-
-
Notifications
You must be signed in to change notification settings - Fork 375
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Fix privileged steps in kubernetes #3711
Conversation
Shouldn't it only possible to use this when the repo is trusted? Where is this checked? |
Yep, it looks like it ignores the entire discussion from the linked PR. |
…nto fix-k8s-privileged
Step privileged is only set in case its a plugin and in the list of privileged plugins:
Or if the In case a user tries to set that option without having a trusted repo he will get a linter error from:
|
Yes, but there's no linter for |
Setting the security-context / user / group to woodpecker/pipeline/backend/kubernetes/pod.go Line 391 in 9cc5d08
woodpecker/pipeline/backend/kubernetes/pod.go Line 445 in 9cc5d08
|
It solves the issue that the |
And this is the only option that could be dangerous? |
At least those are the options we have and the checks we do: woodpecker/pipeline/backend/kubernetes/pod.go Lines 389 to 409 in b08133b
|
My goal was to simply fix the actual issue #3537 first 🤷🏾 . Changing the logic to require a trusted repo for the Requiring a trusted repo to manually set the |
Thanks, yes, in general it should work like docker. However, users should not be allowed to set dangerous options without the repo being trusted. |
I would suggest to involve the people that have created, contributed and tested the original PR. This entire discussion should have been done in the existing PR instead of just starting a new one... |
What about this now? Would it be fine to get it merged as hotfix and then rework the whole thing again? |
I would like to briefly share my perspective as a user of the Kubernetes backend. Recently, I had to downgrade to version 2.3 because it is not feasible to ask every user to adapt to a bug in Woodpecker that will eventually be reverted. If this PR is skipped in the release, most Kubernetes users would likely have to skip this release, which would be unfortunate. I sincerely appreciate the inclusion of this PR in the next release, as I expect most of us users would. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I'll just approve this now to get 2.5.0 ready.
Please use a new discussion to revert these changes and make it how it should work ideally, but the bug should be fixed asap.
Thanks for approving.
We can just move on with #3538 as this is part of it. |
closes #3537