Disable HTTP_PORT and automatic config monitoring - #780
Conversation
| USER 1001 | ||
|
|
||
| EXPOSE 9080 9443 | ||
| EXPOSE 9443 |
There was a problem hiding this comment.
The warm up as part of SCC generation relies on 9080. We should use HTTPS by default if the /openapi endpoint can still be invoked.
leochr
left a comment
leochr
left a comment
There was a problem hiding this comment.
@kabicin Thanks for the PR. Added some comments. As discussed, we should enable these by default for UBI Micro only. We could use the same configure.sh between the UBI variants and set the flag to enable in the relevant Dockerfile only.
| find /opt/ibm/wlp/lib /opt/ibm/wlp/bin ! -perm -g=rw -print0 | xargs -0 -r chmod g+rw | ||
|
|
||
| # Validate the Liberty installation integrity after feature installation | ||
| /opt/ibm/wlp/bin/productInfo validate |
There was a problem hiding this comment.
Add a flag to skip validate. We should still validate by default.
| <server> | ||
| <!-- Disable automatic configuration file monitoring. | ||
| The server will not reload config after startup; a restart is required to apply changes. --> | ||
| <config updateTrigger="disabled" /> |
There was a problem hiding this comment.
Please run the Operator FVT tests with this turned on to ensure that the Operator functionalities, beside Trace, won't be impacted (in particular LTPA).
| @@ -0,0 +1,6 @@ | |||
| <?xml version="1.0" encoding="UTF-8"?> | |||
There was a problem hiding this comment.
Change file name (i.e. update-trigger-disabled.xml)
| mkdir -p ${SNIPPETS_TARGET_DEFAULTS} | ||
|
|
||
| # Disable automatic configuration file monitoring (security hardening) | ||
| cp $SNIPPETS_SOURCE/config-mbean.xml $SNIPPETS_TARGET/config-mbean.xml |
There was a problem hiding this comment.
Consider adding a flag to skip over disabling update trigger.
Should we write to the SNIPPETS_TARGET_DEFAULTS directory so admins/users can override in server.xml?
| WARM_ENDPOINT_URL=https://localhost:9443/ | ||
| WARM_OPENAPI_ENDPOINT=true | ||
| WARM_OPENAPI_ENDPOINT_URL=localhost:9080/openapi | ||
| WARM_OPENAPI_ENDPOINT_URL=https://localhost:9443/openapi |
There was a problem hiding this comment.
Validate that https://localhost:9443/openapi endpoint can still be invoked successfully (which should generate additional cache).
8a0eb22 to
b0ce4c0
Compare
3 participants
HTTP_PORTconfig and allows setting environment variableENABLE_HTTP_PORTtotrueto re-enable it inconfigure.shproductInfo validateafter features are installed infeatures.sh