External-Mirrors/kubespray
2
0
Fork 0
mirror of https://github.com/kubernetes-sigs/kubespray.git synced 2026-10-30 22:16:23 -02:30
Code Issues Packages Projects Releases Wiki Activity

ci: run the Ansible controller as an unprivileged user (#13527)

Browse Source 
* ci: run the Ansible controller as an unprivileged user

* ci: clarify non-root controller check

* ci: make the sudo privilege check fail when sudo succeeds

Bash does not apply errexit to the negated sudo command. The old check could not fail the job even when passwordless sudo worked. Exit explicitly when sudo succeeds.

Remove --break-system-packages from both upgrade pip installs because they run inside the controller virtual environment.
This commit is contained in:
Frank
2026-10-07 16:33:59 +00:00
committed by GitHub
parent 1701e1df8d
commit 1c1ed9562a
8 changed files with 50 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.gitlab-ci.yml
+9 -1
View File
@@ -8,11 +8,19 @@ stages:
variables:
FAILFASTCI_NAMESPACE: 'kargo-ci'
GITLAB_REPOSITORY: 'kargo-ci/kubernetes-sigs-kubespray'
GIT_CONFIG_COUNT: 2
# Let the helper assign checkout ownership to the build user.
FF_DISABLE_UMASK_FOR_DOCKER_EXECUTOR: "true"
FF_DISABLE_UMASK_FOR_KUBERNETES_EXECUTOR: "true"
GIT_CONFIG_COUNT: 3
GIT_CONFIG_KEY_0: user.email
GIT_CONFIG_VALUE_0: "ci@kubespray.io"
GIT_CONFIG_KEY_1: user.name
GIT_CONFIG_VALUE_1: "Kubespray CI"
# TODO: Remove this safe.directory workaround after fixing the inconsistent GitLab Runner versions.
# Runners older than 17.11 may leave checkout ownership incorrect despite the FF_DISABLE_UMASK flags.
# https://github.com/kubernetes-sigs/kubespray/pull/13527#discussion_r4198076964
GIT_CONFIG_KEY_2: safe.directory
GIT_CONFIG_VALUE_2: "$CI_PROJECT_DIR"
ANSIBLE_FORCE_COLOR: "true"
MAGIC: "ci check this"
GS_ACCESS_KEY_ID: $GS_KEY