Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[CI-2501]: Fix theatre-secrets vault-file: behaviour failing when running as non-root #332

Merged
merged 1 commit into from
Feb 5, 2024

Conversation

ijames-gc
Copy link
Contributor

theatre-secrets is intended to be able to run as non-root users as commented here. However, when injecting secrets into named files with vault-file: it creates parent directories with the 0600 permissions mask which prevents it from listing the files in said directories later on if running as non-root when it attempts to create the secret files:

app ts=2024-02-02T16:06:24.809590985Z caller=theatre-secrets/main.go:63 msg="exiting with error" error="failed to ensure path structure is available: mkdir /tmp/secrets/app: permission denied" errorVerbose="mkdir /tmp/secrets/app: permission denied\nfailed to ensure path structure is available\nmain.mainError\n\t

This change ensures that all directories created by theatre-secrets to store secret files are created with rwx permissions (read/write/list-files).

Tested by deploying to lab using tanka (changes here). Verified that the new non-root Atlantis came up healthy in lab with the new version of theatre-secrets deployed.

Copy link

@0x0013 0x0013 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@ijames-gc ijames-gc merged commit 0d6ac7d into master Feb 5, 2024
5 checks passed
@ijames-gc ijames-gc deleted the fix-vault-file-perms branch February 5, 2024 15:43
@ijames-gc ijames-gc mentioned this pull request Feb 5, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants