Use nonroot ams sidecar image

k8s-sidecar/Dockerfile

@@ -1,16 +1,22 @@
-FROM alpine
+FROM alpine:3.19.1
+RUN apk --no-cache add bash jq
+RUN apk --no-cache add bash curl
+RUN apk --no-cache add bash tar
 
-RUN apk add bash jq
-RUN apk add bash tar
 
-COPY resources/opa.tar.gz /opa.tar.gz
+WORKDIR /ams
 
-RUN tar -xzf /opa.tar.gz -C /bin/ --remove-files
+RUN adduser -D -u 443 amsnonroot
+RUN chown amsnonroot /ams
 
+COPY resources/opa.tar.gz /opa.tar.gz
+RUN tar -xzf /opa.tar.gz -C /bin/ --remove-files
+RUN chown -R amsnonroot /bin
 RUN chmod +x /bin/opa
 
-COPY k8s-sidecar/start.sh /
+COPY ./sidecar/start.sh .
+COPY ./sidecar/config-template.json .
 
-COPY k8s-sidecar/config-template.json /
+USER amsnonroot
 
-CMD ["/start.sh"]
+CMD ["/bin/bash","/ams/start.sh"]

k8s-sidecar/start.sh

@@ -10,13 +10,13 @@ if [ ${#files[@]} -gt 1 ]; then
   exit 1
 fi
 
-bundle_url=$(cat "${files[0]}/url")/bundle-gateway
+bundle_url=$(cat "${files[0]}/authorization_bundle_url")
 instance_id=$(cat "${files[0]}/authorization_instance_id")
-ias_cert_path=$(pwd -P)/"${files[0]}/certificate"
-ias_key_path=$(pwd -P)/"${files[0]}/key"
+ias_cert_path="${files[0]}/certificate"
+ias_key_path="${files[0]}/key"
 
 jq -n --arg bundleUrl "$bundle_url" --arg iasCertPath "$ias_cert_path" --arg iasKeyPath "$ias_key_path" --arg instanceResource "$instance_id.tar.gz" --arg instanceID "$instance_id" -f config-template.json >config.yml
 
 >&2 echo "INFO: " "$(cat config.yml)"
 
-opa run -s -c config.yml --addr=[]:8181
+opa run -s -c config.yml --set status.plugin=dcl --addr=[]:8181