git-sync ssh as an initContainer

[PhilippeDupont]

Following #144 :

I don't want to force all volumes in the pod to be limited to user 65533, so how can we use it as an initContainer ?

[thockin]

They don't need to be limited to a user for the whole pod. Each container can run as any user they want. Setting the fsGroup should allow them all to read the git contents.

I don't have a demo of that, but it should work - does it not?

Alternately, you can run as an init container and manually chown/chmod if you want, but that requires more privilege.

[stp-ip]

Simplified example running in production (non-init container, but should be working as init container too):

apiVersion: extensions/v1beta1
kind: Deployment
metadata:
  name: git-sync-example
  namespace: tmp
spec:
  revisionHistoryLimit: 2
  replicas: 2
  strategy:
    rollingUpdate:
      maxSurge: 2
      maxUnavailable: 0
  selector:
    matchLabels:
      project: example.git.sync
  template:
    metadata:
      labels:
        project: example.git.sync
    spec:
      securityContext:
        fsGroup: 65533
        runAsNonRoot: true
      containers:
      - name: example
        image: example/application:1.0.1
        securityContext:
          runAsUser: 1000 # usually set within docker image
          allowPrivilegeEscalation: false
          readOnlyRootFilesystem: true
          capabilities:
            drop: ["all"]
        args: [ "--conf=/etc/config.conf" ]
        readinessProbe:
          httpGet:
            path: /healthz
            port: 8081
            httpHeaders:
              - name: X-Probez
                value: readiness.k8s
          initialDelaySeconds: 120
        livenessProbe:
          httpGet:
            path: /healthz
            port: 8081
            httpHeaders:
              - name: X-Probez
                value: liveness.k8s
          initialDelaySeconds: 140
        ports:
          - name: health
            containerPort: 8081
        volumeMounts:
        - name: config
          mountPath: /etc/config
        - name: source
          mountPath: /etc/source
      - name: git-sync
        image: thockin/git-sync:thtest #currently using our own build, but this test build is available from thockin
        securityContext:
          runAsUser: 65533
          allowPrivilegeEscalation: false
          readOnlyRootFilesystem: true
          capabilities:
            drop: ["all"]
        volumeMounts:
        - name: source
          mountPath: /etc/source
        - name: git-secret
          mountPath: /etc/git-secret
        env:
        - name: GIT_SYNC_REPO
          value: git@gitlab.core:repo.git
        - name: GIT_SYNC_BRANCH
          value: master
        - name: GIT_SYNC_SSH
          value: "true"
        - name: GIT_SYNC_WAIT
          value: "60"
        - name: GIT_SYNC_ROOT
          value: /etc/source/
        - name: GIT_SYNC_DEST
          value: files
      volumes:
      - name: config
        configMap:
          name: config
      - name: git-secret
        secret:
          secretName: git-secret
          defaultMode: 288
      - name: source
        emptyDir: {}

[thockin]

Maybe put that in a doc in this repo? Would be nice if it ws actually runnable (no "example app" images :) Then we can close this?

…

On Wed, Feb 13, 2019 at 11:29 AM Michael Grosser ***@***.***> wrote: Simplified example running in production: apiVersion: extensions/v1beta1 kind: Deployment metadata: name: git-sync-example namespace: tmp spec: revisionHistoryLimit: 2 replicas: 2 strategy: rollingUpdate: maxSurge: 2 maxUnavailable: 0 selector: matchLabels: project: example.git.sync template: metadata: labels: project: example.git.sync spec: securityContext: fsGroup: 65533 containers: - name: example image: example/application:1.0.1 securityContext: readOnlyRootFilesystem: true capabilities: drop: ["all"] args: [ "--conf=/etc/config.conf" ] readinessProbe: httpGet: path: /healthz port: 8081 httpHeaders: - name: X-Probez value: readiness.k8s initialDelaySeconds: 120 livenessProbe: httpGet: path: /healthz port: 8081 httpHeaders: - name: X-Probez value: liveness.k8s initialDelaySeconds: 140 ports: - name: health containerPort: 8081 volumeMounts: - name: config mountPath: /etc/config - name: source mountPath: /etc/source - name: git-sync image: thockin/git-sync:thtest #currently using our own build, but this test build is available from thockin securityContext: runAsUser: 65533 readOnlyRootFilesystem: true capabilities: drop: ["all"] volumeMounts: - name: source mountPath: /etc/source - name: git-secret mountPath: /etc/git-secret env: - name: GIT_SYNC_REPO value: ***@***.***:repo.git - name: GIT_SYNC_BRANCH value: master - name: GIT_SYNC_SSH value: "true" - name: GIT_SYNC_WAIT value: "60" - name: GIT_SYNC_ROOT value: /etc/source/ - name: GIT_SYNC_DEST value: files volumes: - name: config configMap: name: config - name: git-secret secret: secretName: git-secret defaultMode: 288 - name: source emptyDir: {} — You are receiving this because you commented. Reply to this email directly, view it on GitHub <#146 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AFVgVILyhIY8tNOllgDO0KeXC1c3orucks5vNGeEgaJpZM4a55Zz> .

