From f73a24c6bc53c28496f0ed7658b98456568dfc55 Mon Sep 17 00:00:00 2001 From: Fabrice Date: Fri, 19 Jun 2020 13:16:47 -0700 Subject: [PATCH] [stable/spinnaker] Relax PSP (#22867) Some processes need to change files from different users (deck for instance). If the pod is run as non root, deck does not start: ********************** cp: cannot create regular file 'spinnaker.conf': Permission denied sed: can't read spinnaker.conf: No such file or directory sed: can't read spinnaker.conf: No such file or directory sed: can't read spinnaker.conf: No such file or directory mv: cannot stat 'spinnaker.conf': No such file or directory ERROR: Site spinnaker does not exist! Could not remove /etc/apache2/sites-enabled/000-default.conf: Permission denied cp: cannot create regular file 'ports.conf': Permission denied sed: can't read ports.conf: No such file or directory sed: can't read ports.conf: No such file or directory mv: cannot stat 'ports.conf': No such file or directory cp: cannot create regular file 'passphrase': Permission denied sed: can't read passphrase: No such file or directory chmod: cannot access 'passphrase': No such file or directory mv: cannot stat 'passphrase': No such file or directory cp: cannot create regular file '/opt/deck/html/settings.js': Permission denied chown: changing ownership of '/var/lock/apache2.ZWzj1uONRl': Operation not permitted ********************** Relaxing the PSP to allow this. Signed-off-by: Fabrice Rabaute --- stable/spinnaker/Chart.yaml | 2 +- stable/spinnaker/templates/rbac/psp-halyard.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/stable/spinnaker/Chart.yaml b/stable/spinnaker/Chart.yaml index f66f288adb..6b38103ca6 100644 --- a/stable/spinnaker/Chart.yaml +++ b/stable/spinnaker/Chart.yaml @@ -1,7 +1,7 @@ apiVersion: v1 description: Open source, multi-cloud continuous delivery platform for releasing software changes with high velocity and confidence. name: spinnaker -version: 2.0.0-rc6 +version: 2.0.0-rc7 appVersion: 1.16.2 home: http://spinnaker.io/ sources: diff --git a/stable/spinnaker/templates/rbac/psp-halyard.yaml b/stable/spinnaker/templates/rbac/psp-halyard.yaml index d6910e0326..f7a4e0c644 100644 --- a/stable/spinnaker/templates/rbac/psp-halyard.yaml +++ b/stable/spinnaker/templates/rbac/psp-halyard.yaml @@ -17,7 +17,7 @@ spec: hostIPC: false hostPID: false runAsUser: - rule: 'MustRunAsNonRoot' + rule: 'RunAsAny' seLinux: rule: 'RunAsAny' supplementalGroups: