Add chown flag. #97

TimBozeman · 2018-06-18T21:56:27Z

Hiya,

Thank you for git-sync. It's pretty awesome! I just signed the CLA. Can we add a chown flag please?

k8s-ci-robot · 2018-06-18T21:56:39Z

Thanks for your pull request. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

📝 Please follow instructions at https://git.k8s.io/community/CLA.md#the-contributor-license-agreement to sign the CLA.

It may take a couple minutes for the CLA signature to be fully registered; after that, please reply here with a new comment and we'll verify. Thanks.

If you've already signed a CLA, it's possible we don't have your GitHub username or you're using a different email address. Check your existing CLA data and verify that your email is set on your git commits.
If you signed the CLA as a corporation, please sign in with your organization's credentials at https://identity.linuxfoundation.org/projects/cncf to be authorized.
If you have done the above and are still having issues with the CLA being reported as unsigned, please email the CNCF helpdesk: helpdesk@rt.linuxfoundation.org

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

TimBozeman · 2018-06-19T16:00:02Z

CLA check.

jasperf · 2020-12-22T06:03:51Z

Any news on this flag addition? Think being able to set group:user would be very useful.

thockin · 2020-12-22T06:39:19Z

Why not simply run it as the user/group you want?

jasperf · 2020-12-22T06:46:00Z

Well, I just tried this addition:

  allowPrivilegeEscalation: false
    readOnlyRootFilesystem: true
    runAsUser: 1000
    runAsGroup: 1000

just to test and see if it would become laradock/docker if that is what you meant? And yes, it seems to now store as user and group 1000. So later on I could use a www-data group uid and gui as well.

thockin · 2020-12-22T23:07:24Z

git-sync is designed to run as any user you want. It does not need any special privileges, and chooses a non-root UID by default. So yeah, setting runAsUser/Group should be enough. If you want to use git over SSH you may also need to specify --add-user (which writes the UID to /etc/passwd to make ssh happy).

…

On Mon, Dec 21, 2020 at 10:46 PM Jasper Frumau ***@***.***> wrote: Well, I just tried this addition: allowPrivilegeEscalation: false readOnlyRootFilesystem: true runAsUser: 1000 runAsGroup: 1000 just to test and see if it would become laradock/docker if that is what you meant? And yes, it seems to now store as user and group 1000. So later on I could use a www-data group uid and gui as well. — You are receiving this because you commented. Reply to this email directly, view it on GitHub <#97 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ABKWAVHOJTZMLB2ZV2AJ6RTSWA6DNANCNFSM4FFSE3NA> .

shubhamc183 · 2021-03-09T13:01:35Z

@thockin can you please let me know where I am going wrong.

I am not able to set the UID and GID of files properly

Even setting the runAsUser and fsGroup as same that worked at #146 (comment) throws the below-mentioned error.

INFO: detected pid 1, running init handler
I0309 12:47:59.450527      10 main.go:430]  "level"=0 "msg"="starting up"  "args"=["/git-sync"] "pid"=10
I0309 12:47:59.450647      10 main.go:694]  "level"=0 "msg"="cloning repo"  "origin"="git@bitbucket.org:org:XXXXXXX/YYY.git" "path"="//git"
E0309 12:47:59.453464      10 main.go:455]  "msg"="too many failures, aborting" "error"="Run(git clone --no-checkout -b master git@bitbucket.org:XXXXXXX/YYYYY.git //git): exit status 128: { stdout: \"\", stderr: \"fatal: could not create work tree dir '//git': Permission denied\\n\" }"  "failCount"=0

I am only able to set the group permission as 5000 and not able to provide UID for the checked-out file.