[stp-ip]

Was an internal app so couldn't use it here. Can morph it into an example and push as docs. Might take a bit as I'm overloaded, but not forgotten.

[PhilippeDupont]

Thank you for your answers.

I still have an issue using the fsgroup : ERROR: can't configure SSH: Permissions -r--r----- for SSH key are too open. It is recommended to mount secret volume with defaultMode: 256 (decimal number for octal 0400).

my deployment definition :

[...]
    spec:
      initContainers:
        - name: git-sync
          image: k8s.gcr.io/git-sync:v3.1.0
          env:
            - name: GIT_SYNC_SSH
              value: "true"
            - name: GIT_SYNC_REPO
              value: {{ .Values.persistentVolume.copyFromGithub.repo | quote }}
            - name: GIT_SYNC_ROOT
              value: "/app"
            - name: GIT_SYNC_DEST
              value: "backup"
          volumeMounts: 
            - name: "git-secret"
              mountPath: "/etc/git-secret"
[...]
          securityContext:
            runAsUser: 65533  # to allow read of ssh key
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
            capabilities:
              drop: ["all"]
      containers:
[...]
      volumes:
[...]
      - name: git-secret
        secret:
          secretName: git-secret
          defaultMode: 288  
[...]
      securityContext:
        fsGroup: 65533

One another thing I can't figure out is that, changing the defaultMode to 256 again, create the exact same error as It was still in 0440.
I don't have the error when I remove the fsGroup. But got fatal: Could not read from remote repository.\n\nPlease make sure you have the correct access rights\nand the repository exists.\n"

[thockin]

Sorry, I need to build a new release. If you build from head or if you use thockin/git-sync:thtest (temporarily) it will work.

…

On Thu, Feb 14, 2019 at 6:16 AM Philippe Dupont ***@***.***> wrote: Thank you for your answers. I still have an issue using the fsgroup : ERROR: can't configure SSH: Permissions -r--r----- for SSH key are too open. It is recommended to mount secret volume with defaultMode: 256 (decimal number for octal 0400). my deployment definition : [...] spec: initContainers: - name: git-sync image: k8s.gcr.io/git-sync:v3.1.0 env: - name: GIT_SYNC_SSH value: "true" - name: GIT_SYNC_REPO value: {{ .Values.persistentVolume.copyFromGithub.repo | quote }} - name: GIT_SYNC_ROOT value: "/app" - name: GIT_SYNC_DEST value: "backup" volumeMounts: - name: "git-secret" mountPath: "/etc/git-secret" [...] securityContext: runAsUser: 65533 # to allow read of ssh key allowPrivilegeEscalation: false readOnlyRootFilesystem: true capabilities: drop: ["all"] containers: [...] volumes: [...] - name: git-secret secret: secretName: git-secret defaultMode: 288 [...] securityContext: fsGroup: 65533 One another thing I can't figure out is that, changing the defaultMode to 256 again, create the exact same error. I don't have the error when I remove the fsGroup. But got fatal: Could not read from remote repository.\n\nPlease make sure you have the correct access rights\nand the repository exists.\n" — You are receiving this because you commented. Reply to this email directly, view it on GitHub <#146 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AFVgVO4zjs941Y0azWK8ZfOdlQJtXS9wks5vNW-tgaJpZM4a55Zz> .

[thockin]

I have kicked off a build of 3.1.1 and am waiting for it to be promoted through the image registry. Should be up within a few hours.

