Nail/fission-src
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Non-root users access Secrets and ConfigMaps (#1697)

Browse Source 
Co-authored-by: Vishal <vishal-biyani@users.noreply.github.com>
This commit is contained in:
Andrew
2020-09-11 10:24:28 +05:30
committed by GitHub
co-authored by Vishal
parent 07b294778a
commit 4fbaae4b12
1 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/fetcher/fetcher.go
+4 -4
View File
@@ -58,7 +58,7 @@ type (
) )
func makeVolumeDir(dirPath string) error { func makeVolumeDir(dirPath string) error {
return os.MkdirAll(dirPath, os.ModeDir|0700) return os.MkdirAll(dirPath, os.ModeDir|0750)
} }
func MakeFetcher(logger *zap.Logger, sharedVolumePath string, sharedSecretPath string, sharedConfigPath string) (*Fetcher, error) { func MakeFetcher(logger *zap.Logger, sharedVolumePath string, sharedSecretPath string, sharedConfigPath string) (*Fetcher, error) {
@@ -106,7 +106,7 @@ func verifyChecksum(fileChecksum, checksum *fv1.Checksum) error {
func writeSecretOrConfigMap(dataMap map[string][]byte, dirPath string) error { func writeSecretOrConfigMap(dataMap map[string][]byte, dirPath string) error {
for key, val := range dataMap { for key, val := range dataMap {
writeFilePath := filepath.Join(dirPath, key) writeFilePath := filepath.Join(dirPath, key)
err := ioutil.WriteFile(writeFilePath, val, 0600) err := ioutil.WriteFile(writeFilePath, val, 0750)
if err != nil { if err != nil {
return errors.Wrapf(err, "Failed to write file %s", writeFilePath) return errors.Wrapf(err, "Failed to write file %s", writeFilePath)
} }
@@ -347,7 +347,7 @@ func (fetcher *Fetcher) FetchSecretsAndCfgMaps(secrets []fv1.SecretReference, cf
secretPath := filepath.Join(secret.Namespace, secret.Name) secretPath := filepath.Join(secret.Namespace, secret.Name)
secretDir := filepath.Join(fetcher.sharedSecretPath, secretPath) secretDir := filepath.Join(fetcher.sharedSecretPath, secretPath)
err = os.MkdirAll(secretDir, os.ModeDir|0644) err = os.MkdirAll(secretDir, os.ModeDir|0750)
if err != nil { if err != nil {
e := "failed to create directory for secret" e := "failed to create directory for secret"
fetcher.logger.Error(e, fetcher.logger.Error(e,
@@ -391,7 +391,7 @@ func (fetcher *Fetcher) FetchSecretsAndCfgMaps(secrets []fv1.SecretReference, cf
configPath := filepath.Join(config.Namespace, config.Name) configPath := filepath.Join(config.Namespace, config.Name)
configDir := filepath.Join(fetcher.sharedConfigPath, configPath) configDir := filepath.Join(fetcher.sharedConfigPath, configPath)
err = os.MkdirAll(configDir, os.ModeDir|0644) err = os.MkdirAll(configDir, os.ModeDir|0750)
if err != nil { if err != nil {
e := "failed to create directory for configmap" e := "failed to create directory for configmap"
fetcher.logger.Error(e, fetcher.logger.Error(e,