Conversation
The portal loads agent avatars through its own backend since backstage plugin-agent-platform proxies them from this deployment's DiceBear host, so the rendered Content-Security-Policy names no host of the installation. The DiceBear component and its route stay: the backend fetches from them. Also restores the changelog's Unreleased header a previous edit mangled.
teemow
changed the title
Member
Author
|
Closed for now, not abandoned: nine fleet instances still run Backstage 0.245.0, whose frontend loads the avatars from the installation host directly and needs the CSP entry. Reopens once every instance this touches runs 2.48.9 or later. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
The connectivity chart's rendered Backstage app-config listed
https://avatars.<global.domain>in the Content-Security-Policy'simg-src, because the portal's<img>s loaded agent avatars from that host. Since giantswarm/backstage#2521 (Backstage 2.48.9) the portal's backend fetches the avatars from the installation's DiceBear host and serves them same-origin, so the entry is dead configuration, and a header sent with the unauthenticated page no longer needs to name a host of the installation.Change
templates/backstage/app-config.yaml: theimg-srclist is'self',data:and the app-icon CDN; the DiceBear guard around the avatars entry goes with it. The DiceBear component and its public route are unchanged: the backend fetches from them.tests/verify-target.py: the dicebear on/off check asserts that the portal's CSP names noavatars.host either way (and still carries the CDN); a hold keeps the removed line and the app-config checksum it moves out of the golden comparison withorigin/mainuntil main carries this.Makefile.custom.mkverify-wiring: the avatars host leaves the expected-pattern list; a negative check refuses anyavatars.host in the rendered app-config.\1, literal\n\n) restored.Verification
make verify-wiringandmake verify-targetpass locally (5 renders byte-identical to origin/mainwith the hold). Merge after the Backstage release runs on the fleet.