awxfifo creation fails when write access to container is prohibited.
#14,052 opened on May 26, 2023
Repository metrics
- Stars
- (13,071 stars)
- PR merge metrics
- (Avg merge 24d 6h) (30 merged PRs in 30d)
Description
Please confirm the following
- I agree to follow this project's code of conduct.
- I have checked the current issues for duplicates.
- I understand that AWX is open source software provided for free and that I might not receive a timely response.
- I am NOT reporting a (potential) security vulnerability. (These should be emailed to
security@ansible.cominstead.)
Bug Summary
awxfifo file specified in uwsgi.ini might not be created in Kubernetes environment where writing to file system is forbidden/prohibited.
https://github.com/ansible/awx/blob/22.3.0/tools/ansible/roles/dockerfile/files/uwsgi.ini#L9
AWX version
22.3.0
Select the relevant components
- UI
- UI (tech preview)
- API
- Docs
- Collection
- CLI
- Other
Installation method
kubernetes
Modifications
no
Ansible version
No response
Operating system
No response
Web browser
No response
Steps to reproduce
- Apply security policy with "readOnlyRootFilesystem" context to Kubernetes cluster.
- Start AWX installation with AWX Operator.
Expected results
If the file was located in different directory or subdirectory of /var/lib/awx, then with help of awx-operator emptyDir can be mounted to such location. Thus allowing awxfifo file to be created.
---
spec:
...
extra_volumes:
- name: awx-fifo
emptyDir: {}
task_extra_volume_mounts: |
- name: awx-fifo
mountPath: /var/lib/awx/fifo
master-fifo = /var/lib/awx/fifo/awxfifo
Actual results
uwsgi will prevent startup of web container due to inability of writing to /var/lib/awx directory.
Additional information
No response