Merge branch 'main' into bmz-UID2-7146-restrict-deployment-role

Author: BehnamMozafari

pom.xml

@@ -6,7 +6,7 @@
 
     <groupId>com.uid2</groupId>
     <artifactId>uid2-operator</artifactId>
-    <version>5.70.118-alpha-228-SNAPSHOT</version>
+    <version>5.70.131</version>
 
     <properties>
         <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>

scripts/aws/uid2-operator-ami/ansible.cfg

@@ -0,0 +1,14 @@
+# Raise the connection timeout from the default 10s.
+# fixes "Timeout (12s) waiting for privilege escalation prompt" since May 2026
+[defaults]
+timeout = 60
+
+# Reuse one persistent SSH connection for the whole play
+# (ControlMaster/ControlPersist) and pipe module execution over it (pipelining)
+# so we pay the slow SSM setup once instead of per task. ServerAlive keepalives
+# generate traffic so a long-running task's session isn't idle-reaped.
+# Intends to solve an issue where the playbook hangs, seemingly due to the above SSM 
+# setup time.
+[ssh_connection]
+pipelining = True
+ssh_args = -o ControlMaster=auto -o ControlPersist=600s -o ServerAliveInterval=30 -o ServerAliveCountMax=20

scripts/azure-aks/deployment/generate-deployment-artifacts.sh

@@ -82,7 +82,7 @@ fi
 # Export the policy, update it to turn off allow_environment_variable_dropping, and then insert it into the template
 # note that the EnclaveId is generated by generate.py on the raw policy, not the base64 version
 POLICY_DIGEST_FILE=azure-aks-operator-digest-$VERSION_NUMBER.txt
-az confcom acipolicygen --virtual-node-yaml ${OUTPUT_DIR}/operator.yaml --print-policy > ${INPUT_DIR}/policy.base64
+az confcom acipolicygen --omit-id --virtual-node-yaml ${OUTPUT_DIR}/operator.yaml --print-policy > ${INPUT_DIR}/policy.base64
 if [[ $? -ne 0 ]]; then
   echo "Failed to generate ACI policy"
   exit 1

scripts/azure-aks/deployment/operator.yaml

@@ -17,7 +17,7 @@ spec:
         microsoft.containerinstance.virtualnode.injectdns: "false"
     spec:
       containers:
-        - image: "mcr.microsoft.com/aci/skr:2.7"
+        - image: "mcr.microsoft.com/aci/skr:2.14"
           imagePullPolicy: Always
           name: skr
           resources:
@@ -54,8 +54,6 @@ spec:
               value: OPERATOR_KEY_SECRET_NAME_PLACEHOLDER
             - name: DEPLOYMENT_ENVIRONMENT
               value: DEPLOYMENT_ENVIRONMENT_PLACEHOLDER
-            - name: IMAGE_NAME
-              value: IMAGE_PLACEHOLDER
           ports:
             - containerPort: 8080
               protocol: TCP

scripts/azure-cc/azr.py

@@ -88,7 +88,7 @@ def __get_azure_image_info(self) -> str:
         Fetches Image version from non-modifiable environment variable.
         """
         try:
-            return os.getenv("IMAGE_NAME")
+            return os.getenv("IMAGE_VERSION")
         except Exception as e:
             raise RuntimeError(f"Failed to fetch Azure image info: {e}")
 

scripts/azure-cc/deployment/generate-deployment-artifacts.sh

@@ -84,7 +84,7 @@ fi
 # Export the policy, update it to turn off allow_environment_variable_dropping, and then insert it into the template
 # note that the EnclaveId is generated by generate.py on the raw policy, not the base64 version
 POLICY_DIGEST_FILE=azure-cc-operator-digest-$VERSION_NUMBER.txt
-az confcom acipolicygen --approve-wildcards --template-file ${OUTPUT_DIR}/operator.json --print-policy > ${INPUT_DIR}/policy.base64
+az confcom acipolicygen --approve-wildcards --omit-id --template-file ${OUTPUT_DIR}/operator.json --print-policy > ${INPUT_DIR}/policy.base64
 base64 -di < ${INPUT_DIR}/policy.base64 > ${INPUT_DIR}/generated.rego
 sed -i "s#allow_environment_variable_dropping := true#allow_environment_variable_dropping := false#g" ${INPUT_DIR}/generated.rego
 base64 -w0 < ${INPUT_DIR}/generated.rego > ${INPUT_DIR}/generated.rego.base64

scripts/azure-cc/deployment/operator.json

@@ -121,10 +121,6 @@
                 }
               },
               "environmentVariables": [
-                {
-                  "name": "IMAGE_NAME",
-                  "value": "IMAGE_PLACEHOLDER"
-                },
                 {
                   "name": "VAULT_NAME",
                   "value": "[parameters('vaultName')]"