Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix(batch): windows does not support readonlyRootFilesystem #29145

Merged
merged 6 commits into from
Mar 1, 2024

Conversation

msambol
Copy link
Contributor

@msambol msambol commented Feb 17, 2024

Here's from the k8s docs:

securityContext.readOnlyRootFilesystem - not possible on Windows; write access is required for registry & system processes to run inside the container

Closes #29140.


By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

@aws-cdk-automation aws-cdk-automation requested a review from a team February 17, 2024 03:59
@github-actions github-actions bot added star-contributor [Pilot] contributed between 25-49 PRs to the CDK bug This issue is a bug. p2 labels Feb 17, 2024
Copy link
Collaborator

@aws-cdk-automation aws-cdk-automation left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The pull request linter has failed. See the aws-cdk-automation comment below for failure reasons. If you believe this pull request should receive an exemption, please comment and provide a justification.

A comment requesting an exemption should contain the text Exemption Request. Additionally, if clarification is needed add Clarification Request to a comment.

@msambol msambol changed the title fix(batch): Windows does not support readonlyRootFilesystem fix(batch): windows does not support readonlyRootFilesystem Feb 17, 2024
@msambol
Copy link
Contributor Author

msambol commented Feb 17, 2024

Exemption request: I don't believe an integration test is needed for this fix.

@aws-cdk-automation aws-cdk-automation added pr-linter/exemption-requested The contributor has requested an exemption to the PR Linter feedback. pr/needs-community-review This PR needs a review from a Trusted Community Member or Core Team Member. labels Feb 17, 2024
@juantula
Copy link

@msambol I'm not sure this actually fixes #29140, because the generated CF template includes the readOnlyRootFilesystem even when the attribute is not present in the code, so looks like it's setting a default value when it's present. I think a change is also needed somewhere else to prevent the attribute to be generated.

@msambol
Copy link
Contributor Author

msambol commented Feb 21, 2024

@juantula Correct, it doesn't fix the root problem. Those files are generated from the CFN spec, AFAIK, so the change will need to be over there. I'm hoping @pahud can assist.

@juantula
Copy link

@msambol BTW, thanks a lot for your help on this issue! :)

@pahud
Copy link
Contributor

pahud commented Feb 21, 2024

I probably would modify here

this.readonlyRootFilesystem = props.readonlyRootFilesystem ?? false;

to

this.readonlyRootFilesystem =  is_windows() ? undefined : props.readonlyRootFilesystem ?? false; 

This will make sure readonlyRootFilesystem would always be undefined when OS is windows.

Plus add a check here - if os is windows and props.readonlyRootFilesystem is defined, throw an error.

// readonlyRootFilesystem isn't applicable to Windows, see https://kubernetes.io/docs/concepts/windows/intro/
if (this.isWindows(operatingSystemFamily)) {
containerDef.readonlyRootFilesystem = undefined;
}
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@pahud operatingSystemFamily isn't available in the constructor so I had to remove it here from the final rendering.

@aws-cdk-automation aws-cdk-automation dismissed their stale review February 22, 2024 16:54

✅ Updated pull request passes all PRLinter validations. Dismissing previous PRLinter review.

@github-actions github-actions bot added the effort/medium Medium work item – several days of effort label Feb 22, 2024
jfuss
jfuss previously requested changes Feb 29, 2024
Copy link
Contributor

@jfuss jfuss left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nothing major just a couple comments/thoughts.

@@ -1087,6 +1092,13 @@ export class EcsFargateContainerDefinition extends EcsContainerDefinitionBase im
operatingSystemFamily: this.fargateOperatingSystemFamily?._operatingSystemFamily,
},
};

// readonlyRootFilesystem isn't applicable to Windows, see https://kubernetes.io/docs/concepts/windows/intro/
if (this.fargateOperatingSystemFamily?.isWindows()) {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can we do this as a ternary operation in the above containerDef? Or do we need things to render first before we can apply this?

Copy link
Contributor Author

@msambol msambol Feb 29, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think I could change this line to use undefined instead of false ?

this.readonlyRootFilesystem = props.readonlyRootFilesystem ?? undefined; <– was false

That would change the default value but that shouldn't matter because the default was false ? Then I can remove quite a bit of this code.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@msambol If we set this.readonlyRootFilesystem from false to undefined, I am unsure what the consequences of that might be. I assume undefined will omit the value vs false setting this directly.

Now I think about it, I like the default being undefined but only if the service defaults to false when the property is not provided. Let me poke someone from the team that might know more to see what you suggest here will have wider side affects we might want to avoid.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@msambol So one thing I missed, we can't update the this.readonlyRootFilesystem because that may break customers you expected the default value to be false. So I think we have to do it in the way you have it. If we can simplify it with a ternary in the containerDef I think that is helpful but not strictly required.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

makes sense... I updated the PR.

packages/aws-cdk-lib/aws-ecs/lib/runtime-platform.ts Outdated Show resolved Hide resolved
@jfuss jfuss self-assigned this Feb 29, 2024
@aws-cdk-automation aws-cdk-automation removed the pr/needs-community-review This PR needs a review from a Trusted Community Member or Core Team Member. label Feb 29, 2024
@mergify mergify bot dismissed jfuss’s stale review March 1, 2024 19:51

Pull request has been modified.

* Returns true if the operating system family is Windows
*/
public isWindows(): boolean {
return this._operatingSystemFamily?.toLowerCase().startsWith('windows') ? true : false;
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@jfuss changed this to a ternary

@aws-cdk-automation
Copy link
Collaborator

AWS CodeBuild CI Report

  • CodeBuild project: AutoBuildv2Project1C6BFA3F-wQm2hXv2jqQv
  • Commit ID: 677090f
  • Result: SUCCEEDED
  • Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

Copy link
Contributor

mergify bot commented Mar 1, 2024

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

@mergify mergify bot merged commit 7205143 into aws:main Mar 1, 2024
13 checks passed
@msambol msambol deleted the 29140 branch March 1, 2024 20:19
godwingrs22 pushed a commit to godwingrs22/aws-cdk that referenced this pull request Mar 1, 2024
Here's from the k8s docs:
```
securityContext.readOnlyRootFilesystem - not possible on Windows; write access is required for registry & system processes to run inside the container
```

Closes aws#29140. 

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug This issue is a bug. effort/medium Medium work item – several days of effort p2 pr-linter/exemption-requested The contributor has requested an exemption to the PR Linter feedback. star-contributor [Pilot] contributed between 25-49 PRs to the CDK
Projects
None yet
Development

Successfully merging this pull request may close these issues.

aws-batch: Unable to create Windows Fargate Job Definition due to invalid generated CF Template
5 participants