nestybox / nestybox/sysbox

When using sysbox 0.6.5, k8s secrets are mounted with owner `nobody nogroup`

Open
#874 10 comments 0 reactions 1 assignee View on GitHub

@ctalledo is already working on this.

Since Dec 9, 2024.

question
Dominant language
Shell
Stars
3.9k
Forks
230
Avg merge
7h 48m
Merged PRs (30d)
3

Description

I'm running a pod in Kubernetes on a sysbox 0.6.5 runtime. In the Kubernetes spec, I've mounted a secret into a folder, and it's being mounted with owner nobody nogroup. This is no problem if we use the default k8s secret permissions of 0644, so all users can read, but if we choose to set e.g. defaultMode: 256 (0400 in oct) in the kubernets secret volume spec (which translates to 0400 where only the owner can read), then we're in trouble because root nor any other owner owns a nobody file. In this case, I hit a permission denied error. When sysbox is not installed, or if sysbox 0.6.4 or 0.6.3 is installed (I didn't observe this erroneous behavior before upgrading), then the owner is properly set to root.

I'm running on Linux kernel 5.15.0-1067-azure (it's an Azure AKS node).

I'm installing specifically using https://raw.githubusercontent.com/nestybox/sysbox/8834a2d9b8eabbfeb2a2181b8649684e14a619f1/sysbox-k8s-manifests/sysbox-install.yaml as my sysbox k8s install spec with no modifications.

I define my secrets in my k8s spec with:

  volumes:
  - name: github-deploy-key
    secret:
      defaultMode: 256
      secretName: github-deploy-key

and

    volumeMounts:
    - mountPath: /etc/secrets/ssh/github-deploy-key
      name: github-deploy-key
      readOnly: true

in this case I'm observing the same beahvior on both kubernetes versions 1.28.9 and 1.30.5.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.