From 738119cf6d83e1720d0b3232049013847635b903 Mon Sep 17 00:00:00 2001 From: masoodafar-web Date: Thu, 14 May 2026 00:42:36 +0330 Subject: [PATCH] fix: trust staging-ca in container to resolve PartialChain gRPC error Add staging-ca.crt to the Dockerfile so the ASP.NET runtime inside the container trusts the internal staging CA. This fixes server-side gRPC calls from FrontOffice (Blazor Server) to https://cms.se.kbs1.ir which were failing with PartialChain because the container CA store did not include the staging root certificate. Also adds GW_URL env support alongside GwUrl for parity with BackOffice. Co-authored-by: Cursor --- k8s/staging/frontoffice-deployment.yaml | 4 ++-- src/FrontOffice.Main/Dockerfile | 6 ++++-- src/FrontOffice.Main/staging-ca.crt | 18 ++++++++++++++++++ 3 files changed, 24 insertions(+), 4 deletions(-) create mode 100644 src/FrontOffice.Main/staging-ca.crt diff --git a/k8s/staging/frontoffice-deployment.yaml b/k8s/staging/frontoffice-deployment.yaml index 30879bb..88b5cf3 100644 --- a/k8s/staging/frontoffice-deployment.yaml +++ b/k8s/staging/frontoffice-deployment.yaml @@ -29,9 +29,9 @@ spec: - name: ASPNETCORE_ENVIRONMENT value: "Staging" - name: GW_URL - value: "http://cms-svc:8080" + value: "https://cms.se.kbs1.ir" - name: GwUrl - value: "http://cms-svc:8080" + value: "https://cms.se.kbs1.ir" resources: requests: memory: "256Mi" diff --git a/src/FrontOffice.Main/Dockerfile b/src/FrontOffice.Main/Dockerfile index b548502..7773778 100644 --- a/src/FrontOffice.Main/Dockerfile +++ b/src/FrontOffice.Main/Dockerfile @@ -20,10 +20,12 @@ FROM 194.5.195.53:32082/dotnet/aspnet:9.0 AS runtime WORKDIR /app COPY --from=build /app/publish . +# Trust the staging-ca so server-side gRPC calls to https://cms.se.kbs1.ir succeed without PartialChain +COPY ["FrontOffice.Main/staging-ca.crt", "/usr/local/share/ca-certificates/staging-ca.crt"] +RUN update-ca-certificates + ENV ASPNETCORE_URLS=http://+:80 ENV GW_URL=https://cms.se.kbs1.ir -# For Kubernetes staging, override GW_URL/GwUrl to http://cms-svc:8080 via deployment env vars -# to avoid TLS PartialChain when the public ingress cert is not trusted by the container. EXPOSE 80 ENTRYPOINT ["dotnet", "FrontOffice.Main.dll"] diff --git a/src/FrontOffice.Main/staging-ca.crt b/src/FrontOffice.Main/staging-ca.crt new file mode 100644 index 0000000..d115b76 --- /dev/null +++ b/src/FrontOffice.Main/staging-ca.crt @@ -0,0 +1,18 @@ +-----BEGIN CERTIFICATE----- +MIIC9jCCAd6gAwIBAgIQAwobM2pDCheGeQdvVZzMPTANBgkqhkiG9w0BAQsFADAV +MRMwEQYDVQQDEwpzdGFnaW5nLWNhMB4XDTI2MDQyODE5MjU0NVoXDTM2MDQyNTE5 +MjU0NVowFTETMBEGA1UEAxMKc3RhZ2luZy1jYTCCASIwDQYJKoZIhvcNAQEBBQAD +ggEPADCCAQoCggEBALOOLPxgHegrkI9YXm/0wHKchE5ukb8omv2oDYPp/CjQn8yJ +KBpn+8tev8wT1SECACNuA3XhxtjV9dryV5U6lxkmQv2YlLrJOFa3ljcODQpAkKXl +Q+PMWic2VyO9/UkW1a4HcPQfGhpgN710evOfBFB4Ora4CUVsADKPLbjJfX8jpqkU +LAZiQCrA1kJ087fiKheuXEAWPgcwEE5q0BCs876zIHyST6FaLVNabM5/m0sr7Bky +1GQCJlgOLtUeDkaXAv/WJqq/LetcjNy2dWS26PJc7C2byShTfaaWDM8Ki5FG/uMQ +/6L54Lx5QKGbl8MzIKmEscXe4GYnmE8MyHQX0aECAwEAAaNCMEAwDgYDVR0PAQH/ +BAQDAgKkMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFELZSJbeWDRQgj6cTQWY +K2sT9ZsLMA0GCSqGSIb3DQEBCwUAA4IBAQCT2eGmHcd1t4K80NobrUzm1d3SB4EW +XOLCR+TTYFIYsim0eltwzrOuch+MBTf4+v+4zXWE4e7d1B1lzJIqFIXcgLpDu0i2 +QeZMrPxY1rkUhqGPwwsoOWBIK/cGot2yg6SZEwj64f7lKUbUB8aWY+xSzct2mwlG +i0j6wt0/eRh6hKGdvEiYORffdubC94utkNzr0kFszY4yb3vG0zCVWYiGzkxe0IiF +Gc8zN8ZHTY9tk+G5wQuj2WAo7M3DXgFWBbhNgharKulEXTxLXhQksw/nXITa2IwM +qt4MWHdGn7/iIyUp/774ySkFk2n6cHi7gQAvolT6OZNCuAOYm8+No7P6 +-----END CERTIFICATE-----