1666069 - Permit remote settings access for mozilla/ccadb2onecrl

Status: RESOLVED FIXED

(Core :: Security Block-lists, Allow-lists, and other State, task)

Description

[J.C. Jones [:jcj] (he/they)]

The container running the mozilla/ccadb2onecrl image requires access to both the Stage and Prod Remote Settings, so it will need to have suitable firewall ports opened.

ONECRL_PRODUCTION and ONECRL_STAGING arguments correspond with Remote Settings Stage and Remote Settings Prod environments, from the perspective of the ccadb2onecrl tool.

Comment 1

[Erik Olson]

What are the URLs that you have been using for dev and/or local testing?

Comment 2

[J.C. Jones [:jcj] (he/they)]

I would expect them to be:

ONECRL_PRODUCTION="https://settings.prod.mozaws.net/v1"
ONECRL_STAGING="https://settings.stage.mozaws.net/v1"

That's what I used for the test run that produced real data.

For local testing, they are http://localhost:8888/v1 addresses for the instances raised by cd kinto/local; docker-compose up

Comment 3

[Erik Olson]

The app that can accept writes is at these endpoints:

ONECRL_PRODUCTION = 'https://settings-writer.prod.mozaws.net/v1'
ONECRL_STAGING = 'https://settings-writer.stage.mozaws.net/v1'

The job is running from a jenkins worker that has a whitelisted IP for the writer app.