Skip to content

Commit 9c5ddd2

Browse files
piyush-gargtekton-robot
piyush-garg
authored and
tekton-robot
committed
Remove result initcontainer
This will remove the initcontainer which is added for making the results folder writables If it is rn as non-root then this init-containers errors out on every run as the chmod command is not allowed to execute Further there is no need to make the empty-dir volume writable Currently tektoncd/pipeline fails on environment where pod is run as non-root This will fix that Fix #2172
1 parent c7407e6 commit 9c5ddd2

File tree

7 files changed

+12
-78
lines changed

7 files changed

+12
-78
lines changed

‎docs/developers/README.md‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -283,7 +283,6 @@ Instead of hardcoding the path to the result file, the user can also use a varia
283283

284284
### Known issues
285285

286-
- When using a podTemplate to specify a non-root user for all containers, a task will not be able to modify the contents of the results directory and may fail.
287286
- Task Results are returned to the TaskRun controller via the container's
288287
termination log. At time of writing this has a capped maximum size of ["2048 bytes or 80 lines, whichever is smaller"](https://kubernetes.io/docs/tasks/debug-application-cluster/determine-reason-pod-failure/#customizing-the-termination-message).
289288

‎pkg/pod/pod.go‎

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -103,11 +103,6 @@ func MakePod(images pipeline.Images, taskRun *v1alpha1.TaskRun, taskSpec v1alpha
103103
volumes = append(volumes, secretsVolumes...)
104104
}
105105

106-
// make tekton results folder writable by any user
107-
if makeTektonFolderWritableInit := makeTektonResultsFolderWritable(images.ShellImage, implicitVolumeMounts); makeTektonFolderWritableInit != nil {
108-
initContainers = append(initContainers, *makeTektonFolderWritableInit)
109-
}
110-
111106
// Merge step template with steps.
112107
// TODO(#1605): Move MergeSteps to pkg/pod
113108
steps, err := v1alpha1.MergeStepsWithStepTemplate(taskSpec.StepTemplate, taskSpec.Steps)

‎pkg/pod/pod_test.go‎

Lines changed: 8 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -65,14 +65,6 @@ func TestMakePod(t *testing.T) {
6565
VolumeMounts: []corev1.VolumeMount{toolsMount},
6666
}
6767

68-
resultsInit := corev1.Container{
69-
Name: "tekton-results-folder-writable",
70-
Image: images.ShellImage,
71-
Command: []string{"sh"},
72-
Args: []string{"-c", "chmod 777 /tekton/results"},
73-
VolumeMounts: implicitVolumeMounts,
74-
}
75-
7668
runtimeClassName := "gvisor"
7769
automountServiceAccountToken := false
7870
dnsPolicy := corev1.DNSNone
@@ -96,7 +88,7 @@ func TestMakePod(t *testing.T) {
9688
}},
9789
want: &corev1.PodSpec{
9890
RestartPolicy: corev1.RestartPolicyNever,
99-
InitContainers: []corev1.Container{resultsInit, placeToolsInit},
91+
InitContainers: []corev1.Container{placeToolsInit},
10092
Containers: []corev1.Container{{
10193
Name: "step-name",
10294
Image: "image",
@@ -149,7 +141,6 @@ func TestMakePod(t *testing.T) {
149141
VolumeMounts: append(implicitVolumeMounts, secretsVolumeMount),
150142
Env: implicitEnvVars,
151143
},
152-
resultsInit,
153144
placeToolsInit,
154145
},
155146
Containers: []corev1.Container{{
@@ -205,7 +196,7 @@ func TestMakePod(t *testing.T) {
205196
},
206197
want: &corev1.PodSpec{
207198
RestartPolicy: corev1.RestartPolicyNever,
208-
InitContainers: []corev1.Container{resultsInit, placeToolsInit},
199+
InitContainers: []corev1.Container{placeToolsInit},
209200
Containers: []corev1.Container{{
210201
Name: "step-name",
211202
Image: "image",
@@ -255,7 +246,7 @@ func TestMakePod(t *testing.T) {
255246
}},
256247
want: &corev1.PodSpec{
257248
RestartPolicy: corev1.RestartPolicyNever,
258-
InitContainers: []corev1.Container{resultsInit, placeToolsInit},
249+
InitContainers: []corev1.Container{placeToolsInit},
259250
Containers: []corev1.Container{{
260251
Name: "step-a-very-very-long-character-step-name-to-trigger-max-len", // step name trimmed.
261252
Image: "image",
@@ -291,7 +282,7 @@ func TestMakePod(t *testing.T) {
291282
}},
292283
want: &corev1.PodSpec{
293284
RestartPolicy: corev1.RestartPolicyNever,
294-
InitContainers: []corev1.Container{resultsInit, placeToolsInit},
285+
InitContainers: []corev1.Container{placeToolsInit},
295286
Containers: []corev1.Container{{
296287
Name: "step-ends-with-invalid", // invalid suffix removed.
297288
Image: "image",
@@ -329,7 +320,6 @@ func TestMakePod(t *testing.T) {
329320
want: &corev1.PodSpec{
330321
RestartPolicy: corev1.RestartPolicyNever,
331322
InitContainers: []corev1.Container{
332-
resultsInit,
333323
{
334324
Name: "working-dir-initializer",
335325
Image: images.ShellImage,
@@ -382,7 +372,7 @@ func TestMakePod(t *testing.T) {
382372
wantAnnotations: map[string]string{},
383373
want: &corev1.PodSpec{
384374
RestartPolicy: corev1.RestartPolicyNever,
385-
InitContainers: []corev1.Container{resultsInit, placeToolsInit},
375+
InitContainers: []corev1.Container{placeToolsInit},
386376
Containers: []corev1.Container{{
387377
Name: "step-primary-name",
388378
Image: "primary-image",
@@ -433,7 +423,6 @@ func TestMakePod(t *testing.T) {
433423
want: &corev1.PodSpec{
434424
RestartPolicy: corev1.RestartPolicyNever,
435425
InitContainers: []corev1.Container{
436-
resultsInit,
437426
{
438427
Name: "place-scripts",
439428
Image: "busybox",
@@ -507,7 +496,7 @@ sidecar-script-heredoc-randomly-generated-mz4c7
507496
}},
508497
want: &corev1.PodSpec{
509498
RestartPolicy: corev1.RestartPolicyNever,
510-
InitContainers: []corev1.Container{resultsInit, placeToolsInit},
499+
InitContainers: []corev1.Container{placeToolsInit},
511500
Containers: []corev1.Container{{
512501
Name: "step-unnamed-0",
513502
Image: "image",
@@ -596,7 +585,7 @@ print("Hello from Python")`,
596585
want: &corev1.PodSpec{
597586
RestartPolicy: corev1.RestartPolicyNever,
598587
InitContainers: []corev1.Container{
599-
resultsInit, {
588+
{
600589
Name: "place-scripts",
601590
Image: images.ShellImage,
602591
Command: []string{"sh"},
@@ -715,7 +704,7 @@ script-heredoc-randomly-generated-78c5n
715704
},
716705
want: &corev1.PodSpec{
717706
RestartPolicy: corev1.RestartPolicyNever,
718-
InitContainers: []corev1.Container{resultsInit, placeToolsInit},
707+
InitContainers: []corev1.Container{placeToolsInit},
719708
SchedulerName: "there-scheduler",
720709
Volumes: append(implicitVolumes, toolsVolume, downwardVolume),
721710
Containers: []corev1.Container{{

‎pkg/pod/tekton_folder_writable.go‎

Lines changed: 0 additions & 32 deletions
This file was deleted.

‎pkg/reconciler/taskrun/taskrun_test.go‎

Lines changed: 0 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -243,18 +243,6 @@ var (
243243
actualOps = append(actualOps, ops...)
244244
return tb.PodInitContainer("place-tools", "override-with-entrypoint:latest", actualOps...)
245245
}
246-
247-
getResultsInitContainer = func(ops ...tb.ContainerOp) tb.PodSpecOp {
248-
actualOps := []tb.ContainerOp{
249-
tb.Command("sh"),
250-
tb.VolumeMount("tekton-internal-workspace", "/workspace"),
251-
tb.VolumeMount("tekton-internal-home", "/tekton/home"),
252-
tb.VolumeMount("tekton-internal-results", "/tekton/results"),
253-
tb.Args("-c", "chmod 777 /tekton/results"),
254-
}
255-
actualOps = append(actualOps, ops...)
256-
return tb.PodInitContainer("tekton-results-folder-writable", "busybox", actualOps...)
257-
}
258246
)
259247

260248
func getRunName(tr *v1alpha1.TaskRun) string {
@@ -319,7 +307,6 @@ func TestReconcile_ExplicitDefaultSA(t *testing.T) {
319307
tb.PodServiceAccountName(defaultSAName),
320308
tb.PodVolumes(workspaceVolume, homeVolume, resultsVolume, toolsVolume, downwardVolume),
321309
tb.PodRestartPolicy(corev1.RestartPolicyNever),
322-
getResultsInitContainer(),
323310
getPlaceToolsInitContainer(),
324311
tb.PodContainer("step-simple-step", "foo",
325312
tb.Command(entrypointLocation),
@@ -359,7 +346,6 @@ func TestReconcile_ExplicitDefaultSA(t *testing.T) {
359346
tb.PodServiceAccountName("test-sa"),
360347
tb.PodVolumes(workspaceVolume, homeVolume, resultsVolume, toolsVolume, downwardVolume),
361348
tb.PodRestartPolicy(corev1.RestartPolicyNever),
362-
getResultsInitContainer(),
363349
getPlaceToolsInitContainer(),
364350
tb.PodContainer("step-sa-step", "foo",
365351
tb.Command(entrypointLocation),
@@ -582,7 +568,6 @@ func TestReconcile(t *testing.T) {
582568
tb.PodSpec(
583569
tb.PodVolumes(workspaceVolume, homeVolume, resultsVolume, toolsVolume, downwardVolume),
584570
tb.PodRestartPolicy(corev1.RestartPolicyNever),
585-
getResultsInitContainer(),
586571
getPlaceToolsInitContainer(),
587572
tb.PodContainer("step-simple-step", "foo",
588573
tb.Command(entrypointLocation),
@@ -622,7 +607,6 @@ func TestReconcile(t *testing.T) {
622607
tb.PodServiceAccountName("test-sa"),
623608
tb.PodVolumes(workspaceVolume, homeVolume, resultsVolume, toolsVolume, downwardVolume),
624609
tb.PodRestartPolicy(corev1.RestartPolicyNever),
625-
getResultsInitContainer(),
626610
getPlaceToolsInitContainer(),
627611
tb.PodContainer("step-sa-step", "foo",
628612
tb.Command(entrypointLocation),
@@ -673,7 +657,6 @@ func TestReconcile(t *testing.T) {
673657
},
674658
),
675659
tb.PodRestartPolicy(corev1.RestartPolicyNever),
676-
getResultsInitContainer(),
677660
getPlaceToolsInitContainer(),
678661
getMkdirResourceContainer("myimage", "/workspace/output/myimage", "mssqb"),
679662
tb.PodContainer("step-git-source-git-resource-mz4c7", "override-with-git:latest",
@@ -743,7 +726,6 @@ func TestReconcile(t *testing.T) {
743726
tb.PodSpec(
744727
tb.PodVolumes(workspaceVolume, homeVolume, resultsVolume, toolsVolume, downwardVolume),
745728
tb.PodRestartPolicy(corev1.RestartPolicyNever),
746-
getResultsInitContainer(),
747729
getPlaceToolsInitContainer(),
748730
tb.PodContainer("step-git-source-git-resource-9l9zj", "override-with-git:latest",
749731
tb.Command(entrypointLocation),
@@ -801,7 +783,6 @@ func TestReconcile(t *testing.T) {
801783
tb.PodSpec(
802784
tb.PodVolumes(workspaceVolume, homeVolume, resultsVolume, toolsVolume, downwardVolume),
803785
tb.PodRestartPolicy(corev1.RestartPolicyNever),
804-
getResultsInitContainer(),
805786
getPlaceToolsInitContainer(),
806787
tb.PodContainer("step-simple-step", "foo",
807788
tb.Command(entrypointLocation),
@@ -839,7 +820,6 @@ func TestReconcile(t *testing.T) {
839820
tb.PodSpec(
840821
tb.PodVolumes(workspaceVolume, homeVolume, resultsVolume, toolsVolume, downwardVolume),
841822
tb.PodRestartPolicy(corev1.RestartPolicyNever),
842-
getResultsInitContainer(),
843823
getPlaceToolsInitContainer(),
844824
tb.PodContainer("step-git-source-workspace-9l9zj", "override-with-git:latest",
845825
tb.Command(entrypointLocation),
@@ -896,7 +876,6 @@ func TestReconcile(t *testing.T) {
896876
tb.PodSpec(
897877
tb.PodVolumes(workspaceVolume, homeVolume, resultsVolume, toolsVolume, downwardVolume),
898878
tb.PodRestartPolicy(corev1.RestartPolicyNever),
899-
getResultsInitContainer(),
900879
getPlaceToolsInitContainer(),
901880
tb.PodContainer("step-simple-step", "foo",
902881
tb.Command(entrypointLocation),

‎third_party/github.com/hashicorp/errwrap/go.mod‎

Lines changed: 2 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎third_party/github.com/hashicorp/go-multierror/go.mod‎

Lines changed: 2 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)