Skip to content

Commit f49eb31

Browse files
42atomys42atomys
authored
fix: dragonfly cannot start due to disk permissions (#437)
Describe the pull request This pull request addresses an issue preventing Dragonfly from starting due to disk permission errors. The fix involves modifying the disk permission settings, allowing Dragonfly to access the necessary resources and launch as expected. **Checklist** - [x] I have linked the relative issue to this pull request - [x] I have made the modifications or added tests related to my PR - [x] I have added/updated the documentation for my RP - [x] I put my PR in Ready for Review only when all the checklist is checked **Breaking changes ?** no
1 parent 4442a58 commit f49eb31

File tree

6 files changed

+124
-0
lines changed

6 files changed

+124
-0
lines changed

‎deploy/modules/service/cronjob.tf

+29
Original file line numberDiff line numberDiff line change
@@ -77,6 +77,35 @@ resource "kubernetes_cron_job" "app" {
7777
}
7878
}
7979

80+
dynamic "init_container" {
81+
for_each = { for k, v in var.volumeMounts : k => v if var.fixPermissions == true && v.readOnly == false }
82+
83+
content {
84+
name = "fix-permissions-${init_container.key}"
85+
image = "busybox"
86+
command = [
87+
"chown",
88+
"-R",
89+
"${var.containerSecurityContext.runAsUser}:${var.containerSecurityContext.runAsGroup}",
90+
init_container.value.mountPath,
91+
]
92+
93+
security_context {
94+
run_as_group = 0
95+
run_as_user = 0
96+
run_as_non_root = false
97+
}
98+
99+
volume_mount {
100+
name = init_container.value.volumeName
101+
mount_path = init_container.value.mountPath
102+
read_only = lookup(init_container.value, "readOnly", false)
103+
sub_path = lookup(init_container.value, "subPath", null)
104+
mount_propagation = lookup(init_container.value, "mountPropagation", null)
105+
}
106+
}
107+
}
108+
80109
security_context {
81110
run_as_user = lookup(var.podSecurityContext, "runAsUser", 1000)
82111
run_as_group = lookup(var.podSecurityContext, "runAsGroup", 1000)

‎deploy/modules/service/deamonset.tf

+29
Original file line numberDiff line numberDiff line change
@@ -62,6 +62,35 @@ resource "kubernetes_daemonset" "app" {
6262
}
6363
}
6464

65+
dynamic "init_container" {
66+
for_each = { for k, v in var.volumeMounts : k => v if var.fixPermissions == true && v.readOnly == false }
67+
68+
content {
69+
name = "fix-permissions-${init_container.key}"
70+
image = "busybox"
71+
command = [
72+
"chown",
73+
"-R",
74+
"${var.containerSecurityContext.runAsUser}:${var.containerSecurityContext.runAsGroup}",
75+
init_container.value.mountPath,
76+
]
77+
78+
security_context {
79+
run_as_group = 0
80+
run_as_user = 0
81+
run_as_non_root = false
82+
}
83+
84+
volume_mount {
85+
name = init_container.value.volumeName
86+
mount_path = init_container.value.mountPath
87+
read_only = lookup(init_container.value, "readOnly", false)
88+
sub_path = lookup(init_container.value, "subPath", null)
89+
mount_propagation = lookup(init_container.value, "mountPropagation", null)
90+
}
91+
}
92+
}
93+
6594
security_context {
6695
run_as_user = lookup(var.podSecurityContext, "runAsUser", 1000)
6796
run_as_group = lookup(var.podSecurityContext, "runAsGroup", 1000)

‎deploy/modules/service/deployment.tf

+29
Original file line numberDiff line numberDiff line change
@@ -64,6 +64,35 @@ resource "kubernetes_deployment" "app" {
6464
}
6565
}
6666

67+
dynamic "init_container" {
68+
for_each = { for k, v in var.volumeMounts : k => v if var.fixPermissions == true && v.readOnly == false }
69+
70+
content {
71+
name = "fix-permissions-${init_container.key}"
72+
image = "busybox"
73+
command = [
74+
"chown",
75+
"-R",
76+
"${var.containerSecurityContext.runAsUser}:${var.containerSecurityContext.runAsGroup}",
77+
init_container.value.mountPath,
78+
]
79+
80+
security_context {
81+
run_as_group = 0
82+
run_as_user = 0
83+
run_as_non_root = false
84+
}
85+
86+
volume_mount {
87+
name = init_container.value.volumeName
88+
mount_path = init_container.value.mountPath
89+
read_only = lookup(init_container.value, "readOnly", false)
90+
sub_path = lookup(init_container.value, "subPath", null)
91+
mount_propagation = lookup(init_container.value, "mountPropagation", null)
92+
}
93+
}
94+
}
95+
6796
security_context {
6897
run_as_user = lookup(var.podSecurityContext, "runAsUser", 1000)
6998
run_as_group = lookup(var.podSecurityContext, "runAsGroup", 1000)

‎deploy/modules/service/statefulset.tf

+29
Original file line numberDiff line numberDiff line change
@@ -70,6 +70,35 @@ resource "kubernetes_stateful_set" "app" {
7070
}
7171
}
7272

73+
dynamic "init_container" {
74+
for_each = { for k, v in var.volumeMounts : k => v if var.fixPermissions == true && v.readOnly == false }
75+
76+
content {
77+
name = "fix-permissions-${init_container.key}"
78+
image = "busybox"
79+
command = [
80+
"chown",
81+
"-R",
82+
"${var.containerSecurityContext.runAsUser}:${var.containerSecurityContext.runAsGroup}",
83+
init_container.value.mountPath,
84+
]
85+
86+
security_context {
87+
run_as_group = 0
88+
run_as_user = 0
89+
run_as_non_root = false
90+
}
91+
92+
volume_mount {
93+
name = init_container.value.volumeName
94+
mount_path = init_container.value.mountPath
95+
read_only = lookup(init_container.value, "readOnly", false)
96+
sub_path = lookup(init_container.value, "subPath", null)
97+
mount_propagation = lookup(init_container.value, "mountPropagation", null)
98+
}
99+
}
100+
}
101+
73102
security_context {
74103
run_as_user = lookup(var.podSecurityContext, "runAsUser", 1000)
75104
run_as_group = lookup(var.podSecurityContext, "runAsGroup", 1000)

‎deploy/modules/service/variables.tf

+6
Original file line numberDiff line numberDiff line change
@@ -654,3 +654,9 @@ variable "serviceType" {
654654
error_message = "serviceType must be one of ClusterIP, NodePort or LoadBalancer"
655655
}
656656
}
657+
658+
variable "fixPermissions" {
659+
type = bool
660+
description = "Fix permissions of the mounted volumes (start an init container as root to chown the volumes)"
661+
default = false
662+
}

‎deploy/stacks/apps/s42/storages.tf

+2
Original file line numberDiff line numberDiff line change
@@ -249,6 +249,8 @@ module "dragonfly" {
249249
replicas = 1
250250
maxUnavailable = 0
251251

252+
fixPermissions = true
253+
252254
prometheus = {
253255
enabled = true
254256
port = 6379

0 commit comments

Comments
 (0)