[CI-2501]: Fix theatre-secrets vault-file:
behaviour failing when running as non-root
#332
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
theatre-secrets
is intended to be able to run as non-root users as commented here. However, when injecting secrets into named files withvault-file:
it creates parent directories with the0600
permissions mask which prevents it from listing the files in said directories later on if running as non-root when it attempts to create the secret files:app ts=2024-02-02T16:06:24.809590985Z caller=theatre-secrets/main.go:63 msg="exiting with error" error="failed to ensure path structure is available: mkdir /tmp/secrets/app: permission denied" errorVerbose="mkdir /tmp/secrets/app: permission denied\nfailed to ensure path structure is available\nmain.mainError\n\t
This change ensures that all directories created by
theatre-secrets
to store secret files are created withrwx
permissions (read/write/list-files
).Tested by deploying to lab using
tanka
(changes here). Verified that the new non-root Atlantis came up healthy in lab with the new version oftheatre-secrets
deployed.