Error: loading generator plugins: failed to load generator: unexecutable plugin but plugin is executable

[paololazzari]

My kustomization is using a plugin to generate secrets. Here's the layout:

├── base
│ ├── myapplication
│ │ ├── base
│ │ │ ├── deployment.yaml
│ │ │ ├── kustomization.yaml
│ │ │ └── svc.yaml
│ │ └── envs
│ │     ├── dev
│ │     │ ├── kustomization.yaml
│ │     │ └── secretGenerator.yaml
├── plugin
  └── util
    ├── gcloudsecretgenerator
      └── gcloudSecretGenerator

the plugin is an executable bash script. The executable bit has been commited to the git repository.

$ git ls-files --stage plugin/util/gcloudsecretgenerator/gcloudSecretGenerator
100755 e2096634c3aa718285647f258e1ba93701ec20b6 0	plugin/util/gcloudsecretgenerator/gcloudSecretGenerator

Now I can run this just fine locally. From the root repo:

KUSTOMIZE_PLUGIN_HOME="$(pwd)/plugin" kustomize build base/myapplication/envs/dev/ --enable-alpha-plugins

I am using the sidecar pattern in the argocd-repo-server pod, and mounting in the sidecar the following:

apiVersion: v1
data:
  plugin.yaml: |
    apiVersion: argoproj.io/v1alpha1
    kind: ConfigManagementPlugin
    metadata:
      name: kustomize-plugin
    spec:
      version: v1.0
      generate:
        command: ["sh", "-c"]
        args: ["KUSTOMIZE_PLUGIN_HOME=../../../../plugin kustomize build --enable-alpha-plugins"]

In argocd I see the following:

ComparisonError: Failed to load target state: failed to generate manifest for source 1 of 1: rpc error: code = Unknown desc = Manifest generation error (cached): plugin sidecar failed. error generating manifests in cmp: rpc error: code = Unknown desc = error generating manifests: sh -c "KUSTOMIZE_PLUGIN_HOME=../../../../plugin kustomize build --enable-alpha-plugins" failed exit status 1: Error: loading generator plugins: failed to load generator: unexecutable plugin at: ../../../../plugin/util/gcloudsecretgenerator/gcloudSecretGenerator

the sidecar container has the following:

securityContext:
  runAsNonRoot: true
  runAsUser: 999

[paololazzari]

Explicitly setting it executable fixed it, but this shouldn't be necessary:

apiVersion: v1
data:
  plugin.yaml: |
    apiVersion: argoproj.io/v1alpha1
    kind: ConfigManagementPlugin
    metadata:
      name: kustomize-plugin
    spec:
      version: v1.0
      generate:
        command: ["sh", "-c"]
        args: ["chmod +x ../../../../plugin/util/gcloudsecretgenerator/gcloudSecretGenerator; KUSTOMIZE_PLUGIN_HOME=../../../../plugin kustomize build --enable-alpha-plugins"]

[paololazzari]

preserveFileMode can be used to fix this https://argo-cd.readthedocs.io/en/stable/operator-manual/config-management-plugins/#preserve-repository-files-mode