ensure ca-certificate package is installed

ensure update-ca-certificates is called upon startup
ITISFoundation · Oct 24, 2023 · 93962a3 · 93962a3
1 parent c4b0134
commit 93962a3
Show file tree

Hide file tree

Showing 4 changed files with 14 additions and 2 deletions.
diff --git a/services/autoscaling/Dockerfile b/services/autoscaling/Dockerfile
@@ -37,7 +37,6 @@ RUN --mount=type=cache,target=/var/cache/apt,mode=0755,sharing=private \
   # only the cli is needed and we remove the unnecessary stuff again
   docker-ce-cli=${DOCKER_APT_VERSION} \
   && apt-get remove -y\
-  ca-certificates \
   gnupg \
   curl \
   lsb-release \

diff --git a/services/autoscaling/docker/entrypoint.sh b/services/autoscaling/docker/entrypoint.sh
@@ -13,6 +13,13 @@ INFO="INFO: [$(basename "$0")] "
 WARNING="WARNING: [$(basename "$0")] "
 ERROR="ERROR: [$(basename "$0")] "
 
+# Read self-signed SSH certificates (if applicable)
+#
+# In case clusters-keeper must access a docker registry in a secure way using
+# non-standard certificates (e.g. such as self-signed certificates), this call is needed.
+# It needs to be executed as root. Also required to any access for example to secure rabbitmq.
+update-ca-certificates
+
 echo "$INFO" "Entrypoint for stage ${SC_BUILD_TARGET} ..."
 echo "$INFO" "User :$(id "$(whoami)")"
 echo "$INFO" "Workdir : $(pwd)"

diff --git a/services/clusters-keeper/Dockerfile b/services/clusters-keeper/Dockerfile
@@ -37,7 +37,6 @@ RUN --mount=type=cache,target=/var/cache/apt,mode=0755,sharing=private \
   # only the cli is needed and we remove the unnecessary stuff again
   docker-ce-cli=${DOCKER_APT_VERSION} \
   && apt-get remove -y\
-  ca-certificates \
   gnupg \
   curl \
   lsb-release \

diff --git a/services/clusters-keeper/docker/entrypoint.sh b/services/clusters-keeper/docker/entrypoint.sh
@@ -13,6 +13,13 @@ INFO="INFO: [$(basename "$0")] "
 WARNING="WARNING: [$(basename "$0")] "
 ERROR="ERROR: [$(basename "$0")] "
 
+# Read self-signed SSH certificates (if applicable)
+#
+# In case clusters-keeper must access a docker registry in a secure way using
+# non-standard certificates (e.g. such as self-signed certificates), this call is needed.
+# It needs to be executed as root. Also required to any access for example to secure rabbitmq.
+update-ca-certificates
+
 echo "$INFO" "Entrypoint for stage ${SC_BUILD_TARGET} ..."
 echo "$INFO" "User :$(id "$(whoami)")"
 echo "$INFO" "Workdir : $(pwd)"