Upgrade from v.0.19.2 to v.0.19.4 breaks

[awhitepl]

Overview of the Issue

Upgrading to this version critically fails for me. I don't think that we are doing anything bad with the atlantis image we just install some extras like terragrunt and a couple other helper programs. Maintaining at version v.0.19.2 continue to work for me.

Reproduction Steps

Build an image with Gitops, send it to live in k8 cluster in each env. Image gets pulled and fails with backoff with the following error messages.

Logs

│ docker-entrypoint.sh: detected /atlantis-data wrong filesystem permissions                                               │
│ currently owned by root:atlantis, changing to atlantis:atlantis...                                                       │
│ chown: /atlantis-data/lost+found: Operation not permitted                                                                │
│ chown: /atlantis-data/lost+found: Operation not permitted                                                                │
│ chown: /atlantis-data: Operation not permitted                                                                           │
│ chown: /atlantis-data: Operation not permitted       

[michelmzs]

docker-entrypoint.sh: detected /atlantis-data wrong filesystem permissions

Can you share your Dockerfile? There is no related issues with the default image.

[bdashrad]

We are seeing the same issue, upgrading from 0.19.2 to 0.19.4. This is our Dockerfile we're using to add gcloud.

FROM ghcr.io/runatlantis/atlantis:v0.19.4

RUN apk --no-cache --update add \
    python3 \
    py-pip \
  && pip install --upgrade pip \
  && apk add --virtual build-deps \
    gcc \
    libffi-dev \
    python3-dev \
    linux-headers \
    musl-dev \
    openssl-dev \
  && pip install gsutil \
  && apk del build-deps \
  && rm -rf /var/cache/apk/*

[bdashrad]

Looks like my issue is resolved by removing the securityContext set in the older values.yaml and using the current (4.0.x) chart. runatlantis/helm-charts#21

[ysoldak]

We deploy with helm chart to GKE (1.22) on GCP and experience the same.

The persistent volume for "/atlantis-data" mounts as "root:bin" and changing mount point ownership is not permitted.
The most we can have is root:atlantis by setting fsGroup:1000 in securityContext

This is PR that break it for us: #1326
We are going to use fsGroup: 1000 and either hack and disable chown block in docker-entrypoint.sh or stay on v0.19.3

Atlantis shall use fsGroupChangePolicy: "OnRootMismatch" instead of script in docker-entrypoint.sh.
fsGroupChangePolicy is stable in K8S 1.23

[jamengual]

Correct me if I'm wrong :
we should use fsGroupChangePolicy since now is stable but it was not when that PR was implemented ( but I merged it no long ago ) and we will have to ever the entry-point changes , correct?

[ysoldak]

Yes, correct, @jamengual
See my PRs to this repo and helm-charts.

[ysoldak]

[Temporary] hack for docker-entry point.sh is to build your own image based on atlantis and use it in helm:

FROM ghcr.io/runatlantis/atlantis:v0.19.4
RUN sed -i.bak "s,/atlantis-data,/disabled," /usr/local/bin/docker-entrypoint.sh

[jamengual]

I'm tempted to create a new release just to get rid of this issue but we can't really do it right now, I can create a pre-release , but I have not looked if the image URL can be changed in the values.

[ysoldak]

In helm chart you mean? Yes, we can set the tag there, here
https://github.com/runatlantis/helm-charts/blob/main/charts/atlantis/values.yaml#L103

[jamengual]

then you can use the prerelease from today without having to build an image

…

On Wed., Jun. 22, 2022, 1:31 p.m. Yurii Soldak, ***@***.***> wrote: In helm chart you mean? Yes, we can set the tag there, here https://github.com/runatlantis/helm-charts/blob/main/charts/atlantis/values.yaml#L103 — Reply to this email directly, view it on GitHub <#2322 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAQ3ERD2KATKQ2FZDFMOPVDVQNZ2ZANCNFSM5YY64Y5A> . You are receiving this because you modified the open/close state.Message ID: ***@***.***>