Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Updated git-clone task #2469

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Updated git-clone task #2469

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 4 additions & 2 deletions pkg/pipelines/tekton/tasks.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -66,7 +66,7 @@ spec:
default: "1001"
- name: GROUP_ID
description: The group ID of the builder image user.
default: "0"
default: "65532"
Copy link
Member

@lkingland lkingland Aug 28, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What happens if this setting were just removed? This default group ID, and runAsGroup below, and the fsGroup setting? Is it possible that explicitly setting these to 0 is what caused the problem in the first place?

Copy link
Contributor Author

@matejvasek matejvasek Aug 28, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The primary problem is that that uid is changed, not gid. This causes that git-fetch task on second run cannot clean up the volume. I fixed it by setting gid to match gid of git-fetch task (and also fsGroup) and by setting write access to said group on line 111.

TBH I have no idea why the gid here was set to 0 here. Zbynek implemented it that way long ago.
IMO the gid should be 1000 to match buildpack builder, but it works also with 65532.

I suspect I could just s/65532/1000/g on this PR and it still would work. But I am not sure.

Copy link
Contributor Author

@matejvasek matejvasek Aug 28, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This whole ceremony here can be ignored on OCP. OCP automatically sets fsGroup and also adds write perms for the group.
Actually on OCP you must not set podTemplate.securityContext, otherwise there will be error.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The primary problem is that that uid is changed, not gid.

This and the fact that set gid works oddly or not at all.

##############################################################
##### "default" has been changed to "0" for Knative Functions
- name: PLATFORM_DIR
Expand Down Expand Up @@ -108,6 +108,8 @@ spec:
fi
done

chmod -R g+w "$(workspaces.source.path)"

echo "> Parsing additional configuration..."
parsing_flag=""
envs=()
Expand Down Expand Up @@ -187,7 +189,7 @@ spec:
runAsUser: 1001
#################################################################
##### "runAsGroup" has been changed to "0" for Knative Functions
runAsGroup: 0
runAsGroup: 65532

- name: results
image: docker.io/library/bash:5.1.4@sha256:b208215a4655538be652b2769d82e576bc4d0a2bb132144c060efc5be8c3f5d6
Expand Down
2 changes: 1 addition & 1 deletion pkg/pipelines/tekton/templates.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -57,7 +57,7 @@ const (
- name: name
value: git-clone
- name: version
value: "0.4"
value: "0.9"
workspaces:
- name: output
workspace: source-workspace`
Expand Down
3 changes: 3 additions & 0 deletions pkg/pipelines/tekton/templates_pack.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -103,6 +103,9 @@ metadata:
{{end}}
generateName: {{.PipelineRunName}}
spec:
podTemplate:
securityContext:
fsGroup: 65532
params:
- name: gitRepository
value: {{.RepoUrl}}
Expand Down
3 changes: 3 additions & 0 deletions pkg/pipelines/tekton/templates_s2i.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -108,6 +108,9 @@ metadata:
{{end}}
generateName: {{.PipelineRunName}}
spec:
podTemplate:
securityContext:
fsGroup: 65532
params:
- name: gitRepository
value: {{.RepoUrl}}
Expand Down
Loading