apiVersion: apps/v1
kind: Deployment
metadata:
  name: poc
spec:
  selector:
    matchLabels:
      app: poc
  replicas: 1
  template:
    metadata:
      labels:
        app: poc
    spec:
      securityContext:
        fsGroup: 5000
      containers:
        - name: busybox
          image: busybox
          volumeMounts:
          - name: buildproperties
            mountPath: /opt/data
            subPath: data
          stdin: true
      initContainers:
      - name: git-sync
        image: k8s.gcr.io/git-sync/git-sync:v3.2.2
        volumeMounts:
        - name: buildproperties
          mountPath: "/tmp/git/"
        - name: ssh-key
          mountPath: /etc/git-secret/
          readOnly: true
        env:
        - name: GIT_SYNC_SSH
          value: "true"
        - name: GIT_KNOWN_HOSTS
          value: "false"
        - name: GIT_SYNC_REPO
          value: git@bitbucket.org:XXX/YYYY.git
        - name: GIT_SYNC_BRANCH
          value: "master"
        - name: GIT_SYNC_DEST
          value: "data"
        - name: GIT_SYNC_ONE_TIME
          value: "true"
        - name: GIT_SYNC_PERMISSIONS
          value: "0777"
        - name: GIT_SYNC_ADD_USER
          value: "true"
      volumes:
      - name: buildproperties
        emptyDir: {}
      - name: ssh-key
        secret:
          secretName: bitbucket-ssh-key
          defaultMode: 0400

Inside the container busybox

/opt/data # ls -l
total 8
-rwxrwxrwx    1 65533    5000           565 Mar  9 12:44 README.md
-rwxrwxrwx    1 65533    5000            51 Mar  9 12:44 test.val

Can you please tell me how can I set the UID(1000) and GID(1001) for the checked-out files?

@aneesh-joseph

thockin · 2021-03-11T18:42:57Z

The default $HOME is /tmp:

$ docker run -ti --entrypoint sh k8s.gcr.io/git-sync/git-sync:v3.2.2 -c 'echo $HOME'
/tmp

The default git-root for git-sync is /tmp/git:

$ docker run -ti k8s.gcr.io/git-sync/git-sync:v3.2.2 | grep "root directory"
    	the root directory for git-sync operations, under which --dest will be created (default "/tmp/git")

Your log suggests that the root is being changed:

I0309 12:47:59.450647      10 main.go:694]  "level"=0 "msg"="cloning repo"  "origin"="git@bitbucket.org:org:XXXXXXX/YYY.git" "path"="//git"

Specifically: "path"="//git"

shubhamc183 · 2021-03-16T12:29:09Z

I am facing this issue only when I add runAsUser: 1001.

I want to change the UID of the checked-out files. GID and permission I am able to change via securityContext.fsGroup and GIT_SYNC_PERMISSIONS respectively.

shubhamc183 · 2021-03-16T12:42:27Z

After I changed the GIT_SYNC_ROOT to say(/workspace) it worked like charm.

Now, I can see my files cloned with UID: 1001, GID:5000, and expected permissions.

apiVersion: apps/v1
kind: Deployment
metadata:
  name: poc
spec:
  selector:
    matchLabels:
      app: poc
  replicas: 1
  template:
    metadata:
      labels:
        app: poc
    spec:
      securityContext:
        runAsUser: 1001
        fsGroup: 5000
      containers:
        - name: busybox
          image: busybox
          volumeMounts:
          - name: buildproperties
            mountPath: /etc/data
            subPath: data
          stdin: true
      initContainers:
      - name: git-sync
        image: k8s.gcr.io/git-sync/git-sync:v3.2.2
        volumeMounts:
        - name: buildproperties
          mountPath: "/workspace"
        - name: ssh-key
          mountPath: /etc/git-secret/
          readOnly: true
        env:
        - name: GIT_SYNC_SSH
          value: "true"
        - name: GIT_KNOWN_HOSTS
          value: "false"
        - name: GIT_SYNC_REPO
          value: git@bitbucket.org:XXX/YYY.git
        - name: GIT_SYNC_BRANCH
          value: "master"
        - name: GIT_SYNC_DEST
          value: "data"
        - name: GIT_SYNC_ONE_TIME
          value: "true"
        - name: GIT_SYNC_PERMISSIONS
          value: "0777"
        - name: GIT_SYNC_ADD_USER
          value: "true"
        - name: GIT_SYNC_ROOT
          value: "/workspace"
      volumes:
      - name: buildproperties
        emptyDir: {}
      - name: ssh-key
        secret:
          secretName: bitbucket-ssh-key
          defaultMode: 0400

thockin · 2021-03-16T17:56:47Z

Ahh, this is because 1001 does not exist in /etc/passwd, so is getting "/" as $HOME. Setting the git-root is the right answer and will be required in later versions of git-sync.

