search

Oteemo / charts

Helm chart repository
https://oteemo.github.io/charts
MIT License
181 stars 232 forks source link

[sonarqube] init container fails to chmod directories #87

Open BryanHunt opened 4 years ago

BryanHunt commented 4 years ago

After I hacked the template to include the certs mount, the init container now fails on the chmod:

drwxr-xr-x    7 root     root            73 Apr 11 02:39 .
drwxr-xr-x    3 root     root            23 Apr 11 02:39 ..
drwxrwsr-x    2 root     999              6 Apr 11 02:26 certs
drwxrwxr-x    2 999      999              6 Apr 11 01:48 data
drwxr-xr-x    4 root     root            38 Apr 11 02:39 extensions
drwxrwxr-x    2 999      999             37 Apr 11 01:48 logs
drwxrwxr-x    4 999      999             57 Apr 11 02:13 temp
chown: /opt/sonarqube/temp/conf/es/elasticsearch.yml: Operation not permitted
chown: /opt/sonarqube/temp/conf/es/jvm.options: Operation not permitted
chown: /opt/sonarqube/temp/conf/es/log4j2.properties: Operation not permitted
chown: /opt/sonarqube/temp/conf/es/elasticsearch.keystore: Operation not permitted
chown: /opt/sonarqube/temp/conf/es: Operation not permitted
chown: /opt/sonarqube/temp/conf/es: Operation not permitted
chown: /opt/sonarqube/temp/conf: Operation not permitted
chown: /opt/sonarqube/temp/conf: Operation not permitted
chown: /opt/sonarqube/temp/jna-3506402: Operation not permitted
chown: /opt/sonarqube/temp/jna-3506402: Operation not permitted
chown: /opt/sonarqube/certs: Operation not permitted
chown: /opt/sonarqube/certs: Operation not permitted

Also, the chmod is hardcoded to 999:999 which is probably bad if I use a custom security context.

BryanHunt commented 4 years ago

I completely commented out the mkdir/chmod init container, and the sonarqube pod started just fine.

VioletHynes commented 4 years ago

This sounds not dissimilar from my issue here: https://github.com/Oteemo/charts/issues/56

Frustratingly, you can get around it by running as root, but then Sonarqube can't start.

rjkernick commented 4 years ago

I can add functionality to turn this off. Might have been needed for earlier versions of the software. This chart is a couple years old at this point.

VioletHynes commented 4 years ago

One fix would be to make this container run as a different security context than the rest of the software (or allow this through configuration)

If I set the following, this runs as 999:999, and therefore fails: securityContext: fsGroup: 999 runAsUser: 999

I don't mind this init pod running as root, but if I remove the runAsUser: 999 to do that, then Sonar can't start

anitabee commented 4 years ago

We are running in-house version of k8s cluster that is not allowing run of privileged containers, so :+1: for switching it off. @rjkernick depending on what exactly you had in mind for switching it off, maybe also provide functionality to load additional init containers, something like extraInitContainers approach followed by many other charts?