External-Mirrors/kubespray
2
0
Fork 0
mirror of https://github.com/kubernetes-sigs/kubespray.git synced 2026-10-30 06:13:29 -02:30
Code Issues Packages Projects Releases Wiki Activity

ci: run the Ansible controller as an unprivileged user (#13527)

Browse Source 
* ci: run the Ansible controller as an unprivileged user

* ci: clarify non-root controller check

* ci: make the sudo privilege check fail when sudo succeeds

Bash does not apply errexit to the negated sudo command. The old check could not fail the job even when passwordless sudo worked. Exit explicitly when sudo succeeds.

Remove --break-system-packages from both upgrade pip installs because they run inside the controller virtual environment.
This commit is contained in:
Frank
2026-10-07 16:33:59 +00:00
committed by GitHub
parent 1701e1df8d
commit 1c1ed9562a
8 changed files with 50 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/pipeline.Dockerfile.j2
+11 -4
View File
@@ -16,6 +16,7 @@ RUN apt update -q \
libssl-dev \
python3-dev \
python3-pip \
python3-venv \
sshpass \
apt-transport-https \
jq \
@@ -44,16 +45,22 @@ ADD ./requirements.txt /kubespray/requirements.txt
ADD ./tests/requirements.txt /kubespray/tests/requirements.txt
RUN update-alternatives --install /usr/bin/python python /usr/bin/python3 1 \
&& pip install --break-system-packages --ignore-installed --no-compile --no-cache-dir pip -U \
&& pip install --break-system-packages --no-compile --no-cache-dir -r tests/requirements.txt \
&& curl -L https://dl.k8s.io/release/v{{ kube_version }}/bin/linux/$(dpkg --print-architecture)/kubectl -o /usr/local/bin/kubectl \
&& echo $(curl -L https://dl.k8s.io/release/v{{ kube_version }}/bin/linux/$(dpkg --print-architecture)/kubectl.sha256) /usr/local/bin/kubectl | sha256sum --check \
&& chmod a+x /usr/local/bin/kubectl \
# Install Vagrant
&& curl -LO https://releases.hashicorp.com/vagrant/${VAGRANT_VERSION}/vagrant_${VAGRANT_VERSION}-1_$(dpkg --print-architecture).deb \
&& dpkg -i vagrant_${VAGRANT_VERSION}-1_$(dpkg --print-architecture).deb \
&& rm vagrant_${VAGRANT_VERSION}-1_$(dpkg --print-architecture).deb \
&& rm vagrant_${VAGRANT_VERSION}-1_$(dpkg --print-architecture).deb
RUN useradd --create-home --uid 1001 kubespray
ENV HOME=/home/kubespray \
PATH="/home/kubespray/.local/bin:/home/kubespray/venv/bin:${PATH}"
USER kubespray
RUN python3 -m venv /home/kubespray/venv \
&& pip install --no-compile --no-cache-dir -r tests/requirements.txt \
&& vagrant plugin install vagrant-libvirt \
# Install Kubernetes collections
&& pip install --break-system-packages --no-compile --no-cache-dir kubernetes==35.0.0 \
&& pip install --no-compile --no-cache-dir kubernetes==35.0.0 \
&& ansible-galaxy collection install kubernetes.core:==6.4.0