…

On Tue, Mar 16, 2021 at 5:42 AM Shubham Choudhary ***@***.***> wrote: *After I changed the GIT_SYNC_ROOT to say(/workspace) it worked like charm.* Now, I can see my files cloned with UID: 1001, GID:5000, and expected permissions. apiVersion: apps/v1 kind: Deployment metadata: name: poc spec: selector: matchLabels: app: poc replicas: 1 template: metadata: labels: app: poc spec: securityContext: runAsUser: 1001 fsGroup: 5000 containers: - name: busybox image: busybox volumeMounts: - name: buildproperties mountPath: /etc/data subPath: data stdin: true initContainers: - name: git-sync image: k8s.gcr.io/git-sync/git-sync:v3.2.2 volumeMounts: - name: buildproperties mountPath: "/workspace" - name: ssh-key mountPath: /etc/git-secret/ readOnly: true env: - name: GIT_SYNC_SSH value: "true" - name: GIT_KNOWN_HOSTS value: "false" - name: GIT_SYNC_REPO value: ***@***.***:XXX/YYY.git - name: GIT_SYNC_BRANCH value: "master" - name: GIT_SYNC_DEST value: "data" - name: GIT_SYNC_ONE_TIME value: "true" - name: GIT_SYNC_PERMISSIONS value: "0777" - name: GIT_SYNC_ADD_USER value: "true" - name: GIT_SYNC_ROOT value: "/workspace" volumes: - name: buildproperties emptyDir: {} - name: ssh-key secret: secretName: bitbucket-ssh-key defaultMode: 0400 — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#97 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ABKWAVASAED3UNLXODHFKR3TD5G4PANCNFSM4FFSE3NA> .

shubhamc183 · 2021-03-16T18:03:04Z

Is it documented somewhere? I was not able to find it.

If you want I can send a PR to add this note at the bottom of https://github.com/kubernetes/git-sync/blob/release-3.x/docs/ssh.md#step-3-configure-git-sync-container.

thockin · 2021-03-16T21:10:14Z

That would be great!

…

On Tue, Mar 16, 2021 at 11:03 AM Shubham Choudhary ***@***.***> wrote: Is it documented somewhere? I was not able to find it. If you want I can send a PR to add this note at the bottom of https://github.com/kubernetes/git-sync/blob/release-3.x/docs/ssh.md#step-3-configure-git-sync-container . — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#97 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ABKWAVHFJCEB3SEAVSJNW5TTD6MOVANCNFSM4FFSE3NA> .

shubhamc183 · 2021-03-17T13:05:58Z

/workspace/max-mind in git-sync container is mounted to /opt/deployment/max-mind in application container where max-mind repo is being created with the required UID and GID as passed in the runAsUser and fsGroup of podSecurityContext.

But while using GIT_SYNC_PERMISSIONS, argument, as "0755" I am getting this below error.

INFO: detected pid 1, running init handler
I0317 12:48:55.834540      11 main.go:321]  "level"=0 "msg"="starting up"  "args"=["/git-sync"] "pid"=11
I0317 12:48:55.834621      11 main.go:574]  "level"=0 "msg"="cloning repo"  "origin"="git@bitbucket.org:XXXX/YYYY.git" "path"="/workspace"
I0317 12:49:26.223966      11 main.go:480]  "level"=0 "msg"="syncing git"  "hash"="719007cc322f9cd1d1e3141c99f899e2be860a8c" "rev"="HEAD"
I0317 12:49:27.144134      11 main.go:501]  "level"=0 "msg"="adding worktree"  "branch"="origin/feature_1.0" "path"="/workspace/rev-719007cc322f9cd1d1e3141c99f899e2be860a8c"
I0317 12:49:27.164566      11 main.go:524]  "level"=0 "msg"="reset worktree to hash"  "hash"="719007cc322f9cd1d1e3141c99f899e2be860a8c" "path"="/workspace/rev-719007cc322f9cd1d1e3141c99f899e2be860a8c"
I0317 12:49:27.164676      11 main.go:528]  "level"=0 "msg"="updating submodules"  
I0317 12:49:27.196228      11 main.go:541]  "level"=0 "msg"="changing file permissions"  "mode"="01363"
E0317 12:49:27.197236      11 main.go:347]  "msg"="failed to sync repo, aborting" "error"="error running command: exit status 1: { stdout: \"\", stderr: \"chmod: cannot read directory '/workspace/rev-719007cc322f9cd1d1e3141c99f899e2be860a8c': Permission denied\\n\" }"

When I don't pass GIT_SYNC_PERMISSIONS I can manually go inside the application container and run chmod -R 755 /opt/deployment/max-mind successfully.

https://github.com/kubernetes/git-sync/pull/97\#issuecomment-800606819

thockin · 2021-03-17T17:16:33Z

Hi, Can you please break this permissions issue report into a new issue with the smallest repro possible?

https://github.com/kubernetes/git-sync/pull/97\#issuecomment-800606819

* Add GIT_SYNC_ROOT change for non-root user in docs/ssh https://github.com/kubernetes/git-sync/pull/97\#issuecomment-800606819 * linewrap * minor * Add GIT_SYNC_ROOT change for non-root user in docs/ssh https://github.com/kubernetes/git-sync/pull/97\#issuecomment-800606819 * linewrap * minor * minor

Add chown flag

222248a

k8s-ci-robot added the size/S Denotes a PR that changes 10-29 lines, ignoring generated files. label Jun 18, 2018

k8s-ci-robot added the cncf-cla: no Indicates the PR's author has not signed the CNCF CLA. label Jun 18, 2018

TimBozeman closed this Jun 19, 2018

shubhamc183 referenced this pull request in shubhamc183/git-sync Mar 17, 2021

Add GIT_SYNC_ROOT change for non-root user in docs/ssh

0e5426b

https://github.com/kubernetes/git-sync/pull/97\#issuecomment-800606819

shubhamc183 mentioned this pull request Mar 17, 2021

Add GIT_SYNC_ROOT change for non-root user in docs/ssh #354

Merged

shubhamc183 referenced this pull request in shubhamc183/git-sync Mar 17, 2021

Add GIT_SYNC_ROOT change for non-root user in docs/ssh

b6bed08

https://github.com/kubernetes/git-sync/pull/97\#issuecomment-800606819

shubhamc183 mentioned this pull request Mar 18, 2021

GIT_SYNC_PERMISSIONS not working for non-root user #363

Closed

Add chown flag. #97

Add chown flag. #97

Uh oh!

Conversation

TimBozeman commented Jun 18, 2018 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

k8s-ci-robot commented Jun 18, 2018

Uh oh!

TimBozeman commented Jun 19, 2018

Uh oh!

jasperf commented Dec 22, 2020

Uh oh!

thockin commented Dec 22, 2020

Uh oh!

jasperf commented Dec 22, 2020

Uh oh!

thockin commented Dec 22, 2020 via email

Uh oh!

shubhamc183 commented Mar 9, 2021

Uh oh!

thockin commented Mar 11, 2021

Uh oh!

shubhamc183 commented Mar 16, 2021

Uh oh!

shubhamc183 commented Mar 16, 2021

Uh oh!

thockin commented Mar 16, 2021 via email

Uh oh!

shubhamc183 commented Mar 16, 2021

Uh oh!

thockin commented Mar 16, 2021 via email

Uh oh!

shubhamc183 commented Mar 17, 2021

Uh oh!

thockin commented Mar 17, 2021

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

TimBozeman commented Jun 18, 2018 •

edited

Loading