byteayan commented on code in PR #3381:
URL: https://github.com/apache/hugegraph/pull/3381#discussion_r4345664888
##########
helm/hugegraph/README.md:
##########
@@ -246,7 +246,48 @@ helm test hugegraph -n hugegraph --logs --timeout 5m
An easy-mode upgrade that inherits Server/Hubble entry types prints a short
NodePort-default notice in NOTES; explicitly configured entry types are
preserved.
To adopt new defaults, use `--reset-values` with a reviewed values file
retaining
-all settings your release needs. Older explicit helper images also remain under
+all settings your release needs.
+
+PD, Store and Server images built from this version run as UID/GID `10001`. The
+PD and Store pods get `fsGroup: 10001` (with `fsGroupChangePolicy:
OnRootMismatch`)
+unless their `podSecurityContext` sets `fsGroup`, also when `--reuse-values`
keeps
+an older release's empty value, so that user can write PVCs created by older
+images, which ran as root.
+
+Switch PD and Store to images from this version in the same rollout that first
+applies `fsGroup`, so the kubelet changes the volume ownership right before the
+`10001` image starts. Do not run images that still run as root with this chart
+first, for example the published `latest` before it moves to this version:
files
+they create stay owned by root, and `OnRootMismatch` checks only the volume
root,
+so it does not fix them later. Pin `pd.image` and `store.image` to a build from
+this version rather than relying on `latest`.
+
+If a release already ran root images with `fsGroup` set, roll out the first
+`10001` image together with a one-time recursive ownership change. Set the
image
+tags in the same command, so the recursive change runs for the `10001` image
+rather than for a pinned root image:
+
+```bash
+helm upgrade hugegraph ./helm/hugegraph -n hugegraph --reuse-values \
+ --set pd.image.tag=<this-version> \
Review Comment:
Fixed in 9ff9a0b. The example also passes `--set-string pd.image.digest=`
and `store.image.digest=`, and the text says a release pinned by digest should
set both digests to this version's images instead. I added a `kubectl get pods`
check of the running images before the policy goes back to `OnRootMismatch`.
Same change in docs/operations.md and apache/hugegraph-doc#544.
##########
.github/scripts/check-docker-images.sh:
##########
@@ -30,6 +30,23 @@ for pair in \
HC=$(docker image inspect --format '{{json .Config.Healthcheck}}'
"$IMAGE_ID")
[[ "$HC" != null ]] || { echo "Missing HEALTHCHECK: $dockerfile"; exit
1; }
+ # The images must run as the fixed non-root user and own the
directories
+ # the start scripts and default volumes write to.
+ case "$dockerfile" in
+ hugegraph-pd/*) OWNED_DIRS=". logs pd_data" ;;
+ hugegraph-store/*) OWNED_DIRS=". logs storage" ;;
+ hugegraph-server/Dockerfile) OWNED_DIRS=". logs rocksdb-data" ;;
+ *) OWNED_DIRS=". logs" ;;
+ esac
+ IMAGE_USER=$(docker image inspect --format '{{.Config.User}}'
"$IMAGE_ID")
+ RUNTIME_IDS=$(docker run --rm --pull never --entrypoint sh "$IMAGE_ID"
-c \
+ 'echo "$(id -u):$(id -g)" $(stat -c %u "$@")' owners $OWNED_DIRS)
Review Comment:
Fixed in 9ff9a0b. The check now prints `stat -c %u:%g` for every path and
compares each with `10001:10001`.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
