apache / apache/openwhisk-wskdeploy

Option "include" in manifest.yml file does not preserve files permission

Open
#1,158 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
75
Forks
73
PR merge metrics
No merged PRs in 30d

Description

Hi all,

We are facing an issue when using the option `include` in the manifest.yml file, where the permissions of the included files are not preserved.

Our manifest.yaml file looks like:

```yaml
packages:
poc:
actions:
example:
annotations:
web-export: true
function: src/example
include:
- ["tls"]
- ["virtualenv"]
- ["requirements.txt"]
inputs: {}
runtime: python:3.9
version: 1.0.0
web: true
version: 1.0.0
```

Inside of the directly `tls`, we have some TLS certificates that are used by PostgreSQL, and the private key must have the limited permissions (`600` if owned by a regular user, or `640` is owned by root - [reference](https://www.postgresql.org/docs/13/ssl-tcp.html)). In our local environment, the files have the permissions set properly:

```
-rw------- 1 denis test 1703 Apr 5 16:30 tls/client-tls.key
```

However, once it's deployed, the TLS files are copied with broader access (`644`) and then the PostgreSQL connection fails complaining about the permissions.

Is there a way to include these files and also keeping the existing permissions? A workaround so far is to make the Python code to fix the files permissions but ideally it would be nice if this could be fixed during deployment (rather than in each function run).

Thanks in advance.

Contributor guide

Open the contributing guide

Research direction

Start by tracing how the Go utility handles the `include` entries in manifest.yml during deployment, using the tls directory and its client-tls.key as the reproduction case. Compare the deployed permissions with the local 600/640 requirement and verify that included TLS files retain suitable permissions so the PostgreSQL connection succeeds.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
devops
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.