWLSDomain passing the parameters and the file

exit $exitCode
52 changes: 26 additions & 26 deletions weblogic-azure-aks/src/main/arm/scripts/setupWLSDomain.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
# Copyright (c) 2021, Oracle Corporation and/or its affiliates.
# Copyright (c) 2019, 2020, Oracle Corporation and/or its affiliates.
# Licensed under the Universal Permissive License v 1.0 as shown at https://oss.oracle.com/licenses/upl.

echo "Script starts"
Expand All @@ -14,14 +14,15 @@ function echo_stdout() {
echo "$@" >>stdout
}

# PENDING(edburns): load <wlsPassword> <wdtRuntimePassword> from filesystem, from a file that is guaranteed to be secured as required
function load_parameters_from_file() {
# read <ocrSSOPSW> <wlsPassword> <wdtRuntimePassword> from stdin
function read_sensitive_parameters_from_stdin() {
read ocrSSOPSW wlsPassword wdtRuntimePassword
}


#Function to display usage message
function usage() {
echo_stdout "./setupWLSDomain.sh <ocrSSOUser> <ocrSSOPSW> <aksClusterRGName> <aksClusterName> <wlsImageTag> <acrName> <wlsDomainName> <wlsDomainUID> <wlsUserName> <wlsCPU> <wlsMemory> <managedServerPrefix> <appReplicas> <appPackageUrls> <currentResourceGroup> <scriptURL> <storageAccountName> <wlsClusterSize>"
echo_stdout "<ocrSSOPSW> <wlsPassword> <wdtRuntimePassword> ./setupWLSDomain.sh <ocrSSOUser> <aksClusterRGName> <aksClusterName> <wlsImageTag> <acrName> <wlsDomainName> <wlsDomainUID> <wlsUserName> <wlsCPU> <wlsMemory> <managedServerPrefix> <appReplicas> <appPackageUrls> <currentResourceGroup> <scriptURL> <storageAccountName> <wlsClusterSize>"
Copy link
Member

@mriccell mriccell Aug 10, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Are we displaying the wls password and wdt password to standard out?

Copy link
Contributor Author

@jacobt123 jacobt123 Aug 10, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Here is the response I received from Ed Burns ....

"No, we are not. That is just the usage string, which includes literals like “” and “” for parameters named foo and bar."

Copy link
Member

@mriccell mriccell Aug 10, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I do not think this will be approved

Copy link
Contributor Author

@jacobt123 jacobt123 Aug 10, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@mriccell I have updated it

if [ $1 -eq 1 ]; then
exit 1
fi
Expand Down Expand Up @@ -250,7 +251,7 @@ function build_docker_image() {
--publisher Microsoft.Azure.Extensions \
--version 2.0 \
--settings "{ \"fileUris\": [\"${scriptURL}model.yaml\",\"${scriptURL}model.properties\",\"${scriptURL}buildWLSDockerImage.sh\"]}" \
--protected-settings "{\"commandToExecute\":\"bash buildWLSDockerImage.sh ${wlsImagePath} ${azureACRServer} ${azureACRUserName} ${newImageTag} \\\"${appPackageUrls}\\\" ${ocrSSOUser} ${wlsClusterSize}\"}"
--protected-settings "{\"commandToExecute\":\"echo ${azureACRPassword} ${ocrSSOPSW} | bash ./buildWLSDockerImage.sh ${wlsImagePath} ${azureACRServer} ${azureACRUserName} ${newImageTag} \\\"${appPackageUrls}\\\" ${ocrSSOUser} ${ocrSSOPSW} \"}"
Copy link
Member

@mriccell mriccell Aug 10, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Passing ocr password on the command line?

Copy link
Contributor Author

@jacobt123 jacobt123 Aug 10, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Here is the response I received from Ed Burns ....

No, we are not. We are passing that information in the --protected-settings option to the Azure Resource Manager (ARM). This means the values will not be echoed. The “echo” that you see is for the command that runs inside ARM, and in that case we are using the “allow the script to read sensitive parameters from stdin.

Copy link
Member

@mriccell mriccell Aug 10, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I am ok with this


# If error fires, keep vm resource and exit.
validate_status "Check status of buiding WLS domain image."
Expand Down Expand Up @@ -312,7 +313,7 @@ function setup_wls_domain() {
# * Create PV using Azure file share
# * Create PVC
function create_pv() {
export storageAccountKey=$(az storage account keys list --resource-group $currentResourceGroup --account-name $storageAccountName --query "[0].value" -o tsv)
storageAccountKey=$(az storage account keys list --resource-group $currentResourceGroup --account-name $storageAccountName --query "[0].value" -o tsv)
export azureSecretName="azure-secret"
kubectl -n ${wlsDomainNS} create secret generic ${azureSecretName} \
--from-literal=azurestorageaccountname=${storageAccountName} \
Expand Down Expand Up @@ -446,30 +447,29 @@ function cleanup_vm() {
export script="${BASH_SOURCE[0]}"
export scriptDir="$(cd "$(dirname "${script}")" && pwd)"

export ocrSSOUser=$1
export ocrSSOPSW=$2
export aksClusterRGName=$3
export aksClusterName=$4
export wlsImageTag=$5
export acrName=$6
export wlsDomainName=$7
export wlsDomainUID=$8
export wlsUserName=$9
export wlsCPU=${10}
export wlsMemory=${11}
export managedServerPrefix=${12}
export appReplicas=${13}
export appPackageUrls=${14}
export currentResourceGroup=${15}
export scriptURL=${16}
export storageAccountName=${17}
export wlsClusterSize=${18}
export ocrSSOUser=${1}
export aksClusterRGName=${2}
export aksClusterName=${3}
export wlsImageTag=${4}
export acrName=${5}
export wlsDomainName=${6}
export wlsDomainUID=${7}
export wlsUserName=${8}
export wlsCPU=${9}
export wlsMemory=${10}
export managedServerPrefix=${11}
export appReplicas=${12}
export appPackageUrls=${13}
export currentResourceGroup=${14}
export scriptURL=${15}
export storageAccountName=${16}
export wlsClusterSize=${17}

export adminServerName="admin-server"
export exitCode=0
export ocrLoginServer="container-registry.oracle.com"
export kubectlSecretForACR="regsecret"
export kubectlWLSCredentials="${wlsDomainUID}-weblogic-credentials"
kubectlWLSCredentials="${wlsDomainUID}-weblogic-credentials"
export newImageTag=$(date +%s)
export storageFileShareName="weblogic"
export wlsDomainNS="${wlsDomainUID}-ns"
Expand All @@ -478,7 +478,7 @@ export wlsOptNameSpace="weblogic-operator-ns"
export wlsOptRelease="weblogic-operator"
export wlsOptSA="weblogic-operator-sa"

load_parameters_from_file
read_sensitive_parameters_from_stdin

validate_input

Expand Down