-
Type:
New Feature
-
Resolution: Duplicate
-
Priority:
Minor
-
Component/s: kubernetes-plugin
Add new Feature Secret files permissions.
We need to modify the permissions of the file with the functionality of kubernetes
Â
Doc in K8s (Secret files permission):Â
https://kubernetes.io/docs/concepts/configuration/secret/
Â
Example pipeline (default mode set permission to 400):
Â
podTemplate(label: 'pod-jenkins-agent-ansible', containers: [ containerTemplate(name: 'ansible', image: 'sockmal/ansible:2.4.3.0', ttyEnabled: true, command: 'cat', envVars: [containerEnvVar(key: 'ANSIBLE_HOST_KEY_CHECKING', value: 'False')])], volumes: [secretVolume(secretName: 'ansible-private-key', mountPath: '/root/.ssh', defaultMode: '256') ])
Error output in ansible jenkins agent (Permissions 0644 for '/root/.ssh/id_rsa' are too open):
Â
[dev-back-java-murcia] Running shell script
+ ls -la /root/.ssh/
total 4
drwxrwxrwt 3 root root 100 Feb 20 09:11 .
dr-xr-x--- 1 root root 4096 Feb 20 09:11 ..
drwxr-xr-x 2 root root 60 Feb 20 09:11 ..2982_20_02_09_11_01.244648209
lrwxrwxrwx 1 root root 31 Feb 20 09:11 ..data -> ..2982_20_02_09_11_01.244648209
lrwxrwxrwx 1 root root 13 Feb 20 09:11 id_rsa -> ..data/id_rsa
[Pipeline] script
[Pipeline] {
[Pipeline] sh
[dev-back-java-murcia] Running shell script
+ ansible-playbook -i ansible-playbooks/hosts ansible-playbooks/playbook.yml
PLAY [test-campusapp] **********************************************************
TASK [Gathering Facts] *********************************************************
fatal: [test-campusapp.tk]: UNREACHABLE! => \r\n@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@\r\n@ WARNING: UNPROTECTED PRIVATE KEY FILE! @\r\n@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@\r\nPermissions 0644 for '/root/.ssh/id_rsa' are too open.\r\nIt is required that your private key files are NOT accessible by others.\r\nThis private key will be ignored.\r\nLoad key \"/root/.ssh/id_rsa\": bad permissions\r\nPermission denied (publickey,password).\r\n", "unreachable": true}
to retry, use: --limit @/home/jenkins/workspace/dev-back-java-murcia/ansible-playbooks/playbook.retry
PLAY RECAP *********************************************************************
test-campusapp.tk : ok=0 changed=0 unreachable=1 failed=0
Â
- duplicates
-
JENKINS-42851 secretVolume not created read only
-
- Resolved
-