Skip to content

Commit 01a5a5b

Browse files
rabirabi
committed
Set SSH private key file permissions to 0600
OpenSSH requires private keys to have mode 0600 when the file owner matches the process UID. With restricted-v2 SCC, the process runs as a random UID different from the file owner (root), so OpenSSH skips the check. But ansible-ee containers use anyuid SCC, running as root which matches the key file owner, triggering the strict permission check. Set defaultMode to 384 (0600) for SSH key volumes to ensure OpenSSH accepts the key. Signed-off-by: rabi <ramishra@redhat.com>
1 parent 38e6308 commit 01a5a5b

15 files changed

Lines changed: 51 additions & 48 deletions

File tree

‎internal/dataplane/util/ansible_execution.go‎

Lines changed: 7 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,7 @@ import (
3030
corev1 "k8s.io/api/core/v1"
3131
k8serrors "k8s.io/apimachinery/pkg/api/errors"
3232
apimachineryvalidation "k8s.io/apimachinery/pkg/util/validation"
33+
"k8s.io/utils/ptr"
3334
"sigs.k8s.io/controller-runtime/pkg/client"
3435

3536
networkv1 "github.com/k8snetworkplumbingwg/network-attachment-definition-client/pkg/apis/k8s.cni.cncf.io/v1"
@@ -324,7 +325,7 @@ func SetAeeSSHMounts(
324325
sshKeyMountSubPath = fmt.Sprintf("ssh_key_%s", sshKeyNodeName)
325326
sshKeyMountPath = fmt.Sprintf("/runner/env/ssh_key/%s", sshKeyMountSubPath)
326327

327-
CreateVolume(ansibleEEMounts, sshKeyName, sshKeyMountSubPath, sshKeySecret, "ssh-privatekey")
328+
CreateVolume(ansibleEEMounts, sshKeyName, sshKeyMountSubPath, sshKeySecret, "ssh-privatekey", ptr.To(int32(0600)))
328329
CreateVolumeMount(ansibleEEMounts, sshKeyName, sshKeyMountPath, sshKeyMountSubPath)
329330
}
330331
}
@@ -361,18 +362,20 @@ func SetAeeInvMounts(
361362
inventoryMountPath = "/runner/inventory/hosts"
362363
}
363364

364-
CreateVolume(ansibleEEMounts, inventoryName, inventoryName, inventorySecrets[nodeName], "inventory")
365+
CreateVolume(ansibleEEMounts, inventoryName, inventoryName, inventorySecrets[nodeName], "inventory", nil)
365366
CreateVolumeMount(ansibleEEMounts, inventoryName, inventoryMountPath, inventoryName)
366367
}
367368
}
368369

369370
// CreateVolume creates a volume configuration for Ansible Execution Environment mounts
370-
func CreateVolume(ansibleEEMounts *storage.VolMounts, volumeName string, volumeMountPath string, secretName string, keyToPathKey string) {
371+
// If defaultMode is nil, Kubernetes default (0644) is used
372+
func CreateVolume(ansibleEEMounts *storage.VolMounts, volumeName string, volumeMountPath string, secretName string, keyToPathKey string, defaultMode *int32) {
371373
volume := storage.Volume{
372374
Name: volumeName,
373375
VolumeSource: storage.VolumeSource{
374376
Secret: &corev1.SecretVolumeSource{
375-
SecretName: secretName,
377+
SecretName: secretName,
378+
DefaultMode: defaultMode,
376379
Items: []corev1.KeyToPath{
377380
{
378381
Key: keyToPathKey,

‎test/kuttl/tests/dataplane-deploy-global-service-test/01-assert.yaml‎

Lines changed: 14 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -162,7 +162,7 @@ spec:
162162
secretName: combined-ca-bundle
163163
- name: ssh-key-edpm-compute-global
164164
secret:
165-
defaultMode: 420
165+
defaultMode: 384
166166
items:
167167
- key: ssh-privatekey
168168
path: ssh_key_edpm-compute-global
@@ -258,7 +258,7 @@ spec:
258258
volumes:
259259
- name: ssh-key-edpm-compute-global
260260
secret:
261-
defaultMode: 420
261+
defaultMode: 384
262262
items:
263263
- key: ssh-privatekey
264264
path: ssh_key_edpm-compute-global
@@ -362,7 +362,7 @@ spec:
362362
secretName: combined-ca-bundle
363363
- name: ssh-key-edpm-compute-global
364364
secret:
365-
defaultMode: 420
365+
defaultMode: 384
366366
items:
367367
- key: ssh-privatekey
368368
path: ssh_key_edpm-compute-global
@@ -460,7 +460,7 @@ spec:
460460
volumes:
461461
- name: ssh-key-edpm-compute-global
462462
secret:
463-
defaultMode: 420
463+
defaultMode: 384
464464
items:
465465
- key: ssh-privatekey
466466
path: ssh_key_edpm-compute-global
@@ -558,7 +558,7 @@ spec:
558558
volumes:
559559
- name: ssh-key-edpm-compute-global
560560
secret:
561-
defaultMode: 420
561+
defaultMode: 384
562562
items:
563563
- key: ssh-privatekey
564564
path: ssh_key_edpm-compute-global
@@ -656,7 +656,7 @@ spec:
656656
volumes:
657657
- name: ssh-key-edpm-compute-global
658658
secret:
659-
defaultMode: 420
659+
defaultMode: 384
660660
items:
661661
- key: ssh-privatekey
662662
path: ssh_key_edpm-compute-global
@@ -808,7 +808,7 @@ spec:
808808
secretName: combined-ca-bundle
809809
- name: ssh-key-edpm-compute-global
810810
secret:
811-
defaultMode: 420
811+
defaultMode: 384
812812
items:
813813
- key: ssh-privatekey
814814
path: ssh_key_edpm-compute-global
@@ -917,7 +917,7 @@ spec:
917917
secretName: combined-ca-bundle
918918
- name: ssh-key-edpm-compute-global
919919
secret:
920-
defaultMode: 420
920+
defaultMode: 384
921921
items:
922922
- key: ssh-privatekey
923923
path: ssh_key_edpm-compute-global
@@ -1056,7 +1056,7 @@ spec:
10561056
secretName: combined-ca-bundle
10571057
- name: ssh-key-edpm-compute-global
10581058
secret:
1059-
defaultMode: 420
1059+
defaultMode: 384
10601060
items:
10611061
- key: ssh-privatekey
10621062
path: ssh_key_edpm-compute-global
@@ -1165,7 +1165,7 @@ spec:
11651165
secretName: combined-ca-bundle
11661166
- name: ssh-key-edpm-compute-global
11671167
secret:
1168-
defaultMode: 420
1168+
defaultMode: 384
11691169
items:
11701170
- key: ssh-privatekey
11711171
path: ssh_key_edpm-compute-global
@@ -1274,7 +1274,7 @@ spec:
12741274
secretName: combined-ca-bundle
12751275
- name: ssh-key-edpm-compute-global
12761276
secret:
1277-
defaultMode: 420
1277+
defaultMode: 384
12781278
items:
12791279
- key: ssh-privatekey
12801280
path: ssh_key_edpm-compute-global
@@ -1383,7 +1383,7 @@ spec:
13831383
secretName: combined-ca-bundle
13841384
- name: ssh-key-edpm-compute-global
13851385
secret:
1386-
defaultMode: 420
1386+
defaultMode: 384
13871387
items:
13881388
- key: ssh-privatekey
13891389
path: ssh_key_edpm-compute-global
@@ -1492,7 +1492,7 @@ spec:
14921492
secretName: combined-ca-bundle
14931493
- name: ssh-key-edpm-compute-global
14941494
secret:
1495-
defaultMode: 420
1495+
defaultMode: 384
14961496
items:
14971497
- key: ssh-privatekey
14981498
path: ssh_key_edpm-compute-global
@@ -1631,7 +1631,7 @@ spec:
16311631
secretName: combined-ca-bundle
16321632
- name: ssh-key-edpm-compute-global
16331633
secret:
1634-
defaultMode: 420
1634+
defaultMode: 384
16351635
items:
16361636
- key: ssh-privatekey
16371637
path: ssh_key_edpm-compute-global

