You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@pulsar.apache.org by GitBox <gi...@apache.org> on 2021/05/29 20:49:13 UTC
[GitHub] [pulsar] zzzming opened a new pull request #10743: Rootless container mount user token secret in the default 644 permission for Function Kubernetes runtime
zzzming opened a new pull request #10743:
URL: https://github.com/apache/pulsar/pull/10743
### Motivation
In the rootless docker container, Function Kubernetes runtime needs to read /etc/auth/token. But currently the file permission is mounted as 400 under `root`.
### Modifications
Use the default Kubernetes secret mount permission, which allows non-root user to read the auth token.
### Verifying this change
### Does this pull request potentially affect one of the following parts:
*If `yes` was chosen, please highlight the changes*
- Dependencies (does it add or upgrade a dependency): no
- The public API: no
- The schema: no
- The default values of configurations: no
- The wire protocol: no
- The rest endpoints: no
- The admin cli options: no
- Anything that affects deployment: no
### Documentation
- Does this pull request introduce a new feature? no
- If yes, how is the feature documented? not applicable
- If a feature is not applicable for documentation, explain why?
- If a feature is not documented yet in this PR, please create a followup issue for adding the documentation
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [pulsar] sijie commented on pull request #10743: Rootless container mount user token secret in the default 644 permission for Function Kubernetes runtime
Posted by GitBox <gi...@apache.org>.
sijie commented on pull request #10743:
URL: https://github.com/apache/pulsar/pull/10743#issuecomment-856530990
@lhotari @eolivelli for functions change, please tag @jerrypeng @srkukarni @nlu90 @freeznet or me for reviews. We should have an eye from committers who understand the Pulsar Functions codebase better.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [pulsar] lhotari merged pull request #10743: Rootless container mount user token secret in the default 644 permission for Function Kubernetes runtime
Posted by GitBox <gi...@apache.org>.
lhotari merged pull request #10743:
URL: https://github.com/apache/pulsar/pull/10743
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [pulsar] eolivelli commented on a change in pull request #10743: Rootless container mount user token secret in the default 644 permission for Function Kubernetes runtime
Posted by GitBox <gi...@apache.org>.
eolivelli commented on a change in pull request #10743:
URL: https://github.com/apache/pulsar/pull/10743#discussion_r641985311
##########
File path: pulsar-functions/runtime/src/main/java/org/apache/pulsar/functions/auth/KubernetesSecretsTokenAuthProvider.java
##########
@@ -97,14 +97,12 @@ public void configureAuthDataStatefulSet(V1StatefulSet statefulSet, Optional<Fun
.name(SECRET_NAME)
.secret(
new V1SecretVolumeSource()
- .secretName(getSecretName(new String(functionAuthData.get().getData())))
- .defaultMode(256))));
+ .secretName(getSecretName(new String(functionAuthData.get().getData()))))));
podSpec.getContainers().forEach(container -> container.setVolumeMounts(Collections.singletonList(
new V1VolumeMount()
.name(SECRET_NAME)
- .mountPath(DEFAULT_SECRET_MOUNT_DIR)
- .readOnly(true))));
Review comment:
Why do we have to drop 'readonly' ?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [pulsar] zzzming commented on a change in pull request #10743: Rootless container mount user token secret in the default 644 permission for Function Kubernetes runtime
Posted by GitBox <gi...@apache.org>.
zzzming commented on a change in pull request #10743:
URL: https://github.com/apache/pulsar/pull/10743#discussion_r641987143
##########
File path: pulsar-functions/runtime/src/main/java/org/apache/pulsar/functions/auth/KubernetesSecretsTokenAuthProvider.java
##########
@@ -97,14 +97,12 @@ public void configureAuthDataStatefulSet(V1StatefulSet statefulSet, Optional<Fun
.name(SECRET_NAME)
.secret(
new V1SecretVolumeSource()
- .secretName(getSecretName(new String(functionAuthData.get().getData())))
- .defaultMode(256))));
+ .secretName(getSecretName(new String(functionAuthData.get().getData()))))));
podSpec.getContainers().forEach(container -> container.setVolumeMounts(Collections.singletonList(
new V1VolumeMount()
.name(SECRET_NAME)
- .mountPath(DEFAULT_SECRET_MOUNT_DIR)
- .readOnly(true))));
Review comment:
We should keep ready only. It's added back in.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org