FF_DISABLE_UMASK_FOR_KUBERNETES_EXECUTOR doesn't disable the umask
Summary
The documentation describes three functions enabled by this flag:
-
removes the umask 0000 call for jobs executed with the Kubernetes executor => not working at all
-
tries to discover the user ID (UID) and group ID (GID) of the user the build container runs as => working fine
-
changes the ownership of the working directory and files => only working when I set
shell = "bash"
in the runners config.toml
Steps to reproduce
For 1:
The test which is shown in the MR which introduced the flag does already show the problem: !4842 (merged)
The extract of the job log shows all folders world writable. Same with the last reply at the end: !4842 (comment 2020544743)
In this job logs all files are world writable again
For 3:
config.toml
which does not chown any file:
[[runners]]
pre_get_sources_script = "git config --system --add safe.directory $CI_PROJECT_DIR"
post_get_sources_script = "git config --local --add safe.directory $CI_PROJECT_DIR"
executor = "kubernetes"
[runners.feature_flags]
FF_DISABLE_UMASK_FOR_KUBERNETES_EXECUTOR = true
[runners.kubernetes]
namespace = "{{.Release.Namespace}}"
image = "ubuntu:16.04"
config.toml
which works fine for number 3:
[[runners]]
pre_get_sources_script = "git config --system --add safe.directory $CI_PROJECT_DIR"
post_get_sources_script = "git config --local --add safe.directory $CI_PROJECT_DIR"
executor = "kubernetes"
shell = "bash"
[runners.feature_flags]
FF_DISABLE_UMASK_FOR_KUBERNETES_EXECUTOR = true
[runners.kubernetes]
namespace = "{{.Release.Namespace}}"
image = "ubuntu:16.04"
.gitlab-ci.yml
stages:
- test
test:
stage: test
script:
- ls -lR /builds
- |
for i in $(seq 1 120); do
printf .
sleep 0.02
done
Actual behavior
- If I don't manually remove the
umask 0000
from the helper image, all files and folders are shown with world writable permissions - If I manually remove the
umask 0000
from the helper image and dont explicitly set
shell = "bash"`, the build fails with the following error message:
/scripts-2-27681/step_script: line 68: /builds/******/******.tmp/CI_SERVER_TLS_CA_FILE: Permission denied
- If I manually remove the
umask 0000
from the helper image and do explicitly setshell = "bash"
, I see the files non world-writable and owned by uid1000
Expected behavior
- Files should be owned by uid
1000
and non world-writable with the default helper image
Environment description
We are using self hosted gitlab-runner running on kubernetes