‎test/kuttl/tests/dataplane-deploy-global-service-test/02-assert.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -151,7 +151,7 @@ spec:
151151
volumes:
152152
- name: ssh-key-edpm-compute-beta-nodeset
153153
secret:
154-
defaultMode: 420
154+
defaultMode: 384
155155
items:
156156
- key: ssh-privatekey
157157
path: ssh_key_edpm-compute-beta-nodeset
@@ -254,7 +254,7 @@ spec:
254254
secretName: combined-ca-bundle
255255
- name: ssh-key-edpm-compute-beta-nodeset
256256
secret:
257-
defaultMode: 420
257+
defaultMode: 384
258258
items:
259259
- key: ssh-privatekey
260260
path: ssh_key_edpm-compute-beta-nodeset

‎test/kuttl/tests/dataplane-deploy-multiple-secrets/02-assert.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -212,7 +212,7 @@ spec:
212212
secretName: combined-ca-bundle
213213
- name: ssh-key-openstack-edpm-tls
214214
secret:
215-
defaultMode: 420
215+
defaultMode: 384
216216
items:
217217
- key: ssh-privatekey
218218
path: ssh_key_openstack-edpm-tls
@@ -319,7 +319,7 @@ spec:
319319
secretName: combined-ca-bundle
320320
- name: ssh-key-openstack-edpm-tls
321321
secret:
322-
defaultMode: 420
322+
defaultMode: 384
323323
items:
324324
- key: ssh-privatekey
325325
path: ssh_key_openstack-edpm-tls

‎test/kuttl/tests/dataplane-deploy-no-nodes-test/01-assert.yaml‎

Lines changed: 13 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -147,7 +147,7 @@ spec:
147147
volumes:
148148
- name: ssh-key-edpm-compute-no-nodes
149149
secret:
150-
defaultMode: 420
150+
defaultMode: 384
151151
items:
152152
- key: ssh-privatekey
153153
path: ssh_key_edpm-compute-no-nodes
@@ -252,7 +252,7 @@ spec:
252252
secretName: combined-ca-bundle
253253
- name: ssh-key-edpm-compute-no-nodes
254254
secret:
255-
defaultMode: 420
255+
defaultMode: 384
256256
items:
257257
- key: ssh-privatekey
258258
path: ssh_key_edpm-compute-no-nodes
@@ -352,7 +352,7 @@ spec:
352352
volumes:
353353
- name: ssh-key-edpm-compute-no-nodes
354354
secret:
355-
defaultMode: 420
355+
defaultMode: 384
356356
items:
357357
- key: ssh-privatekey
358358
path: ssh_key_edpm-compute-no-nodes
@@ -452,7 +452,7 @@ spec:
452452
volumes:
453453
- name: ssh-key-edpm-compute-no-nodes
454454
secret:
455-
defaultMode: 420
455+
defaultMode: 384
456456
items:
457457
- key: ssh-privatekey
458458
path: ssh_key_edpm-compute-no-nodes
@@ -552,7 +552,7 @@ spec:
552552
volumes:
553553
- name: ssh-key-edpm-compute-no-nodes
554554
secret:
555-
defaultMode: 420
555+
defaultMode: 384
556556
items:
557557
- key: ssh-privatekey
558558
path: ssh_key_edpm-compute-no-nodes
@@ -700,7 +700,7 @@ spec:
700700
secretName: combined-ca-bundle
701701
- name: ssh-key-edpm-compute-no-nodes
702702
secret:
703-
defaultMode: 420
703+
defaultMode: 384
704704
items:
705705
- key: ssh-privatekey
706706
path: ssh_key_edpm-compute-no-nodes
@@ -810,7 +810,7 @@ spec:
810810
secretName: combined-ca-bundle
811811
- name: ssh-key-edpm-compute-no-nodes
812812
secret:
813-
defaultMode: 420
813+
defaultMode: 384
814814
items:
815815
- key: ssh-privatekey
816816
path: ssh_key_edpm-compute-no-nodes
@@ -950,7 +950,7 @@ spec:
950950
secretName: combined-ca-bundle
951951
- name: ssh-key-edpm-compute-no-nodes
952952
secret:
953-
defaultMode: 420
953+
defaultMode: 384
954954
items:
955955
- key: ssh-privatekey
956956
path: ssh_key_edpm-compute-no-nodes
@@ -1060,7 +1060,7 @@ spec:
10601060
secretName: combined-ca-bundle
10611061
- name: ssh-key-edpm-compute-no-nodes
10621062
secret:
1063-
defaultMode: 420
1063+
defaultMode: 384
10641064
items:
10651065
- key: ssh-privatekey
10661066
path: ssh_key_edpm-compute-no-nodes
@@ -1170,7 +1170,7 @@ spec:
11701170
secretName: combined-ca-bundle
11711171
- name: ssh-key-edpm-compute-no-nodes
11721172
secret:
1173-
defaultMode: 420
1173+
defaultMode: 384
11741174
items:
11751175
- key: ssh-privatekey
11761176
path: ssh_key_edpm-compute-no-nodes
@@ -1280,7 +1280,7 @@ spec:
12801280
secretName: combined-ca-bundle
12811281
- name: ssh-key-edpm-compute-no-nodes
12821282
secret:
1283-
defaultMode: 420
1283+
defaultMode: 384
12841284
items:
12851285
- key: ssh-privatekey
12861286
path: ssh_key_edpm-compute-no-nodes
@@ -1390,7 +1390,7 @@ spec:
13901390
secretName: combined-ca-bundle
13911391
- name: ssh-key-edpm-compute-no-nodes
13921392
secret:
1393-
defaultMode: 420
1393+
defaultMode: 384
13941394
items:
13951395
- key: ssh-privatekey
13961396
path: ssh_key_edpm-compute-no-nodes
@@ -1530,7 +1530,7 @@ spec:
15301530
secretName: combined-ca-bundle
15311531
- name: ssh-key-edpm-compute-no-nodes
15321532
secret:
1533-
defaultMode: 420
1533+
defaultMode: 384
15341534
items:
15351535
- key: ssh-privatekey
15361536
path: ssh_key_edpm-compute-no-nodes

‎test/kuttl/tests/dataplane-deploy-no-nodes-test/02-assert.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -90,7 +90,7 @@ spec:
9090
volumes:
9191
- name: ssh-key-edpm-compute-no-nodes
9292
secret:
93-
defaultMode: 420
93+
defaultMode: 384
9494
items:
9595
- key: ssh-privatekey
9696
path: ssh_key_edpm-compute-no-nodes

‎test/kuttl/tests/dataplane-deploy-no-nodes-test/04-assert.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -165,7 +165,7 @@ spec:
165165
secretName: combined-ca-bundle
166166
- name: ssh-key-edpm-compute-no-nodes
167167
secret:
168-
defaultMode: 420
168+
defaultMode: 384
169169
items:
170170
- key: ssh-privatekey
171171
path: ssh_key_edpm-compute-no-nodes

‎test/kuttl/tests/dataplane-deploy-no-nodes-test/06-assert.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -157,7 +157,7 @@ spec:
157157
secretName: combined-ca-bundle
158158
- name: ssh-key-edpm-compute-beta-nodeset
159159
secret:
160-
defaultMode: 420
160+
defaultMode: 384
161161
items:
162162
- key: ssh-privatekey
163163
path: ssh_key_edpm-compute-beta-nodeset
@@ -258,7 +258,7 @@ spec:
258258
volumes:
259259
- name: ssh-key-edpm-compute-beta-nodeset
260260
secret:
261-
defaultMode: 420
261+
defaultMode: 384
262262
items:
263263
- key: ssh-privatekey
264264
path: ssh_key_edpm-compute-beta-nodeset

‎test/kuttl/tests/dataplane-deploy-no-nodes-test/07-assert.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -85,7 +85,7 @@ spec:
8585
volumes:
8686
- name: ssh-key-edpm-compute-no-nodes
8787
secret:
88-
defaultMode: 420
88+
defaultMode: 384
8989
items:
9090
- key: ssh-privatekey
9191
path: ssh_key_edpm-compute-no-nodes

‎test/kuttl/tests/dataplane-deploy-tls-test/02-assert.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -249,7 +249,7 @@ spec:
249249
secretName: combined-ca-bundle
250250
- name: ssh-key-openstack-edpm-tls
251251
secret:
252-
defaultMode: 420
252+
defaultMode: 384
253253
items:
254254
- key: ssh-privatekey
255255
path: ssh_key_openstack-edpm-tls
@@ -361,7 +361,7 @@ spec:
361361
secretName: combined-ca-bundle
362362
- name: ssh-key-openstack-edpm-tls
363363
secret:
364-
defaultMode: 420
364+
defaultMode: 384
365365
items:
366366
- key: ssh-privatekey
367367
path: ssh_key_openstack-edpm-tls

0 commit comments

Comments
 (0)