Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Provide writable directories by default #67

Merged
merged 1 commit into from
Oct 5, 2022

Conversation

jawnsy
Copy link
Contributor

@jawnsy jawnsy commented Oct 3, 2022

Closes: #54


Orion

I've installed orion using the following command, to disable PostgreSQL:

helm upgrade prefect-orion ./charts/prefect-orion --install --set=postgresql.enabled=false

I then verified that orion starts successfully using SQLite:

$ kubectl exec -it deployment/prefect-orion -- ls -alR
.:
total 16
drwxrwsrwx 3 root 1001 4096 Oct  4 23:33 .
drwxr-xr-x 1 root root 4096 Oct  4 23:28 ..
-rw------- 1 1001 1001   34 Oct  4 23:33 .bash_history
drwxr-sr-x 2 1001 1001 4096 Oct  4 23:36 .prefect

./.prefect:
total 584
drwxr-sr-x 2 1001 1001   4096 Oct  4 23:36 .
drwxrwsrwx 3 root 1001   4096 Oct  4 23:33 ..
-rw-r--r-- 1 1001 1001     93 Oct  4 23:29 memo_store.toml
-rw-r--r-- 1 1001 1001 585728 Oct  4 23:29 orion.db

From filesystem mounts, both the home directory and tmp directory are available and writable:

$ kubectl exec -it deployment/prefect-orion -- findmnt | grep -E '(/tmp|home)'
├─/tmp /dev/sda1[/var/lib/kubelet/pods/8ed9efee-1f96-4c6b-a920-03f382656089/volumes/kubernetes.io~empty-dir/scratch/tmp]
├─/home/prefect
│      /dev/sda1[/var/lib/kubelet/pods/8ed9efee-1f96-4c6b-a920-03f382656089/volumes/kubernetes.io~empty-dir/scratch/home]

Agent

I've installed the agent using the following command:

helm upgrade prefect-agent ./charts/prefect-agent --install --set=agent.cloudApiConfig.accountId=aa44c164-ecc4-4c76-9c85-4a2f1835f36b --set=agent.cloudApiConfig.workspaceId=b97ece4a-c5a2-4430-95ff-b6e6eb20d7ea

I verified that I can install packages:

$ kubectl exec -it deployment/prefect-agent -- pip install pytest
Defaulting to user installation because normal site-packages is not writeable
Requirement already satisfied: pytest in ./.local/lib/python3.10/site-packages (7.1.3)
Requirement already satisfied: attrs>=19.2.0 in /usr/local/lib/python3.10/site-packages (from pytest) (22.1.0)
Requirement already satisfied: iniconfig in ./.local/lib/python3.10/site-packages (from pytest) (1.1.1)
Requirement already satisfied: packaging in /usr/local/lib/python3.10/site-packages (from pytest) (21.3)
Requirement already satisfied: py>=1.8.2 in ./.local/lib/python3.10/site-packages (from pytest) (1.11.0)
Requirement already satisfied: pluggy<2.0,>=0.12 in ./.local/lib/python3.10/site-packages (from pytest) (1.0.0)
Requirement already satisfied: tomli>=1.0.0 in ./.local/lib/python3.10/site-packages (from pytest) (2.0.1)
Requirement already satisfied: pyparsing!=3.0.5,>=2.0.2 in /usr/local/lib/python3.10/site-packages (from packaging->pytest) (3.0.9)
WARNING: You are using pip version 21.3.1; however, version 22.2.2 is available.
You should consider upgrading via the '/usr/local/bin/python -m pip install --upgrade pip' command.

@jawnsy jawnsy self-assigned this Oct 3, 2022
@jamiezieziula jamiezieziula added the fix A fix for a bug in an existing feature label Oct 4, 2022
@jawnsy jawnsy force-pushed the jawnsy/add-readonly-support branch from 4af82ed to 72508b4 Compare October 4, 2022 22:52
* Mount scratch space to /tmp and /home/prefect by default, and
  configure the container working directory and HOME directory
  accordingly
* Add documentation for different installation options (default
  fully-unprivileged, running as root, and running in OpenShift)
@jawnsy jawnsy force-pushed the jawnsy/add-readonly-support branch from 72508b4 to 2fac42c Compare October 4, 2022 23:31
@jawnsy jawnsy marked this pull request as ready for review October 4, 2022 23:40
@jawnsy jawnsy requested review from gabcoyne, zanieb and a team as code owners October 4, 2022 23:40
Copy link
Contributor

@jamiezieziula jamiezieziula left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm! thank you!

@jamiezieziula jamiezieziula merged commit bf577f1 into main Oct 5, 2022
@jamiezieziula jamiezieziula deleted the jawnsy/add-readonly-support branch October 5, 2022 00:01
@Seldonm
Copy link

Seldonm commented Oct 5, 2022

I tried to install the chart with the last version 2.4.5 but it seems that is still using the old path (/opt/prefect), giving a write permission error when the pod starts

@jamiezieziula
Copy link
Contributor

@Seldonm just to clarify - you installed the chart with the latest release or with the latest local version available from this repo?

@Seldonm
Copy link

Seldonm commented Oct 5, 2022

@Seldonm just to clarify - you installed the chart with the latest release or with the latest local version available from this repo?

i installed the latest release from the Helm repository, chart version 2022.10.04

@jamiezieziula
Copy link
Contributor

Got it - that doesn't contain this PR. I'll get a release out tomorrow that will have this change in it.

@Seldonm
Copy link

Seldonm commented Oct 5, 2022

Got it - that doesn't contain this PR. I'll get a release out tomorrow that will have this change in it.

Thank you very much. Meanwhile i'll test it by building locally the repo

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
fix A fix for a bug in an existing feature
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Errors caused by new default security settings
3 participants