Skip to content

UID2-7804: Revert env_rules workaround (#2720) #2733

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
swibi-ttd merged 1 commit into from
Sep 9, 2026
Merged

UID2-7804: Revert env_rules workaround (#2720) #2733

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
22 changes: 0 additions & 22 deletions scripts/azure-cc/deployment/generate-deployment-artifacts.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -86,29 +86,7 @@ fi
POLICY_DIGEST_FILE=azure-cc-operator-digest-$VERSION_NUMBER.txt
az confcom acipolicygen --approve-wildcards --omit-id --template-file ${OUTPUT_DIR}/operator.json --print-policy > ${INPUT_DIR}/policy.base64
base64 -di < ${INPUT_DIR}/policy.base64 > ${INPUT_DIR}/generated.rego
# Azure ACI injects these managed-identity vars into confidential containers, but confcom's built-in
# ACI-injected allowlist does not yet cover them. Without matching rules the container fails to start,
# since env-var dropping is off below. skr needs IDENTITY_ENDPOINT/IMDS_ENDPOINT to fetch the
# managed-identity token for key release, so they must be allowed rather than dropped. See UID2-7797.
sed -i "s#{\"pattern\":\"IDENTITY_SERVER_THUMBPRINT=.+\",\"required\":false,\"strategy\":\"re2\"},#{\"pattern\":\"IDENTITY_SERVER_THUMBPRINT=.+\",\"required\":false,\"strategy\":\"re2\"},{\"pattern\":\"APP_IDENTITY_ENDPOINT=.+\",\"required\":false,\"strategy\":\"re2\"},{\"pattern\":\"IDENTITY_ENDPOINT=.+\",\"required\":false,\"strategy\":\"re2\"},{\"pattern\":\"IMDS_ENDPOINT=.+\",\"required\":false,\"strategy\":\"re2\"},#g" ${INPUT_DIR}/generated.rego
sed -i "s#allow_environment_variable_dropping := true#allow_environment_variable_dropping := false#g" ${INPUT_DIR}/generated.rego

# Fail loudly if the edits above did not apply. Both seds are anchored on the exact JSON shape
# emitted by az confcom, which is not pinned here - if a future version reorders or renames these
# rules the seds silently no-op and we would publish a policy that cannot attest.
for ACI_ENV_VAR in APP_IDENTITY_ENDPOINT IDENTITY_ENDPOINT IMDS_ENDPOINT; do
RULE_COUNT=$(grep -o "\"${ACI_ENV_VAR}=\.+\"" ${INPUT_DIR}/generated.rego | wc -l)
if [[ ${RULE_COUNT} -ne 2 ]]; then
echo "Expected 2 env_rules for ${ACI_ENV_VAR} (uid2-operator and skr), found ${RULE_COUNT}"
echo "The az confcom output format has likely changed and the env_rules sed no longer matches"
exit 1
fi
done

if ! grep -q "allow_environment_variable_dropping := false" ${INPUT_DIR}/generated.rego; then
echo "allow_environment_variable_dropping is not false in the generated policy"
exit 1
fi
base64 -w0 < ${INPUT_DIR}/generated.rego > ${INPUT_DIR}/generated.rego.base64
python3 ${SCRIPT_DIR}/generate.py ${INPUT_DIR}/generated.rego > ${MANIFEST_DIR}/${POLICY_DIGEST_FILE}

Expand Down
Loading