Repository navigation
Cosmos DB NoSQL samples: no LocalStack CA, the endpoint is publicly trusted - #55
Merged
Merged
Conversation
…LocalStack CA The emulator now serves the Cosmos DB for NoSQL endpoint (<account>.cosmos.azure.localhost.localstack.cloud) with the LocalStack public certificate, so the Python and .NET Vacation Planner verify it with their default trust store, on the emulator as on Azure. The LocalStack-only steps that installed the LocalStack root CA are removed: the localstack-ca ConfigMap, the REQUESTS_CA_BUNDLE / SSL_CERT_FILE variables and their volume, the CA mount of the local Docker run and the LOCALSTACK_URL variable. Left in place, the Python sample's REQUESTS_CA_BUNDLE would now make it distrust the endpoint. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FvNuJLfY2KkMwaymfFnz7R
Contributor
There was a problem hiding this comment.
🔵 Needs a closer look
The required rollout of localstack/localstack-pro#10406 to localstack/localstack-azure:latest remains unverified, while removing CA trust breaks NoSQL CI with the prior image and reported emulator tests used a custom image.
No open issues 🎉
What changed in this PR
Updates the Python and .NET Cosmos DB NoSQL samples to use default certificate trust stores instead of installing the LocalStack root CA. This aligns the samples with the emulator’s publicly trusted endpoint and removes Azure-specific configuration cleanup. The PR description notes that merging depends on the emulator change shipping in localstack/localstack-azure:latest.
Changes:
- Removes CA downloads, Docker mounts, Kubernetes ConfigMap creation, and certificate environment overrides.
- Removes the unused
LOCALSTACK_URLsetting and related README instructions. - Deletes the ignore rule for the CA file that scripts no longer generate.
| File | Description |
|---|---|
samples/web-app-cosmosdb-nosql-api/python/scripts/deployment.yml |
Removes the CA mount and REQUESTS_CA_BUNDLE override. |
samples/web-app-cosmosdb-nosql-api/python/scripts/05-deploy-app.sh |
Removes CA download and ConfigMap creation. |
samples/web-app-cosmosdb-nosql-api/python/scripts/03-run-docker-container.sh |
Removes CA handling and its path-conversion helper. |
samples/web-app-cosmosdb-nosql-api/python/scripts/00-variables.sh |
Removes LOCALSTACK_URL. |
samples/web-app-cosmosdb-nosql-api/python/README.md |
Removes obsolete CA setup guidance. |
samples/web-app-cosmosdb-nosql-api/dotnet/scripts/deployment.yml |
Removes the CA mount and SSL_CERT_FILE override. |
samples/web-app-cosmosdb-nosql-api/dotnet/scripts/05-deploy-app.sh |
Removes CA download and ConfigMap creation. |
samples/web-app-cosmosdb-nosql-api/dotnet/scripts/03-run-docker-container.sh |
Removes CA handling and its path-conversion helper. |
samples/web-app-cosmosdb-nosql-api/dotnet/scripts/00-variables.sh |
Removes LOCALSTACK_URL. |
samples/web-app-cosmosdb-nosql-api/dotnet/README.md |
Removes obsolete CA setup guidance. |
.gitignore |
Removes the generated CA-file rule and updates its comment. |
Review effort: Balanced
Collaborator
Author
|
Answering Copilot's overview:
Correct on all three counts, and it is the intended order:
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Motivation
The Python and .NET
web-app-cosmosdb-nosql-apisamples installed the LocalStack root CA so that the app would trust the emulated Cosmos DB endpoint:05-deploy-app.shstored it in alocalstack-caConfigMap,deployment.ymlmounted it and pointedREQUESTS_CA_BUNDLE(Python) orSSL_CERT_FILE(.NET) at it,03-run-docker-container.shmounted it into the local Docker run, and00-variables.shcarried aLOCALSTACK_URLthat readers had to empty before a run on Azure. Those steps existed only for the emulator, anddeployment.ymlasked readers to remove them when switching to Azure.localstack/localstack-pro pull request 10406 makes the emulator serve the Cosmos DB for NoSQL endpoint, now
<account>.cosmos.azure.localhost.localstack.cloud, with the LocalStack public certificate. The samples then verify it with their default trust store, as they verify<account>.documents.azure.comon Azure, so the steps go. Left in place, the Python sample'sREQUESTS_CA_BUNDLE, which holds only the LocalStack root CA, would make its pods reject the endpoint, and also every other emulator endpoint served with the public certificate, such as Key Vault and Blob Storage.Fixes SMF-1138
Changes
samples/web-app-cosmosdb-nosql-api/pythonandsamples/web-app-cosmosdb-nosql-api/dotnet:scripts/05-deploy-app.sh: no longer downloads the LocalStack root CA or creates thelocalstack-caConfigMap.scripts/deployment.yml: noREQUESTS_CA_BUNDLE/SSL_CERT_FILEvariable, volume mount orlocalstack-cavolume.scripts/03-run-docker-container.sh: no CA download or mount, and nonative_path, which only the CA file used.scripts/00-variables.sh: noLOCALSTACK_URL.README.md: the LocalStack note aboutLOCALSTACK_URLand the root CA is removed..gitignore: the entry for the CA file that03-run-docker-container.shwrote is removed.The MongoDB API samples need no change: they install no CA, and their endpoint does not use TLS in the emulator.
Tests
The same scripts ran on both targets,
01to05in order, after a cluster created byscripts/01-user-assigned-managed-identity.sh; the Python and .NET samples share the account and the namespace, so each language ran in turn.https://local-nosql-test.cosmos.azure.localhost.localstack.cloud:4511/, and the endpoint presents the Google Trust Services chain.03-run-docker-container.sh: both apps answer/healthwithokand store and list an activity, with no CA variable in the container.05-deploy-app.shandtests/test-vacation-planner.sh: both languages pass (health, add, delete). In a Python pod, with no CA variable, TLS to Cosmos DB, Key Vault and Blob Storage verifies with certifi. With the previous version of the sample, Key Vault and Blob Storage failed in that pod.italynorth), on a real AKS cluster with the same cluster script (only its prefix, a node ceiling of 4 and the admin credentials changed for the run):03-run-docker-container.sh: both apps answer/healthwithokand store and list an activity.05-deploy-app.shandtests/test-vacation-planner.sh: both languages pass (health, add, delete).bash -npasses on the changed scripts,yqparses both manifests, andpre-commit run: gitleaks passed, zizmor skipped.Related
localstack/localstack-azure:latest. Until then the Cosmos DB for NoSQL jobs of this repository's Samples CI fail, because the published image still serves a LocalStack-CA certificate the samples no longer trust.🤖 Generated with Claude Code
https://claude.ai/code/session_01FvNuJLfY2KkMwaymfFnz7R