Skip to content

Commit b2d31f3

Browse files
authored
Merge pull request #219 from cognifloyd/stanley_rsa-permissions
Fix stanley_rsa permissions via postStart pod lifecycle hook
2 parents 824bf74 + a6e4ab1 commit b2d31f3

File tree

4 files changed

+60
-4
lines changed

4 files changed

+60
-4
lines changed

CHANGELOG.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,7 @@
1414
* Add advanced pod placment (nodeSelector, affinity, tolerations) to specs for batch Jobs pods. (#193) (by @cognifloyd)
1515
* Allow adding dnsPolicy and/or dnsConfig to all pods. (#201) (by @cognifloyd)
1616
* Move st2-config-vol volume definition and list of st2-config-vol volumeMounts to helpers to reduce duplication (#198) (by @cognifloyd)
17+
* Fix permissions for /home/stanley/.ssh/stanley_rsa using the postStart lifecycle hook (#219) (by @cognifloyd)
1718

1819
## v0.60.0
1920
* Switch st2 version to `v3.5dev` as a new latest development version (#187)
Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
---
2+
apiVersion: v1
3+
kind: ConfigMap
4+
metadata:
5+
name: {{ $.Release.Name }}-st2actionrunner-post-start-script
6+
annotations:
7+
description: Custom postStart lifecycle event handler script for st2actionrunner
8+
labels:
9+
app: st2
10+
tier: backend
11+
vendor: stackstorm
12+
chart: {{ $.Chart.Name }}-{{ $.Chart.Version }}
13+
release: {{ $.Release.Name }}
14+
heritage: {{ $.Release.Service }}
15+
data:
16+
# k8s calls this script in parallel with starting st2actionrunner (ie the same time as ENTRYPOINT)
17+
# The pod will not be marked as "running" until this script completes successfully.
18+
# see: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/
19+
post-start.sh: |
20+
#!/bin/bash
21+
mkdir -p /home/stanley/.ssh
22+
cp -L /home/stanley/.ssh{-key-vol,}/stanley_rsa
23+
chown -R stanley:stanley /home/stanley/.ssh/
24+
chmod 400 /home/stanley/.ssh/stanley_rsa
25+
chmod 500 /home/stanley/.ssh

templates/deployments.yaml

Lines changed: 22 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1020,8 +1020,7 @@ spec:
10201020
volumeMounts:
10211021
{{- include "st2-config-volume-mounts" . | nindent 8 }}
10221022
- name: st2-ssh-key-vol
1023-
mountPath: /home/stanley/.ssh/
1024-
readOnly: true
1023+
mountPath: /home/stanley/.ssh-key-vol/
10251024
{{- if .Values.st2.datastore_crypto_key }}
10261025
- name: st2-encryption-key-vol
10271026
mountPath: /etc/st2/keys
@@ -1035,6 +1034,13 @@ spec:
10351034
mountPath: /opt/stackstorm/virtualenvs
10361035
readOnly: true
10371036
{{- end }}
1037+
- name: st2-post-start-script-vol
1038+
mountPath: /post-start.sh
1039+
subPath: post-start.sh
1040+
lifecycle:
1041+
postStart:
1042+
exec:
1043+
command: ["/bin/bash", "/post-start.sh"]
10381044
resources:
10391045
{{- toYaml .Values.st2actionrunner.resources | nindent 10 }}
10401046
{{- if .Values.st2actionrunner.serviceAccount.attach }}
@@ -1061,6 +1067,9 @@ spec:
10611067
{{- if .Values.st2.packs.images }}
10621068
{{- include "packs-volumes" . | indent 8 }}
10631069
{{- end }}
1070+
- name: st2-post-start-script-vol
1071+
configMap:
1072+
name: {{ .Release.Name }}-st2actionrunner-post-start-script
10641073
{{- if .Values.dnsPolicy }}
10651074
dnsPolicy: {{ .Values.dnsPolicy }}
10661075
{{- end }}
@@ -1259,8 +1268,7 @@ spec:
12591268
- name: st2client-config-vol
12601269
mountPath: /root/.st2/
12611270
- name: st2-ssh-key-vol
1262-
mountPath: /home/stanley/.ssh/
1263-
readOnly: true
1271+
mountPath: /home/stanley/.ssh-key-vol/
12641272
{{- if .Values.st2.datastore_crypto_key }}
12651273
- name: st2-encryption-key-vol
12661274
mountPath: /etc/st2/keys
@@ -1274,10 +1282,17 @@ spec:
12741282
mountPath: /opt/stackstorm/virtualenvs
12751283
readOnly: true
12761284
{{- end }}
1285+
- name: st2-post-start-script-vol
1286+
mountPath: /post-start.sh
1287+
subPath: post-start.sh
12771288
command:
12781289
- 'bash'
12791290
- '-ec'
12801291
- 'while true; do sleep 999; done'
1292+
lifecycle:
1293+
postStart:
1294+
exec:
1295+
command: ["/bin/bash", "/post-start.sh"]
12811296
resources:
12821297
requests:
12831298
memory: "5Mi"
@@ -1320,6 +1335,9 @@ spec:
13201335
{{- if .Values.st2.packs.images }}
13211336
{{- include "packs-volumes" . | indent 8 }}
13221337
{{- end }}
1338+
- name: st2-post-start-script-vol
1339+
configMap:
1340+
name: {{ .Release.Name }}-st2actionrunner-post-start-script
13231341

13241342
{{ if .Values.st2chatops.enabled -}}
13251343
---

tests/st2tests.sh

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -52,6 +52,18 @@ load "${BATS_HELPERS_DIR}/bats-file/load.bash"
5252
assert_line --partial 'succeeded: true'
5353
}
5454

55+
@test 'stanley_rsa file has correct permissions and ownership' {
56+
local ssh_dir="/home/stanley/.ssh"
57+
local private_key="${ssh_dir}/stanley_rsa"
58+
run st2 run core.local cmd="find ${ssh_dir} -printf '%p: %u %g %m\n'"
59+
assert_success
60+
assert_line --partial 'return_code: 0'
61+
assert_line --partial "stderr: ''"
62+
assert_line --partial "${ssh_dir}: stanley stanley 500"
63+
assert_line --partial "${private_key}: stanley stanley 400"
64+
assert_line --partial 'succeeded: true'
65+
}
66+
5567
@test 'st2 chatops core rule is loaded' {
5668
run st2 rule list
5769
assert_success

0 commit comments

Comments
 (0)