From ca1d26cc672434d7c6ddff3917737fd8e72548a5 Mon Sep 17 00:00:00 2001 From: dandds Date: Thu, 30 Jan 2020 16:28:02 -0500 Subject: [PATCH 1/8] Give the cluster perms to create load balancers. In order for the cluster app registration to create new load balancers, it needs to have the Network Contributor role for the virtual network. In the future, we should create a custom policy scoped to exactly the permissions the cluster needs, per: https://docs.microsoft.com/en-us/azure/aks/configure-azure-cni#prerequisites --- terraform/modules/k8s/main.tf | 6 ++++++ terraform/modules/k8s/variables.tf | 7 ++++++- terraform/modules/vpc/outputs.tf | 6 +++++- terraform/providers/dev/k8s.tf | 1 + 4 files changed, 18 insertions(+), 2 deletions(-) diff --git a/terraform/modules/k8s/main.tf b/terraform/modules/k8s/main.tf index 8ecbb4cd..1d46fc4c 100644 --- a/terraform/modules/k8s/main.tf +++ b/terraform/modules/k8s/main.tf @@ -81,3 +81,9 @@ resource "azurerm_monitor_diagnostic_setting" "k8s_diagnostic-1" { } } } + +resource "azurerm_role_assignment" "k8s_network_contrib" { + scope = var.vnet_id + role_definition_name = "Network Contributor" + principal_id = azurerm_kubernetes_cluster.k8s.identity[0].principal_id +} diff --git a/terraform/modules/k8s/variables.tf b/terraform/modules/k8s/variables.tf index 79bac3de..1445bdae 100644 --- a/terraform/modules/k8s/variables.tf +++ b/terraform/modules/k8s/variables.tf @@ -66,4 +66,9 @@ variable "client_secret" { variable "workspace_id" { description = "Log Analytics workspace for this resource to log to" type = string -} \ No newline at end of file +} + +variable "vnet_id" { + description = "The ID of the VNET that the AKS cluster app registration needs to provision load balancers in" + type = string +} diff --git a/terraform/modules/vpc/outputs.tf b/terraform/modules/vpc/outputs.tf index baa32935..b1f0fe38 100644 --- a/terraform/modules/vpc/outputs.tf +++ b/terraform/modules/vpc/outputs.tf @@ -6,4 +6,8 @@ output "subnet_list" { value = { for k, id in azurerm_subnet.subnet : k => id } -} \ No newline at end of file +} + +output "id" { + value = azurerm_virtual_network.vpc.id +} diff --git a/terraform/providers/dev/k8s.tf b/terraform/providers/dev/k8s.tf index fe3dac18..33cbabe4 100644 --- a/terraform/providers/dev/k8s.tf +++ b/terraform/providers/dev/k8s.tf @@ -23,6 +23,7 @@ module "k8s" { client_id = data.azurerm_key_vault_secret.k8s_client_id.value client_secret = data.azurerm_key_vault_secret.k8s_client_secret.value workspace_id = module.logs.workspace_id + vnet_id = module.vpc.id } #module "main_lb" { From 10f8bf9503df15610a6770d53276d1f2898c7d1e Mon Sep 17 00:00:00 2001 From: dandds Date: Fri, 31 Jan 2020 06:18:54 -0500 Subject: [PATCH 2/8] Fix bug in setting Secure on session cookie. This fixes a bug I introduced with commit 6edc7b138b0745d0b3f9d99da76c445fe954c5a7 The value for SESSION_COOKIE_SECURE was being read in as a truthy string every time. In order for it to be interpreted correctly, we need to map it to a boolean. --- atst/app.py | 1 + 1 file changed, 1 insertion(+) diff --git a/atst/app.py b/atst/app.py index 29476ed8..05578827 100644 --- a/atst/app.py +++ b/atst/app.py @@ -193,6 +193,7 @@ def map_config(config): "CONTRACT_END_DATE": datetime.strptime( config.get("default", "CONTRACT_END_DATE"), "%Y-%m-%d" ).date(), + "SESSION_COOKIE_SECURE": config.getboolean("default", "SESSION_COOKIE_SECURE"), } From 8d30fd4cfb8753146863c0278d393d23ffc0daf1 Mon Sep 17 00:00:00 2001 From: leigh-mil Date: Fri, 31 Jan 2020 11:52:15 -0500 Subject: [PATCH 3/8] Remove extra --- templates/portfolios/admin.html | 1 - 1 file changed, 1 deletion(-) diff --git a/templates/portfolios/admin.html b/templates/portfolios/admin.html index 9eed77d1..eb2f8228 100644 --- a/templates/portfolios/admin.html +++ b/templates/portfolios/admin.html @@ -54,7 +54,6 @@ {% endif %} -
From 881bf3220cb5b0750705b42b0b26c21c62d48963 Mon Sep 17 00:00:00 2001 From: leigh-mil Date: Fri, 31 Jan 2020 11:57:15 -0500 Subject: [PATCH 4/8] fix formatting --- templates/portfolios/admin.html | 26 +++++++++++++------------- 1 file changed, 13 insertions(+), 13 deletions(-) diff --git a/templates/portfolios/admin.html b/templates/portfolios/admin.html index eb2f8228..40721c0d 100644 --- a/templates/portfolios/admin.html +++ b/templates/portfolios/admin.html @@ -40,20 +40,20 @@ {% endif %} -
-
-
{{ "portfolios.admin.defense_component_label" | translate }}
- {% if portfolio.defense_component %} -
- {% for component in portfolio.defense_component %} - {{ "forms.portfolio.defense_component.choices.%s" | format(component) | translate }}
- {% endfor %} -
- {% else %} -
{{ "fragments.portfolio_admin.none" | translate }}
- {% endif %} -
+
+
+
{{ "portfolios.admin.defense_component_label" | translate }}
+ {% if portfolio.defense_component %} +
+ {% for component in portfolio.defense_component %} + {{ "forms.portfolio.defense_component.choices.%s" | format(component) | translate }}
+ {% endfor %} +
+ {% else %} +
{{ "fragments.portfolio_admin.none" | translate }}
+ {% endif %}
+
From dff9924c95685804955660767b4e194c87619ac2 Mon Sep 17 00:00:00 2001 From: leigh-mil Date: Mon, 27 Jan 2020 15:46:33 -0500 Subject: [PATCH 5/8] Make file size limit configurable --- .secrets.baseline | 4 ++-- atst/forms/task_order.py | 11 +++++++++-- atst/routes/task_orders/new.py | 1 + config/base.ini | 1 + js/components/upload_input.js | 6 +++++- templates/components/upload_input.html | 5 +++-- templates/task_orders/step_1.html | 2 +- tests/render_vue_component.py | 10 +++++++--- translations.yaml | 4 ++-- 9 files changed, 31 insertions(+), 13 deletions(-) diff --git a/.secrets.baseline b/.secrets.baseline index e343eb4f..a233e4cf 100644 --- a/.secrets.baseline +++ b/.secrets.baseline @@ -3,7 +3,7 @@ "files": "^.secrets.baseline$|^.*pgsslrootcert.yml$", "lines": null }, - "generated_at": "2020-01-29T16:40:16Z", + "generated_at": "2020-01-27T19:24:43Z", "plugins_used": [ { "base64_limit": 4.5, @@ -82,7 +82,7 @@ "hashed_secret": "afc848c316af1a89d49826c5ae9d00ed769415f3", "is_secret": false, "is_verified": false, - "line_number": 31, + "line_number": 32, "type": "Secret Keyword" } ], diff --git a/atst/forms/task_order.py b/atst/forms/task_order.py index 8d40c015..2a5c1731 100644 --- a/atst/forms/task_order.py +++ b/atst/forms/task_order.py @@ -26,6 +26,7 @@ from atst.utils.localization import translate from flask import current_app as app MAX_CLIN_AMOUNT = 1_000_000_000 +FILE_SIZE_LIMIT = 64 def coerce_enum(enum_inst): @@ -164,8 +165,14 @@ class TaskOrderForm(BaseForm): ) pdf = FormField( AttachmentForm, - label=translate("task_orders.form.supporting_docs_size_limit"), - description=translate("task_orders.form.supporting_docs_size_limit"), + label=translate( + "task_orders.form.supporting_docs_size_limit", + {"file_size_limit": FILE_SIZE_LIMIT}, + ), + description=translate( + "task_orders.form.supporting_docs_size_limit", + {"file_size_limit": FILE_SIZE_LIMIT}, + ), ) clins = FieldList(FormField(CLINForm)) diff --git a/atst/routes/task_orders/new.py b/atst/routes/task_orders/new.py index eaf6f2b2..eab7812f 100644 --- a/atst/routes/task_orders/new.py +++ b/atst/routes/task_orders/new.py @@ -24,6 +24,7 @@ def render_task_orders_edit( render_args["contract_start"] = app.config.get("CONTRACT_START_DATE") render_args["contract_end"] = app.config.get("CONTRACT_END_DATE") + render_args["file_size_limit"] = int(app.config.get("FILE_SIZE_LIMIT")) if task_order_id: task_order = TaskOrders.get(task_order_id) diff --git a/config/base.ini b/config/base.ini index 3504e3cd..3294c7af 100644 --- a/config/base.ini +++ b/config/base.ini @@ -18,6 +18,7 @@ DEBUG = true DEBUG_MAILER = false DISABLE_CRL_CHECK = false ENVIRONMENT = dev +FILE_SIZE_LIMIT = 64000000 LIMIT_CONCURRENT_SESSIONS = false LOG_JSON = false MAIL_PASSWORD diff --git a/js/components/upload_input.js b/js/components/upload_input.js index d7c90bf5..ae155c48 100644 --- a/js/components/upload_input.js +++ b/js/components/upload_input.js @@ -20,6 +20,9 @@ export default { portfolioId: { type: String, }, + sizeLimit: { + type: String, + }, }, data: function() { @@ -31,6 +34,7 @@ export default { sizeError: false, filenameError: false, downloadLink: '', + fileSizeLimit: parseInt(this.sizeLimit), } }, @@ -48,7 +52,7 @@ export default { this.clearErrors() const file = e.target.files[0] - if (file.size > 64000000) { + if (file.size > this.fileSizeLimit) { this.sizeError = true return } diff --git a/templates/components/upload_input.html b/templates/components/upload_input.html index c86b6ab6..882fcaef 100644 --- a/templates/components/upload_input.html +++ b/templates/components/upload_input.html @@ -1,6 +1,6 @@ {% from "components/icon.html" import Icon %} -{% macro UploadInput(field, portfolio_id, show_label=False) -%} +{% macro UploadInput(field, portfolio_id, file_size_limit, show_label=False) -%}
@@ -47,7 +48,7 @@ {{ "forms.task_order.upload_error" | translate }}