You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
feat(racer): inject racer-object sidecars via racer-controller webhook - #939
Adds in opt-in racer-object sidecar injection for pods that need an S3 or Azure blob interface to Racer.
Also allows the Racer client UDSs to be used by non-root processes.
Re-own trusted leftover entries while the old root owner still holds the
directory, then narrow the mode, then chown the directory. The origin user
can no longer swap entries during migration, and a run that stops before
the handoff retries the migration. Skip migration when the dataplane is
unprivileged so entries never change when the directory cannot.
The sidecar requires Linux. Only the kubernetes.io/os nodeSelector was
checked, so a pod with spec.os.name=windows was mutated and then failed
API validation with an unclear error.
Kubelet expands $(VAR) in container args. The namespace annotation may
contain "$", so a value like store$(KUBERNETES_SERVICE_HOST) reached
the sidecar changed, giving a different cache identity. Write each "$"
as "$$" so kubelet passes the namespace through unchanged.
Root origins could leave /run/racer/<cache>/client as 0700 or 0750, so
nonroot SDK clients could not reach the 0666 client socket. After removing
group and other write bits, add group and other search bits through the
pinned descriptor and verify the inode, owner, and mode. Read and write
bits are not added, ownership stays with the dataplane, and the shared
uds-endpoint helper is unchanged.
Add an O_PATH case for a secure 0700 client directory. It passes
restrict_directory and fails in the search grant fchmod, leaving the mode
and owner unchanged. Clarify that the search bits are for users other
than the directory owner.
A list or ownership error during origin entry migration was only logged,
and the directory was still handed to the origin user. The next run then
saw an owned directory and never retried, so a root-owned lock left by a
root origin blocked the SDK origin.
Return the first migration error after trying every entry, and skip chmod
and chown on failure. The directory keeps its old trusted owner, so the
next bind retries. Skipped symlinks, hard links, and other types are still
not errors.
The reason will be displayed to describe this comment to others. Learn more.
🔵 Needs a closer look
Fail-closed admission and privileged ownership migration require human validation, and a permission-test descriptor bug remains unresolved.
No open issues 🎉
1 previously missed issue
In code that hasn't changed since last review
Clear FD_CLOEXEC when duplicating directory onto descriptor 3
cmd/racer-dataplane/src/client/tests.rs:301
If parallel tests release descriptor 3 before directory is opened, directory.as_raw_fd() can be 3. The directory is opened with O_CLOEXEC (cmd/racer-dataplane/uds-endpoint/src/directory.rs:34), and dup2(3, 3) leaves that flag set. Exec then closes the descriptor, so the post-migration assertion at line 309 fails even when permissions are correct. Clear FD_CLOEXEC on descriptor 3 after duplication, including the self-duplication case.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
Adds in opt-in racer-object sidecar injection for pods that need an S3 or Azure blob interface to Racer.
Also allows the Racer client UDSs to be used by non-root processes.