-
Notifications
You must be signed in to change notification settings - Fork 4.9k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Permission denied for /var/lib/{folder}
#956
Comments
Thanks for the report. I've repro'd this and am now going to try in a GKE cluster to see if this is minikube-specific or not. |
It looks like this does work in GKE. Minikube uses a HostPath PV, while GKE uses a GCEPersistentDisk. Something in the HostPath provisioner must be leaving the permissions different. |
This looks like the relevant code: https://github.com/kubernetes/kubernetes/blob/master/pkg/volume/host_path/host_path.go#L301 The hostpaths get created with 0750, and localkube runs as root so the directory is only accessible by root. |
It looks like this issue: kubernetes/kubernetes#2630 The "fsGroup" workaround doesn't work either, since HostPath doesn't support fsGroup. We might want to open an issue on the contrib repo to stop running as the zookeeper user. |
Seems like the relevant code came from this commit. So why does GKE work then? Shouldn't it have the same security assumptions about what GID and UID are allowed to access a mounted volume inside a container? Also:
How come HostPaths are only writable by root by design? Or is it by accident? |
It works in GKE because the GCEPersistentDisk provisioner doesn't have the same limitations. If you tried to use a HostPath volume in GKE you'd have the same issue. I agree we should try to make these work out of the box in Minikube. Here are some options I see:
I'm not sure if anyone else has other ideas. |
I added a comment showcasing my ignorance, hoping to be enlightened. So I think making HostPath work similar to how docker volumes work is the best way to go forward. Also relevant: Note that ZK runs with:
|
Thanks! FYI, I tried out this commit and it seems to work: dlorenc/kubernetes@824d1f0 Hopefully we can get some clarity on why this hasn't been implemented in k8s yet. |
Could you PR that to kubernetes to see what they say? |
@dlorenc: Could you perhaps submit a pull request so the CI builds your minikube release and i can test? I'd like to try out that commit as well regarding permissions issue on PHP's RecursiveDirectoryIterator() but im not familiar with the build process for minikube (incorporating a new kubernetes build/commit specifically) I have successfully built k8s from your fork (which after a little research seems misguided as its normally part of the mini/localkube build process). Im also happy to do it myself if you can direct me to any guidance or documentation but I tried this and it failed in the minikube build step after 5 which i assume was supposed to be "make". Im in slack as well if you prefer/have time to chat. Thanks! |
@haf I'll submit one to k8s today. @michaelfavia I just submitted one to minikube so we'll get a CI build. Check #959 |
Just sent kubernetes/kubernetes#39438 |
Any updates on this? Would be great to have a minikube to run services on rather than having to bridge to a vagrant-ansible setup. Here's the current roadmap. |
Sorry, haven't heard anything on the PR yet. Hopefully we hear back this week. |
Could minikube work around this while the main project considers the change? |
I came across the same issues trying to run helm charts for rabbitmq: helm/charts#825 The code is trying to be ran as rabbitmq, but the permissions on the folders are reset to root. |
I am trying to run zookeeper on minikube aswell. When I use this security context I get a permission denied error:
But without the
|
I am running into this issue with running a jenkins instance, JENKINS_HOME path needs to be persistent, neither |
I run into the same with Jenkins. |
After ignoreing this for a while i had to come back to it and figure it out. You have to enable "standard" class storeage Then I can get the helm chart for jenkins to work by adding to the values.yaml:
You can probably dig into the chart to see why this works. i haven't yet. |
I got this working by making a derivative of the official Jenkins Docker image that uses root instead of UID 1000. It's the only way I could get past the permissions errors with the minikube hostpath provisioner. Dockerfile looks like this:
|
I am having a similar problem with mysql and trying to do a volume hostPath to /data. So, is the answer here to run all our docker containers as root? |
Minikube has it's own hostpath provisioner now that should create directories in a more-writeable location :) could you attach the output of: kubectl get storageclass kubectl get pv kubectl describe $pod for the pod you configured with the volume? |
and for good measure here is my spec
|
@lukeab This gave me a good lead, I'm not sure why the storageClassName needed to be manually specified rather than defaulted properly to |
@dlorenc Any ideas? |
We fixed this by changing the zookeeper demo to stop using the alpha storage annotation. It should work now at master. |
@siwyd's #956 (comment) just saved my whole day. This was a very difficult problem to understand. Perhaps minikube should just ship with the default storage class already enabled? |
Is this a BUG REPORT or FEATURE REQUEST? (choose one): BUG
Minikube version (use
minikube version
): v0.14.0Environment:
cat ~/.minikube/machines/minikube/config.json | grep DriverName
): virtualboxdocker -v
): Docker version 1.12.0, build 8eab29eWhat happened:
I'm trying to set up a StatefulSet with minikube. It's failing, both for Consul and ZooKeeper. Repro:
From the Kubernetes blog entry.
Also see this issue.
What you expected to happen:
It to work.
How to reproduce it (as minimally and precisely as possible):
Anything else do we need to know: No.
The text was updated successfully, but these errors were encountered: