When using sysbox 0.6.5, k8s secrets are mounted with owner `nobody nogroup`
@ctalledo is already working on this.
Since Dec 9, 2024.
- Dominant language
- Shell
- Stars
- 3.9k
- Forks
- 230
- Avg merge
- 7h 48m
- Merged PRs (30d)
- 3
Description
I'm running a pod in Kubernetes on a sysbox 0.6.5 runtime. In the Kubernetes spec, I've mounted a secret into a folder, and it's being mounted with owner nobody nogroup. This is no problem if we use the default k8s secret permissions of 0644, so all users can read, but if we choose to set e.g. defaultMode: 256 (0400 in oct) in the kubernets secret volume spec (which translates to 0400 where only the owner can read), then we're in trouble because root nor any other owner owns a nobody file. In this case, I hit a permission denied error. When sysbox is not installed, or if sysbox 0.6.4 or 0.6.3 is installed (I didn't observe this erroneous behavior before upgrading), then the owner is properly set to root.
I'm running on Linux kernel 5.15.0-1067-azure (it's an Azure AKS node).
I'm installing specifically using https://raw.githubusercontent.com/nestybox/sysbox/8834a2d9b8eabbfeb2a2181b8649684e14a619f1/sysbox-k8s-manifests/sysbox-install.yaml as my sysbox k8s install spec with no modifications.
I define my secrets in my k8s spec with:
volumes:
- name: github-deploy-key
secret:
defaultMode: 256
secretName: github-deploy-key
and
volumeMounts:
- mountPath: /etc/secrets/ssh/github-deploy-key
name: github-deploy-key
readOnly: true
in this case I'm observing the same beahvior on both kubernetes versions 1.28.9 and 1.30.5.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.