DevOps/truecharts
2
0
Fork 0
Code Issues Pull Requests Actions 31 Packages Projects Releases 1 Wiki Activity

only set group when setting permissions (#783)

Browse Source 
* only set group when setting permissions

* fix test

* another test fix
This commit is contained in:
Kjeld Schouten-Lebbing
2021-08-18 16:47:38 +02:00
committed by GitHub
parent e1d5a61b17
commit 6a0106709e
3 changed files with 7 additions and 28 deletions
Download Patch File Download Diff File Expand all files Collapse all files
charts/library/common/Chart.yaml
+1 -1
View File
@@ -18,4 +18,4 @@ maintainers:
name: common name: common
sources: null sources: null
type: library type: library
version: 6.8.1 version: 6.8.2
charts/library/common/templates/classes/_mountPermissions.tpl
+1 -4
View File
@@ -5,13 +5,10 @@ before chart installation.
{{- define "common.class.mountPermissions" -}} {{- define "common.class.mountPermissions" -}}
{{- if .Values.persistence -}} {{- if .Values.persistence -}}
{{- $jobName := include "common.names.fullname" . -}} {{- $jobName := include "common.names.fullname" . -}}
{{- $user := 568 -}}
{{- $group := 568 -}} {{- $group := 568 -}}
{{- if .Values.env -}} {{- if .Values.env -}}
{{- $user = dig "PUID" $user .Values.env -}}
{{- $group = dig "PGID" $group .Values.env -}} {{- $group = dig "PGID" $group .Values.env -}}
{{- end -}} {{- end -}}
{{- $user = dig "runAsUser" $user .Values.podSecurityContext -}}
{{- $group = dig "fsGroup" $group .Values.podSecurityContext -}} {{- $group = dig "fsGroup" $group .Values.podSecurityContext -}}
{{- $hostPathMounts := dict -}} {{- $hostPathMounts := dict -}}
{{- range $name, $mount := .Values.persistence -}} {{- range $name, $mount := .Values.persistence -}}
@@ -45,7 +42,7 @@ spec:
- -c - -c
- | - |
{{- range $_, $hpm := $hostPathMounts }} {{- range $_, $hpm := $hostPathMounts }}
chown -R {{ printf "%d:%d %s" (int $user) (int $group) $hpm.mountPath }} chown -R {{ printf ":%d %s" (int $group) $hpm.mountPath }}
{{- end }} {{- end }}
volumeMounts: volumeMounts:
{{- range $name, $hpm := $hostPathMounts }} {{- range $name, $hpm := $hostPathMounts }}
charts/library/common/tests/permissions_job_test.go
+5 -23
View File
@@ -139,7 +139,7 @@ func (suite *PermissionsJobTestSuite) TestCommand() {
"DefaultPermissionsForMultipleMounts": { "DefaultPermissionsForMultipleMounts": {
values: baseValues, values: baseValues,
expectedCommand: []string{ expectedCommand: []string{
"/bin/sh", "-c", "chown -R 568:568 /config\nchown -R 568:568 /data\n", "/bin/sh", "-c", "chown -R :568 /config\nchown -R :568 /data\n",
}, },
}, },
"DefaultPermissionsForDisabledpodSecurityContext": { "DefaultPermissionsForDisabledpodSecurityContext": {
@@ -147,7 +147,7 @@ func (suite *PermissionsJobTestSuite) TestCommand() {
"podSecurityContext.allowPrivilegeEscalation=false", "podSecurityContext.allowPrivilegeEscalation=false",
), ),
expectedCommand: []string{ expectedCommand: []string{
"/bin/sh", "-c", "chown -R 568:568 /config\nchown -R 568:568 /data\n", "/bin/sh", "-c", "chown -R :568 /config\nchown -R :568 /data\n",
}, },
}, },
"PermissionsForFsGroup": { "PermissionsForFsGroup": {
@@ -155,33 +155,15 @@ func (suite *PermissionsJobTestSuite) TestCommand() {
"podSecurityContext.fsGroup=666", "podSecurityContext.fsGroup=666",
), ),
expectedCommand: []string{ expectedCommand: []string{
"/bin/sh", "-c", "chown -R 568:666 /config\nchown -R 568:666 /data\n", "/bin/sh", "-c", "chown -R :666 /config\nchown -R :666 /data\n",
}, },
}, },
"PermissionsForRunAsUser": { "PermissionsForPgid": {
values: append(baseValues, values: append(baseValues,
"podSecurityContext.runAsUser=999",
),
expectedCommand: []string{
"/bin/sh", "-c", "chown -R 999:568 /config\nchown -R 999:568 /data\n",
},
},
"PermissionsForRunAsUserAndFsGroup": {
values: append(baseValues,
"podSecurityContext.runAsUser=999",
"podSecurityContext.fsGroup=666",
),
expectedCommand: []string{
"/bin/sh", "-c", "chown -R 999:666 /config\nchown -R 999:666 /data\n",
},
},
"PermissionsForPgidPuid": {
values: append(baseValues,
"env.PUID=999",
"env.PGID=666", "env.PGID=666",
), ),
expectedCommand: []string{ expectedCommand: []string{
"/bin/sh", "-c", "chown -R 999:666 /config\nchown -R 999:666 /data\n", "/bin/sh", "-c", "chown -R :666 /config\nchown -R :666 /data\n",
}, },
}, },
} }