…

On Wed, Feb 13, 2019 at 11:29 AM Michael Grosser ***@***.***> wrote: Simplified example running in production: apiVersion: extensions/v1beta1 kind: Deployment metadata: name: git-sync-example namespace: tmp spec: revisionHistoryLimit: 2 replicas: 2 strategy: rollingUpdate: maxSurge: 2 maxUnavailable: 0 selector: matchLabels: project: example.git.sync template: metadata: labels: project: example.git.sync spec: securityContext: fsGroup: 65533 containers: - name: example image: example/application:1.0.1 securityContext: readOnlyRootFilesystem: true capabilities: drop: ["all"] args: [ "--conf=/etc/config.conf" ] readinessProbe: httpGet: path: /healthz port: 8081 httpHeaders: - name: X-Probez value: readiness.k8s initialDelaySeconds: 120 livenessProbe: httpGet: path: /healthz port: 8081 httpHeaders: - name: X-Probez value: liveness.k8s initialDelaySeconds: 140 ports: - name: health containerPort: 8081 volumeMounts: - name: config mountPath: /etc/config - name: source mountPath: /etc/source - name: git-sync image: thockin/git-sync:thtest #currently using our own build, but this test build is available from thockin securityContext: runAsUser: 65533 readOnlyRootFilesystem: true capabilities: drop: ["all"] volumeMounts: - name: source mountPath: /etc/source - name: git-secret mountPath: /etc/git-secret env: - name: GIT_SYNC_REPO value: ***@***.***:repo.git - name: GIT_SYNC_BRANCH value: master - name: GIT_SYNC_SSH value: "true" - name: GIT_SYNC_WAIT value: "60" - name: GIT_SYNC_ROOT value: /etc/source/ - name: GIT_SYNC_DEST value: files volumes: - name: config configMap: name: config - name: git-secret secret: secretName: git-secret defaultMode: 288 - name: source emptyDir: {} — You are receiving this because you commented. Reply to this email directly, view it on GitHub <#146 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AFVgVILyhIY8tNOllgDO0KeXC1c3orucks5vNGeEgaJpZM4a55Zz> .

[PhilippeDupont]

Thx a lot 👍

[abishekh]

Is this working? And is there a complete example somewhere for initContainers?

[thockin]

Look at docs/ssh.md, that example should work except you should use the `-one-time` flag

…

On Wed, Jun 19, 2019 at 12:14 PM Abishek ***@***.***> wrote: Is this working? And is there a complete example somewhere for initContainers? — You are receiving this because you commented. Reply to this email directly, view it on GitHub <#146?email_source=notifications&email_token=ABKWAVGDHNY42HQVX7C444DP3KAPVA5CNFSM4GXHSZZ2YY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGODYC5UWY#issuecomment-503700059>, or mute the thread <https://github.com/notifications/unsubscribe-auth/ABKWAVDI2JFHFTYNDNF5VT3P3KAPVANCNFSM4GXHSZZQ> .

[abishekh]

Is there a description of this flag somewhere ?

[thockin]

``` $ git-sync ... -one-time exit after the initial checkout ... ```

…

On Wed, Jun 19, 2019 at 12:50 PM Abishek ***@***.***> wrote: Is there a description of this flag somewhere ? — You are receiving this because you commented. Reply to this email directly, view it on GitHub <#146?email_source=notifications&email_token=ABKWAVBPHM4F2MT6PXBYYJDP3KEYLA5CNFSM4GXHSZZ2YY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGODYDC4AY#issuecomment-503721475>, or mute the thread <https://github.com/notifications/unsubscribe-auth/ABKWAVF3ZO73IGINIXZ4TGDP3KEYLANCNFSM4GXHSZZQ> .

[thockin]

Did you follow https://github.com/kubernetes/git-sync/blob/master/docs/ssh.md, especially https://github.com/kubernetes/git-sync/blob/master/docs/ssh.md#step-2-configure-poddeployment-volume ?

…

On Tue, Jun 2, 2020 at 1:07 AM Alex Teterin ***@***.***> wrote: i also still gets ERROR: can't configure SSH: Permissions -r--r----- for SSH key are too open. It is recommended to mount secret volume with defaultMode: 256 (decimal number for octal 0400) config is the same as in example. what is wrong? — You are receiving this because you commented. Reply to this email directly, view it on GitHub <#146 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ABKWAVETY3FYDXZWZ4HT64TRUSXLZANCNFSM4GXHSZZQ> .

[errogaht]

Sorry, I deleted comment because I figured out that I used old image version, so it is my mistake. вт, 2 июня 2020 г. в 18:54, Tim Hockin <notifications@github.com>:

…

Did you follow https://github.com/kubernetes/git-sync/blob/master/docs/ssh.md, especially https://github.com/kubernetes/git-sync/blob/master/docs/ssh.md#step-2-configure-poddeployment-volume ? On Tue, Jun 2, 2020 at 1:07 AM Alex Teterin ***@***.***> wrote: > i also still gets ERROR: can't configure SSH: Permissions -r--r----- for > SSH key are too open. It is recommended to mount secret volume with > defaultMode: 256 (decimal number for octal 0400) > config is the same as in example. what is wrong? > > — > You are receiving this because you commented. > Reply to this email directly, view it on GitHub > < #146 (comment)>, > or unsubscribe > < https://github.com/notifications/unsubscribe-auth/ABKWAVETY3FYDXZWZ4HT64TRUSXLZANCNFSM4GXHSZZQ > > . > — You are receiving this because you commented. Reply to this email directly, view it on GitHub <#146 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ABQIAKPIOFEEUKGPYSZY7G3RUUOELANCNFSM4GXHSZZQ> .