Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

execution of assets/custom-scripts throws "permission denied" #29

Open
financelurker opened this issue Oct 20, 2021 · 0 comments
Open

execution of assets/custom-scripts throws "permission denied" #29

financelurker opened this issue Oct 20, 2021 · 0 comments
Labels
bug Something isn't working

Comments

@financelurker
Copy link

financelurker commented Oct 20, 2021 •
edited
Loading

Summary

After setting up this container we were also spinning up a fusiondirectory container pointing to that openldap-fusiondirectory backend.
With the openldap-fusiondirectory container version 1.4-7.1.5 the custom init scripts are not executed.

Steps to reproduce

First spin up the openldap-fusiondirectory setup:

apiVersion: v1
kind: Secret
metadata:
  name:  openldap-passwords
  namespace: fusiondirectory
data:
   ADMIN_PASS:  <pw>
   CONFIG_PASS: <pw>
   FUSIONDIRECTORY_ADMIN_PASS: <pw>
type: Opaque
---
apiVersion: v1
kind: Secret
metadata:
  name:  openldap-readonly-password
  namespace: fusiondirectory
data:
   secretKey:  <ro-pw>
type: Opaque
---
apiVersion: v1
kind: Service
metadata:
  name: openldap-headless
  namespace: fusiondirectory
  labels:
    app: openldap
    ver: v1
spec:
  ports:
  - port: 389
    name: ldap  
  selector:
    app: openldap
    ver: v1
---
apiVersion: v1
kind: Service
metadata:
  name: openldap-writer
  namespace: fusiondirectory
  labels:
    app: openldap-writer
    ver: v1
spec:
  ports:
  - port: 389
    name: ldap
  selector:
    statefulset.kubernetes.io/pod-name: openldap-0
    ver: v1    
---
apiVersion: apps/v1
kind: StatefulSet
metadata:
  labels:
    app: openldap
    ver: v1
  name: openldap
  namespace: fusiondirectory
spec:
  replicas: 1
  serviceName: openldap-headless
  selector:
    matchLabels:
      app: openldap
      ver: v1
  volumeClaimTemplates:
  - metadata:
      name: openldap-data
    spec:
      accessModes: [ "ReadWriteOnce" ]
      storageClassName: "fusiondirectory-data-pv"
      resources:
        requests:
          storage: 1000Mi
  - metadata:
      name: openldap-config
    spec:
      accessModes: [ "ReadWriteOnce" ]
      storageClassName: "fusiondirectory-config-pv"
      resources:
        requests:
          storage: 500Mi
  template:
    metadata:
      labels:
        app: openldap
        ver: v1
    spec:
      containers:
      - image: tiredofit/openldap-fusiondirectory:1.4-7.1.5
        imagePullPolicy: IfNotPresent
        name: openldap
        volumeMounts:
        - mountPath: /var/lib/openldap
          name: openldap-data
        - mountPath: /etc/openldap/slapd.d
          name: openldap-config
        env:

        # Container ############################################
        - name: ENABLE_CRON
          value: "TRUE"
        - name: ENABLE_ZABBIX
          value: "FALSE"
        - name: CONTAINER_LOG_LEVEL
          value: "NOTICE"
        - name: DEBUG_MODE
          value: "FALSE"

        # Settings ###############################################
        - name: INTERNAL_HOSTNAME
          valueFrom:
            fieldRef:
              fieldPath: metadata.name
        - name: HOSTNAME
          #TODO Setting the fqdn automatically
          value: "$(INTERNAL_HOSTNAME).openldap-headless.fusiondirectory.svc.cluster.local"
        - name: BACKEND
          value: "mdb"
        - name: ULIMIT_N
          value: "21000"
        - name: LOG_LEVEL
          value: "256"
        - name: DOMAIN
          value: "example.com"
        - name: ADMIN_PASS
          valueFrom:
            secretKeyRef:
              name: openldap-passwords
              key: ADMIN_PASS
        - name: CONFIG_PASS
          valueFrom:
            secretKeyRef:
              name: openldap-passwords
              key: CONFIG_PASS
        - name: KEEP_EXISTING_CONFIG
          value: "FALSE"

        # FUSIONDIRECTORY ACCESS #################################
        - name: FUSIONDIRECTORY_ADMIN_USER
          value: "admin"
        - name: FUSIONDIRECTORY_ADMIN_PASS
          valueFrom:
            secretKeyRef:
              name: openldap-passwords
              key: FUSIONDIRECTORY_ADMIN_PASS
        - name: ORGANIZATION
          value: "organization"

