8000 [bitnami/elasticsearch] crash when running as root when TLS certificates are read-only · Issue #77525 · bitnami/containers · GitHub
[go: up one dir, main page]
More Web Proxy on the site http://driver.im/
Skip to content

[bitnami/elasticsearch] crash when running as root when TLS certificates are read-only #77525

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
ianroberts opened this issue Feb 17, 2025 · 10 comments · May be fixed by #77526
Open

[bitnami/elasticsearch] crash when running as root when TLS certificates are read-only #77525

ianroberts opened this issue Feb 17, 2025 · 10 comments · May be fixed by #77526
Assignees
@carrodher
Labels
elasticsearch tech-issues The user has a technical issue about an application triage Triage is needed

Comments

@ianroberts
Copy link

Name and Version

bitnami/elasticsearch:8.17.2-debian-12-r0

What architecture are you using?

amd64

What steps will reproduce the bug?

Run the container as root with a read-only volume mounted to /opt/bitnami/elasticsearch/config/certs.

(This bug was originally reported as bitnami/charts#25280 against the bitnami/elasticsearch Helm chart, which at the time mounted a Kubernetes secret at this path containing the TLS certificate and key files for Elasticsearch)

What is the expected behavior?

Container should start up correctly.

What do you see instead?

Container fails to start, with the error in this section of libelasticsearch.sh:

containers/bitnami/elasticsearch/8/debian-12/rootfs/opt/bitnami/scripts/libelasticsearch.sh

Lines 380 to 383 in 1e1e736

for dir in "$DB_TMP_DIR" "$DB_LOGS_DIR" "$DB_PLUGINS_DIR" "$DB_BASE_DIR/modules" "$DB_CONF_DIR"; do
ensure_dir_exists "$dir"
am_i_root && chown -R "$DB_DAEMON_USER:$DB_DAEMON_GROUP" "$dir"
done

When running as root the container attempts to chown all files under $DB_CONF_DIR (which is /opt/bitnami/elasticsearch/config), but this is not possible when the certs subdirectory is a read-only filesystem.

elasticsearch 14:33:47.48 INFO  ==> ** Starting Elasticsearch setup **
2024-04-19T22:33:47.494601985+08:00 elasticsearch 14:33:47.49 DEBUG ==> Ensuring expected directories/files exist...
chown: changing ownership of '/opt/bitnami/elasticsearch/config/certs/ca.crt': Read-only file system
2024-04-19T22:33:48.961388677+08:00 chown: changing ownership of '/opt/bitnami/elasticsearch/config/certs/tls.key': Read-only file system
2024-04-19T22:33:48.961391451+08:00 chown: changing ownership of '/opt/bitnami/elasticsearch/config/certs/tls.crt': Read-only file system
2024-04-19T22:33:48.961393308+08:00 chown: changing ownership of '/opt/bitnami/elasticsearch/config/certs/..data': Read-only file system
2024-04-19T22:33:48.961395937+08:00 chown: changing ownership of '/opt/bitnami/elasticsearch/config/certs/..2024_04_19_14_33_30.4069200578/tls.key': Read-only file system
2024-04-19T22:33:48.961398958+08:00 chown: changing ownership of '/opt/bitnami/elasticsearch/config/certs/..2024_04_19_14_33_30.4069200578/tls.crt': Read-only file system
2024-04-19T22:33:48.961401321+08:00 chown: changing ownership of '/opt/bitnami/elasticsearch/config/certs/..2024_04_19_14_33_30.4069200578/ca.crt': Read-only file system
2024-04-19T22:33:48.961404189+08:00 chown: changing ownership of '/opt/bitnami/elasticsearch/config/certs/..2024_04_19_14_33_30.4069200578': Read-only file system
2024-04-19T22:33:48.961411662+08:00 chown: changing ownership of '/opt/bitnami/elasticsearch/config/certs': Read-only file system

Additional information

A PR was accepted in the charts repository to "fix" the problem by copying the TLS certificates to a writeable volume instead of directly mounting the read-only one, but this has other undesirable effects where renewed certificates are no longer picked up and reloaded automatically. It would be better to back out that change to the chart and instead fix the problem at source in the container image.

The simplest fix would be to add -f to the chown command to ignore files whose ownership cannot be changed. An alternative could be to change the location of the certificate files so they do not fall under a directory that will be chown-ed, but that may have further reaching knock-on effects on things like custom init scripts that assume the current file locations.
@ianroberts ianroberts added the tech-issues The user has a technical issue about an application label Feb 17, 2025
@github-actions github-actions bot added the triage Triage is needed label Feb 17, 2025
ianroberts added a commit to ianroberts/bitnami-charts that referenced this issue Feb 17, 2025
@ianroberts
[bitnami/elasticsearch] remove copyTlsCerts init container
b6b942c 
Remove the initContainer that copies TLS certificates from the secret to the emptyDir volume and revert to mounting the secret directly into the various statefulset pods.  This fixes bitnami#31872, but will break bitnami#25280 until bitnami/containers#77525 is fixed

Signed-off-by: Ian Roberts <i.roberts@sheffield.ac.uk>
This was referenced Feb 17, 2025
Open
Open
@carrodher
Copy link
Member

Thank you for opening this issue and submitting the associated Pull Request. Our team will review and provide feedback. Once the PR is merged, the issue will automatically close.

Your contribution is greatly appreciated!

@github-actions GitHub Actions
Copy link
github-actions bot commented Mar 6, 2025

This Issue has been automatically marked as "stale" because it has not had recent activity (for 15 days). It will be closed if no further activity occurs. Thanks for the feedback.

@github-actions github-actions bot added the stale 15 days without activity label Mar 6, 2025
@github-actions GitHub Actions
Copy link

Due to the lack of activity in the last 5 days since it was marked as "stale", we proceed to close this Issue. Do not hesitate to reopen it later if necessary.

@bitnami-bot bitnami-bot closed this as not planned Won't fix, can't repro, duplicate, stale Mar 12, 2025
@ianroberts
Copy link
Author

Still relevant - associated PR is awaiting final review from @migruiz4

@migruiz4 migruiz4 reopened this Mar 12, 2025
@github-actions github-actions bot removed solved stale 15 days without activity labels Mar 12, 2025
ianroberts added a commit to ianroberts/bitnami-charts that referenced this issue Mar 26, 2025
@ianroberts
[bitnami/elasticsearch] remove copyTlsCerts init container
b60c2db 
Remove the initContainer that copies TLS certificates from the secret to the emptyDir volume and revert to mounting the secret directly into the various statefulset pods.  This fixes bitnami#31872, but will break bitnami#25280 until bitnami/containers#77525 is fixed

Signed-off-by: Ian Roberts <i.roberts@sheffield.ac.uk>
ianroberts added a commit to ianroberts/bitnami-charts that referenced this issue Mar 26, 2025
@ianroberts
[bitnami/elasticsearch] remove copyTlsCerts init container
1b751ea 
Remove the initContainer that copies TLS certificates from the secret to the emptyDir volume and revert to mounting the secret directly into the various statefulset pods.  This fixes bitnami#31872, but will break bitnami#25280 until bitnami/containers#77525 is fixed

Signed-off-by: Ian Roberts <i.roberts@sheffield.ac.uk>
@github-actions GitHub Actions
Copy link

This Issue has been automatically marked as "stale" because it has not had recent activity (for 15 days). It will be closed if no further activity occurs. Thanks for the feedback.

@github-actions github-actions bot added the stale 15 days without activity label Mar 28, 2025
@ianroberts
Copy link
Author

Fix is ready, still waiting for final review and merge.

@github-actions github-actions bot removed the stale 15 days without activity label Mar 29, 2025
@github-actions GitHub Actions
Copy link

This Issue has been automatically marked as "stale" because it has not had recent activity (for 15 days). It will be closed if no further activity occurs. Thanks for the feedback.

@github-actions github-actions bot added the stale 15 days without activity label Apr 13, 2025
@ianroberts
Copy link
Author

Not stale, #77526 still awaiting approval.

@carrodher carrodher removed the stale 15 days without activity label Apr 13, 2025
@github-actions GitHub Actions
Copy link

This Issue has been automatically marked as "stale" because it has not had recent activity (for 15 days). It will be closed if no further activity occurs. Thanks for the feedback.

@github-actions github-actions bot added the stale 15 days without activity label Apr 29, 2025
@ianroberts
Copy link
Author

Not stale - I made the requested changes to my fix in PR #77526 seven weeks ago (11th March) but they are still awaiting final review and merge.

@github-actions github-actions bot removed the stale 15 days without activity label Apr 30, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@carrodher carrodher

Labels
elasticsearch tech-issues The user has a technical issue about an application triage Triage is needed
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

[bitnami/elasticsearch] do not fail if asked to chown read-only files ianroberts/bitnami-containers
4 participants
@ianroberts @bitnami-bot @carrodher @migruiz4
0