Skip to content
This repository has been archived by the owner on Feb 22, 2022. It is now read-only.

Commit

Permalink
[stable/spinnaker] Relax PSP
Browse files Browse the repository at this point in the history
Some processes need to change files from different users (deck for
instance).
If the pod is run as non root, deck does not start:

**********************
cp: cannot create regular file 'spinnaker.conf': Permission denied
sed: can't read spinnaker.conf: No such file or directory
sed: can't read spinnaker.conf: No such file or directory
sed: can't read spinnaker.conf: No such file or directory
mv: cannot stat 'spinnaker.conf': No such file or directory
ERROR: Site spinnaker does not exist!
Could not remove /etc/apache2/sites-enabled/000-default.conf: Permission denied
cp: cannot create regular file 'ports.conf': Permission denied
sed: can't read ports.conf: No such file or directory
sed: can't read ports.conf: No such file or directory
mv: cannot stat 'ports.conf': No such file or directory
cp: cannot create regular file 'passphrase': Permission denied
sed: can't read passphrase: No such file or directory
chmod: cannot access 'passphrase': No such file or directory
mv: cannot stat 'passphrase': No such file or directory
cp: cannot create regular file '/opt/deck/html/settings.js': Permission denied
chown: changing ownership of '/var/lock/apache2.ZWzj1uONRl': Operation not permitted
**********************

Relaxing the PSP to allow this.
  • Loading branch information
jfrabaute committed Jun 18, 2020
1 parent 6de3734 commit 792fd9c
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion stable/spinnaker/templates/rbac/psp-halyard.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -17,7 +17,7 @@ spec:
hostIPC: false
hostPID: false
runAsUser:
rule: 'MustRunAsNonRoot'
rule: 'RunAsAny'
seLinux:
rule: 'RunAsAny'
supplementalGroups:
Expand Down

0 comments on commit 792fd9c

Please sign in to comment.