        # LDAP Settings ##########################################
        - name: BASE_DN
          value: "dc=example,dc=com"
        - name: ENABLE_READONLY_USER
          value: "TRUE"
        - name: READONLY_USER_USER
          value: "reader"
        - name: READONLY_USER_PASS
          valueFrom:
            secretKeyRef:
              name: openldap-readonly-password
              key: secretKey

        # TLS ######################################################
        - name: ENABLE_TLS
          value: "FALSE"

        # REPLICATION ##############################################
        - name: ENABLE_REPLICATION
          value: "FALSE"

        # Replication without tls tls_reqcert=never
#        - name: REPLICATION_CONFIG_SYNCPROV
#          value: "binddn=\"cn=config\" bindmethod=simple credentials=$(CONFIG_PASS) searchbase=\"cn=config\" type=refreshAndPersist retry=\"5 5 60 +\" timeout=1 filter=\"(!(objectclass=olcGlobal))\" tls_reqcert=never"
#         # Replication without tls tls_reqcert=never
#        - name: REPLICATION_DB_SYNCPROV
#          value: "binddn=\"cn=admin,$(BASE_DN)\" bindmethod=simple credentials=$(ADMIN_PASS) searchbase=\"$(BASE_DN)\" type=refreshAndPersist interval=00:00:00:10 retry=\"60 +\" timeout=1 tls_reqcert=never"
#
#        #TODO  Scaling of the Statefulset won't work -> olcServerID in the config database has to be changed!
#        # Please use the correct fqdn 
#        - name: REPLICATION_HOSTS
#          value: "ldap://openldap-0.openldap-headless.fusiondirectory.svc.cluster.local ldap://openldap-1.openldap-headless.fusiondirectory.svc.cluster.local"

        - name: REMOVE_CONFIG_AFTER_SETUP
          value: "FALSE"

        # ZABBIX #################################################
        - name: ZABBIX_HOSTNAME
          value: "openldap-fusiondirectory-app"

        - name: REAPPLY_PLUGIN_SCHEMAS
          value: "TRUE"
        - name: PLUGIN_ARGONAUT
          value: "TRUE"
        - name: PLUGIN_MAIL
          value: "TRUE"
        - name: PLUGIN_ALIAS
          value: "TRUE"
        - name: PLUGIN_PERSONAL
          value: "TRUE"
        - name: PLUGIN_POSIX
          value: "TRUE"
        - name: PLUGIN_DNS
          value: "TRUE"
        - name: PLUGIN_SUDO
          value: "TRUE"
        - name: PLUGIN_SYSTEMS
          value: "TRUE"
        - name: PLUGIN_NEXTCLOUD
          value: "TRUE"
        - name: PLUGIN_POSTFIX
          value: "TRUE"
        - name: PLUGIN_DOVECOT
          value: "TRUE"
        - name: PLUGIN_DHCP
          value: "TRUE"
        - name: PLUGIN_FUSIONINVENTORY
          value: "TRUE"
        - name: PLUGIN_GPG
          value: "TRUE"
        - name: PLUGIN_REPOSITORY
          value: "TRUE"
        - name: PLUGIN_SPAMASSASSIN
          value: "TRUE"
        - name: PLUGIN_SSH
          value: "TRUE"
        - name: PLUGIN_USER_REMINDER
          value: "TRUE"

        ports:
        - containerPort: 389

      restartPolicy: Always

Then spin up the fusiondirectory UI:

apiVersion: v1
kind: Service
metadata:
  name: fusiondirectory
  namespace: fusiondirectory
  labels:
    app: fusiondirectory
    ver: v1
spec:
  type: NodePort
  ports:
  - port: 80
    targetPort: 80
    nodePort: 30067
    protocol: TCP
    name: http-fusiondirectory
  selector:
    app: fusiondirectory
    ver: v1
---
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: fusiondirectory
    ver: v1
  name: fusiondirectory
  namespace: fusiondirectory
spec:
  replicas: 1
  selector:
    matchLabels:
      app: fusiondirectory
      ver: v1
  strategy:
    rollingUpdate:
      maxSurge: 25%
      maxUnavailable: 25%
    type: RollingUpdate
  template:
    metadata:
      labels:
        app: fusiondirectory
        ver: v1
    spec:
      volumes:
      - name: apachelogs
        emptyDir: {}
      containers:
      - image: tiredofit/fusiondirectory:1.4-2.7.11
        imagePullPolicy: IfNotPresent
        name: fusiondirectory
        resources:
          limits:
            memory: 500Mi
            cpu: "0.5"
          requests:
            memory: 100Mi
            cpu: "0.1"
        volumeMounts:
        - mountPath: /www/logs
          name: apachelogs
        env:
          #- name: DEBUG_SMTP
          #value: TRUE
          #- name: DEBUG_MODE
          #value: TRUE

        - name: VIRTUAL_HOST
          value: "directory.example.com"
        - name: VIRTUAL_PORT
          value: "80"
        - name: ENABLE_ZABBIX
          value: "FALSE"

        - name: PLUGIN_ARGONAUT
          value: "TRUE"
        - name: PLUGIN_MAIL
          value: "TRUE"
        - name: PLUGIN_ALIAS
          value: "TRUE"
        - name: PLUGIN_PERSONAL
          value: "TRUE"
        - name: PLUGIN_POSIX
          value: "TRUE"
        - name: PLUGIN_DNS
          value: "TRUE"
        - name: PLUGIN_SUDO
          value: "TRUE"
        - name: PLUGIN_SYSTEMS
          value: "TRUE"
        - name: PLUGIN_NEXTCLOUD
          value: "TRUE"
        - name: PLUGIN_POSTFIX
          value: "TRUE"
        - name: PLUGIN_DOVECOT
          value: "TRUE"
        - name: PLUGIN_DHCP
          value: "TRUE"
        - name: PLUGIN_FUSIONINVENTORY
          value: "TRUE"
        - name: PLUGIN_GPG
          value: "TRUE"
        - name: PLUGIN_REPOSITORY
          value: "TRUE"
        - name: PLUGIN_SPAMASSASSIN
          value: "TRUE"
        - name: PLUGIN_SSH
          value: "TRUE"
        - name: PLUGIN_USER_REMINDER
          value: "TRUE"

        - name: PLUGIN_LDAPDUMP
          value: "TRUE"
        - name: PLUGIN_LDAPMANAGER
          value: "TRUE"
        - name: PLUGIN_WEBSERVICE
          value: "TRUE"

        # Connect to only one openldap server
        # in case of a openldap replication setup
        - name: LDAP1_HOST
          value: "openldap-writer"
        - name: LDAP1_TLS
          value: "FALSE"
        - name: LDAP1_SSL
          value: "FALSE"
        - name: LDAP1_BASE_DN
          value: "dc=example,dc=com"
        - name: LDAP1_ADMIN_DN
          value: "cn=admin,dc=example,dc=com"
        # Defined in the openldap-fusiondirectory
        # kubernetes exampel installation
        # using the same password/secret
        - name: LDAP1_ADMIN_PASS
          valueFrom:
            secretKeyRef:
              name: openldap-passwords
              key: ADMIN_PASS          
        - name: LDAP1_PORT
          value: "389"
        - name: LDAP1_NAME
          value: "ldap"

        - name: ENABLE_SMTP
          value: "FALSE"
#        - name: ENABLE_SMTP
#          value: "TRUE"
#        - name: SMTP_HOST
#          value: "smtp.example.net"
#        - name: SMTP_PORT
#          value: "25"
#        - name: SMTP_DOMAIN
#          value: "example.net"
#        - name: SMTP_MAILDOMAIN
#          value: "example.net"
#        - name: SMTP_TLS
#          value: "off"   
        ports:
        - containerPort: 80 
        
      restartPolicy: Always

What is the expected correct behavior?

The login through the fusiondirectory UI is possible.
The scripts being executed, so that the fusiondirectory UI can actually access.

Relevant logs and/or screenshots

While starting the docker container the first time, the logs show:

2021-10-20-05:30:08 [NOTICE] ** [openldap] Found custom scripts to execute
/assets/functions/10-openldap: line 558: /assets/custom-scripts/001-install-fusiondirectory.sh: Permission denied
/assets/functions/10-openldap: line 558: /assets/custom-scripts/002-update-schemas.sh: Permission denied

After getting a listing of the custom-scripts directory within the container it shows that the scripts are not executable:

total 36K
drwxr-xr-x 2 root root 4.0K Oct 16 17:06 .
drwxr-xr-x 1 root root 4.0K Oct 20 05:30 ..
-rw-r--r-- 1 root root  19K Oct 16 17:06 001-install-fusiondirectory.sh
-rw-r--r-- 1 root root  969 Oct 16 17:06 002-update-schemas.sh

Environment

  • Image version / tag: 1.4-7.1.5
  • Host OS:
    • Ubuntu (5.4.0-73-generic #82-Ubuntu SMP Wed Apr 14 17:39:42 UTC 2021 x86_64 x86_64 x86_64 GNU/Linux)
    • k8s (v1.22.2)
Any logs | docker-compose.yml

Possible fixes

Not only chmod +x /usr/sbin/fusiondirectory-insert-schema but also chmod +x the other necessary scripts.

Actually, adding the line in the Dockerfile worked for me:

    chmod +x /assets/custom-scripts/*.sh && \
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
bug Something isn't working
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
1 participant
@financelurker