Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update permissions for kubectl.config.yaml #710

Conversation

Chemaclass
Copy link
Contributor

@Chemaclass Chemaclass commented May 18, 2022

Description

After upgrading to helm 3, I faced this issue and I found a potential solution for this too: helm/helm#9115

WARNING: Kubernetes configuration file is group/world-readable 

@andytson
Copy link

andytson commented May 18, 2022

the reason we never saw this is because we started using ArgoCD (which we use helm template render) before the switch to helm v3, so this code was never later used with helm v3 except I think just by your project.

Co-authored-by: Andy Thompson <me@andytson.com>
Co-authored-by: Andy Thompson <me@andytson.com>
@@ -87,7 +87,7 @@ command('app deploy <environment>'):
#!bash(harness:/helm)|=
set -o pipefail
cd "${ENVIRONMENT}"
doctl -t "$DO_ACCESS_TOKEN" kubernetes cluster kubeconfig show "$CLUSTER" > kubectl.config.yaml
(umask 0077 && doctl -t "$DO_ACCESS_TOKEN" kubernetes cluster kubeconfig show "$CLUSTER" > kubectl.config.yaml)
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

For the record: umask removes the bits that are allowed on a file on creation, so e.g. 0007 means if a file created with 666 permissions then it gets 660 permissions. You can see it easily with (umask 0077 && touch testfile) that it gets 600 permissions.

@andytson-inviqa andytson-inviqa merged commit a7ec26b into inviqa:1.4.x May 19, 2022
@Chemaclass Chemaclass deleted the feature/restrict-permissions-kubectl.config.yaml branch May 19, 2022 08:42
@andytson-inviqa andytson-inviqa added enhancement New feature or request harness-all Changes required to all harness directories labels May 19, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request harness-all Changes required to all harness directories
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants