From 19e2ade1124f59ecc3a55f66c32c44434cd5d79a Mon Sep 17 00:00:00 2001 From: Robby Cochran Date: Thu, 17 Sep 2026 11:23:32 -0700 Subject: [PATCH] fix(acs-ci): pin legacy GCP metadata endpoints --- tasks/acs-ci-nightly/openshell/README.md | 7 ++++--- tasks/acs-ci-nightly/workflow/harness.yaml | 1 + tasks/acs-ci-nightly/workflow/preflight.yaml | 6 +++++- 3 files changed, 10 insertions(+), 4 deletions(-) diff --git a/tasks/acs-ci-nightly/openshell/README.md b/tasks/acs-ci-nightly/openshell/README.md index 34b9a2e..df4a0fd 100644 --- a/tasks/acs-ci-nightly/openshell/README.md +++ b/tasks/acs-ci-nightly/openshell/README.md @@ -14,9 +14,10 @@ credentials. The built-in Google Cloud profile supplies the gateway-managed metadata path that gsutil uses. The workflow's Boto configuration enables gsutil's `[GoogleCompute]` metadata credential lookup without placing a credential in -the sandbox, and `GCE_METADATA_ROOT` points legacy gsutil's metadata client at -OpenShell's loopback emulator. The task policy binds that provider instance -only to the read-only `test-platform-results-public` endpoints. +the sandbox, and the workflow sets both legacy metadata variables explicitly +for gsutil's metadata client. They point at OpenShell's loopback emulator. The +task policy binds that provider instance only to the read-only +`test-platform-results-public` endpoints. The task also points Google Cloud CLI tools at OpenShell's combined CA bundle so `gsutil` verifies the sandbox proxy certificate without disabling TLS. diff --git a/tasks/acs-ci-nightly/workflow/harness.yaml b/tasks/acs-ci-nightly/workflow/harness.yaml index 7034a50..93512a6 100644 --- a/tasks/acs-ci-nightly/workflow/harness.yaml +++ b/tasks/acs-ci-nightly/workflow/harness.yaml @@ -26,6 +26,7 @@ sandbox: CURL_CA_BUNDLE: /etc/openshell-tls/ca-bundle.pem BOTO_CONFIG: /tmp/openshell-boto.cfg GCE_METADATA_ROOT: 127.0.0.1:8174 + GCE_METADATA_IP: 127.0.0.1:8174 source: repo: https://github.com/stackrox/acs-triage-agent.git diff --git a/tasks/acs-ci-nightly/workflow/preflight.yaml b/tasks/acs-ci-nightly/workflow/preflight.yaml index 8e33d5e..cd09eac 100644 --- a/tasks/acs-ci-nightly/workflow/preflight.yaml +++ b/tasks/acs-ci-nightly/workflow/preflight.yaml @@ -15,6 +15,7 @@ sandbox: CURL_CA_BUNDLE: /etc/openshell-tls/ca-bundle.pem BOTO_CONFIG: /tmp/openshell-boto.cfg GCE_METADATA_ROOT: 127.0.0.1:8174 + GCE_METADATA_IP: 127.0.0.1:8174 payloads: - content: | @@ -62,7 +63,10 @@ agent: echo echo "GCS: gsutil ls -b gs://$GCS_BUCKET" - if timeout 30s /opt/gsutil/bin/gsutil ls -b "gs://$GCS_BUCKET" >/dev/null 2>"$gcs_error"; then + if env GCE_METADATA_ROOT=127.0.0.1:8174 \ + GCE_METADATA_IP=127.0.0.1:8174 \ + timeout 30s /opt/gsutil/bin/gsutil ls -b "gs://$GCS_BUCKET" \ + >/dev/null 2>"$gcs_error"; then echo "GCS: PASS" else gcs_status=$?