imbajin commented on code in PR #3381:
URL: https://github.com/apache/hugegraph/pull/3381#discussion_r4343571302
##########
helm/hugegraph/README.md:
##########
@@ -246,7 +246,48 @@ helm test hugegraph -n hugegraph --logs --timeout 5m
An easy-mode upgrade that inherits Server/Hubble entry types prints a short
NodePort-default notice in NOTES; explicitly configured entry types are
preserved.
To adopt new defaults, use `--reset-values` with a reviewed values file
retaining
-all settings your release needs. Older explicit helper images also remain under
+all settings your release needs.
+
+PD, Store and Server images built from this version run as UID/GID `10001`. The
+PD and Store pods get `fsGroup: 10001` (with `fsGroupChangePolicy:
OnRootMismatch`)
+unless their `podSecurityContext` sets `fsGroup`, also when `--reuse-values`
keeps
+an older release's empty value, so that user can write PVCs created by older
+images, which ran as root.
+
+Switch PD and Store to images from this version in the same rollout that first
+applies `fsGroup`, so the kubelet changes the volume ownership right before the
+`10001` image starts. Do not run images that still run as root with this chart
+first, for example the published `latest` before it moves to this version:
files
+they create stay owned by root, and `OnRootMismatch` checks only the volume
root,
+so it does not fix them later. Pin `pd.image` and `store.image` to a build from
+this version rather than relying on `latest`.
+
+If a release already ran root images with `fsGroup` set, roll out the first
+`10001` image together with a one-time recursive ownership change. Set the
image
+tags in the same command, so the recursive change runs for the `10001` image
+rather than for a pinned root image:
+
+```bash
+helm upgrade hugegraph ./helm/hugegraph -n hugegraph --reuse-values \
+ --set pd.image.tag=<this-version> \
Review Comment:
⚠️ Important: Setting only `pd.image.tag` and `store.image.tag` does not
guarantee these are the images used. With `--reuse-values`, existing
`pd.image.digest` and `store.image.digest` values are retained, and
`hugegraph.image` renders a non-empty digest instead of the tag. A
digest-pinned release can therefore run the old root images during this
`Always` rollout, then carry root-created files into the later `OnRootMismatch`
step. Please update or clear both digests in the example and tell operators to
verify the rendered image references before switching the policy back.
##########
.github/scripts/check-docker-images.sh:
##########
@@ -30,6 +30,23 @@ for pair in \
HC=$(docker image inspect --format '{{json .Config.Healthcheck}}'
"$IMAGE_ID")
[[ "$HC" != null ]] || { echo "Missing HEALTHCHECK: $dockerfile"; exit
1; }
+ # The images must run as the fixed non-root user and own the
directories
+ # the start scripts and default volumes write to.
+ case "$dockerfile" in
+ hugegraph-pd/*) OWNED_DIRS=". logs pd_data" ;;
+ hugegraph-store/*) OWNED_DIRS=". logs storage" ;;
+ hugegraph-server/Dockerfile) OWNED_DIRS=". logs rocksdb-data" ;;
+ *) OWNED_DIRS=". logs" ;;
+ esac
+ IMAGE_USER=$(docker image inspect --format '{{.Config.User}}'
"$IMAGE_ID")
+ RUNTIME_IDS=$(docker run --rm --pull never --entrypoint sh "$IMAGE_ID"
-c \
+ 'echo "$(id -u):$(id -g)" $(stat -c %u "$@")' owners $OWNED_DIRS)
Review Comment:
🧹 Minor: This assertion compares only each directory's numeric UID (`stat -c
%u`), although the new ownership contract expects `10001:10001`. A directory
with an unexpected GID would pass this guard. Please print `%u:%g` for every
path and compare each result with `10001:10001`, so the check also catches a
wrong default-volume group.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
