From 3ea642f9eaaed12fc1015705bcf8e812f3122a6e Mon Sep 17 00:00:00 2001
From: Yuxiang Zhu <yuxzhu@redhat.com>
Date: Sep 14 2018 06:10:29 +0000
Subject: Add CA_URL env var to image


An entrypoint script will download and install the CA certificate
at container start.

---

diff --git a/Dockerfile b/Dockerfile
index 5a24f92..7706568 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -8,8 +8,6 @@ LABEL \
 # The caller should build a waiverdb RPM package using ./rpmbuild.sh and then pass it in this arg.
 ARG waiverdb_rpm
 ARG waiverdb_common_rpm
-# The caller can optionally provide a cacert url
-ARG cacert_url=undefined
 
 COPY $waiverdb_rpm /tmp
 COPY $waiverdb_common_rpm /tmp
@@ -22,15 +20,11 @@ RUN dnf -y install \
     && dnf -y clean all \
     && rm -f /tmp/*
 
-RUN if [ "$cacert_url" != "undefined" ]; then \
-        cd /etc/pki/ca-trust/source/anchors \
-        && curl -O --insecure $cacert_url \
-        && update-ca-trust extract; \
-    fi
+COPY docker/ /docker/
+# Allow a non-root user to install a custom root CA at run-time
+RUN chmod g+w /etc/pki/tls/certs/ca-bundle.crt
 
 USER 1001
 EXPOSE 8080
-
+ENTRYPOINT ["/docker/docker-entrypoint.sh"]
 CMD ["/usr/bin/gunicorn-3", "--bind", "0.0.0.0:8080", "--access-logfile", "-", "--enable-stdio-inheritance", "waiverdb.wsgi:app"]
-
-
diff --git a/docker/docker-entrypoint.sh b/docker/docker-entrypoint.sh
new file mode 100755
index 0000000..1f316cf
--- /dev/null
+++ b/docker/docker-entrypoint.sh
@@ -0,0 +1,18 @@
+#!/bin/bash
+set -e
+
+# CA_URL is the URL of a custom root CA certificate to be installed at run-time
+: ${CA_URL:=}
+
+main() {
+  # installing CA certificate
+  if [ -n "${CA_URL}" ] && [ ! -f "/tmp/.ca-imported" ]; then
+    # Since update-ca-trust doesn't work as a non-root user, let's just append to the bundle directly
+    curl --silent --show-error --location "${CA_URL}" >> /etc/pki/tls/certs/ca-bundle.crt
+    # Create a file so we know not to import it again if the container is restarted
+    touch /tmp/.ca-imported
+  fi
+}
+
+main
+exec "$@"
diff --git a/openshift/containers/waiverdb/Dockerfile b/openshift/containers/waiverdb/Dockerfile
index 2980337..bd843cc 100644
--- a/openshift/containers/waiverdb/Dockerfile
+++ b/openshift/containers/waiverdb/Dockerfile
@@ -24,7 +24,6 @@ RUN dnf -y install python3-gunicorn \
 
 ARG WAIVERDB_GIT_REPO=https://pagure.io/waiverdb.git
 ARG WAIVERDB_GIT_REF=master
-ARG WAIVERDB_CACERT_URL=
 ARG WAIVERDB_VERSION=
 ENV WAIVERDB_VERSION=$WAIVERDB_VERSION
 
@@ -48,9 +47,12 @@ RUN dnf -y install git python3-pip \
   && cp conf/client.conf.example /etc/waiverdb/client.conf \
   && dnf -y history undo last \
   && dnf -y clean all \
+  # Allow a non-root user to install a custom root CA at run-time
+  && cp -r docker/ / \
+  && chmod g+w /etc/pki/tls/certs/ca-bundle.crt \
   && cd / && rm -rf /usr/local/src/waiverdb
 
 USER 1001
 EXPOSE 8080
-
+ENTRYPOINT ["/docker/docker-entrypoint.sh"]
 CMD ["/usr/bin/gunicorn-3", "--bind", "0.0.0.0:8080", "--access-logfile", "-", "--enable-stdio-inheritance", "waiverdb.wsgi:app"]
diff --git a/openshift/waiverdb-test-template.yaml b/openshift/waiverdb-test-template.yaml
index e67a815..6fc1e65 100644
--- a/openshift/waiverdb-test-template.yaml
+++ b/openshift/waiverdb-test-template.yaml
@@ -242,6 +242,8 @@ objects:
               secretKeyRef:
                 name: "waiverdb-test-${TEST_ID}-secret"
                 key: flask-secret-key
+          - name: CA_URL
+            value: https://password.corp.redhat.com/RH-IT-Root-CA.crt
           readinessProbe:
             timeoutSeconds: 1
             initialDelaySeconds: 5