From 7462b8b93bfda49ff77964bb0fc70815b687294e Mon Sep 17 00:00:00 2001 From: Max Gautier Date: Fri, 25 Sep 2026 13:02:30 +0000 Subject: [PATCH] download: hardcode artifacts mode & owner (#13570) The artifacts acquisition does not need particular owner or mode, it only needs to be readable by other parts of kubespray actually installing the artefacts where needed. Thus, remove all mode / owner specific maniulation in download and hardcode to 0644/0755 for file/directory. --- roles/download/tasks/download_file.yml | 14 ++--- roles/download/tasks/extract_file.yml | 4 +- roles/download/tasks/prep_download.yml | 1 - roles/kubernetes-apps/argocd/tasks/main.yml | 9 ++-- .../defaults/main/download.yml | 52 ------------------- 5 files changed, 8 insertions(+), 72 deletions(-) diff --git a/roles/download/tasks/download_file.yml b/roles/download/tasks/download_file.yml index 0522a48df..ae3a4e9ea 100644 --- a/roles/download/tasks/download_file.yml +++ b/roles/download/tasks/download_file.yml @@ -22,7 +22,6 @@ - name: Download_file | Create dest directory on node file: path: "{{ download.dest | dirname }}" - owner: "{{ download.owner | default(omit) }}" mode: "0755" state: directory @@ -59,8 +58,7 @@ get_url: url: "{{ download.url }}" dest: "{{ file_path_cached if download_force_cache else download.dest }}" - owner: "{{ omit if download_localhost else (download.owner | default(omit)) }}" - mode: "{{ omit if download_localhost else (download.mode | default(omit)) }}" + mode: "0644" checksum: "{{ download.checksum }}" validate_certs: "{{ download_validate_certs }}" url_username: "{{ download.username | default(omit) }}" @@ -96,6 +94,8 @@ dest: "{{ download.dest }}" use_ssh_args: true mode: push + owner: false + group: false register: get_task until: get_task is succeeded delay: "{{ retry_stagger | random + 3 }}" @@ -103,13 +103,5 @@ when: - download_force_cache - - name: Download_file | Set mode and owner - file: - path: "{{ download.dest }}" - mode: "{{ download.mode | default(omit) }}" - owner: "{{ download.owner | default(omit) }}" - when: - - download_force_cache - - name: "Download_file | Extract file archives" include_tasks: "extract_file.yml" diff --git a/roles/download/tasks/extract_file.yml b/roles/download/tasks/extract_file.yml index fbe478ccf..2494b815e 100644 --- a/roles/download/tasks/extract_file.yml +++ b/roles/download/tasks/extract_file.yml @@ -3,8 +3,8 @@ unarchive: src: "{{ download.dest }}" dest: "{{ download.dest | dirname }}" - owner: "{{ download.owner | default(omit) }}" - mode: "{{ download.mode | default(omit) }}" + mode: "a-x,u=rwX,go=rX" + # directory: 0755, file: 0644 remote_src: true extra_opts: "{{ download.unarchive_extra_opts | default(omit) }}" when: diff --git a/roles/download/tasks/prep_download.yml b/roles/download/tasks/prep_download.yml index e66e930a5..502238f0e 100644 --- a/roles/download/tasks/prep_download.yml +++ b/roles/download/tasks/prep_download.yml @@ -70,7 +70,6 @@ path: "{{ local_release_dir }}/images" state: directory mode: "0755" - owner: "{{ ansible_ssh_user | default(ansible_user_id) }}" when: - ansible_os_family != "Flatcar" diff --git a/roles/kubernetes-apps/argocd/tasks/main.yml b/roles/kubernetes-apps/argocd/tasks/main.yml index 9f5dd52fc..f40228836 100644 --- a/roles/kubernetes-apps/argocd/tasks/main.yml +++ b/roles/kubernetes-apps/argocd/tasks/main.yml @@ -5,14 +5,11 @@ download: "{{ download_defaults | combine(downloads.yq) }}" - name: Kubernetes Apps | Copy yq binary from download dir - ansible.posix.synchronize: + copy: src: "{{ downloads.yq.dest }}" dest: "{{ bin_dir }}/yq" - compress: false - perms: true - owner: false - group: false - delegate_to: "{{ inventory_hostname }}" + mode: "0755" + remote_src: true - name: Kubernetes Apps | Set ArgoCD template list set_fact: diff --git a/roles/kubespray_defaults/defaults/main/download.yml b/roles/kubespray_defaults/defaults/main/download.yml index e5a422c56..05b3a15ba 100644 --- a/roles/kubespray_defaults/defaults/main/download.yml +++ b/roles/kubespray_defaults/defaults/main/download.yml @@ -379,8 +379,6 @@ downloads: checksum: "{{ etcd_binary_checksum }}" url: "{{ etcd_download_url }}" unarchive: true - owner: "root" - mode: "0755" groups: - etcd @@ -398,8 +396,6 @@ downloads: checksum: "{{ cni_binary_checksum }}" url: "{{ cni_download_url }}" unarchive: false - owner: "root" - mode: "0755" groups: - k8s_cluster @@ -410,8 +406,6 @@ downloads: checksum: "{{ kubeadm_binary_checksum }}" url: "{{ kubeadm_download_url }}" unarchive: false - owner: "root" - mode: "0755" groups: - k8s_cluster @@ -422,8 +416,6 @@ downloads: checksum: "{{ kubelet_binary_checksum }}" url: "{{ kubelet_download_url }}" unarchive: false - owner: "root" - mode: "0755" groups: - k8s_cluster @@ -434,8 +426,6 @@ downloads: checksum: "{{ kubectl_binary_checksum }}" url: "{{ kubectl_download_url }}" unarchive: false - owner: "root" - mode: "0755" groups: - kube_control_plane @@ -446,8 +436,6 @@ downloads: checksum: "{{ crictl_binary_checksum }}" url: "{{ crictl_download_url }}" unarchive: true - owner: "root" - mode: "0755" groups: - k8s_cluster @@ -458,8 +446,6 @@ downloads: checksum: "{{ crio_archive_checksum }}" url: "{{ crio_download_url }}" unarchive: true - owner: "root" - mode: "0755" groups: - k8s_cluster @@ -472,8 +458,6 @@ downloads: unarchive: true unarchive_extra_opts: - --strip=1 - owner: "root" - mode: "0755" groups: - k8s_cluster @@ -484,8 +468,6 @@ downloads: checksum: "{{ crun_binary_checksum }}" url: "{{ crun_download_url }}" unarchive: false - owner: "root" - mode: "0755" groups: - k8s_cluster @@ -496,8 +478,6 @@ downloads: checksum: "{{ youki_archive_checksum }}" url: "{{ youki_download_url }}" unarchive: true - owner: "root" - mode: "0755" groups: - k8s_cluster @@ -508,8 +488,6 @@ downloads: checksum: "{{ runc_binary_checksum }}" url: "{{ runc_download_url }}" unarchive: false - owner: "root" - mode: "0755" groups: - k8s_cluster @@ -520,8 +498,6 @@ downloads: checksum: "{{ kata_containers_binary_checksum }}" url: "{{ kata_containers_download_url }}" unarchive: false - owner: "root" - mode: "0755" groups: - k8s_cluster @@ -532,8 +508,6 @@ downloads: checksum: "{{ containerd_checksum }}" url: "{{ containerd_download_url }}" unarchive: false - owner: "root" - mode: "0755" groups: - k8s_cluster @@ -544,8 +518,6 @@ downloads: checksum: "{{ gvisor_runsc_binary_checksum }}" url: "{{ gvisor_runsc_download_url }}" unarchive: false - owner: "root" - mode: 755 groups: - k8s_cluster @@ -556,8 +528,6 @@ downloads: checksum: "{{ gvisor_containerd_shim_binary_checksum }}" url: "{{ gvisor_containerd_shim_runsc_download_url }}" unarchive: false - owner: "root" - mode: 755 groups: - k8s_cluster @@ -568,8 +538,6 @@ downloads: checksum: "{{ nerdctl_archive_checksum }}" url: "{{ nerdctl_download_url }}" unarchive: true - owner: "root" - mode: "0755" groups: - k8s_cluster @@ -580,8 +548,6 @@ downloads: checksum: "{{ skopeo_binary_checksum }}" url: "{{ skopeo_download_url }}" unarchive: false - owner: "root" - mode: "0755" groups: - kube_control_plane @@ -641,8 +607,6 @@ downloads: checksum: "{{ ciliumcli_binary_checksum }}" url: "{{ ciliumcli_download_url }}" unarchive: true - owner: "root" - mode: "0755" groups: - k8s_cluster @@ -674,8 +638,6 @@ downloads: checksum: "{{ calicoctl_binary_checksum }}" url: "{{ calicoctl_download_url }}" unarchive: false - owner: "root" - mode: "0755" groups: - k8s_cluster @@ -720,8 +682,6 @@ downloads: dest: "{{ local_release_dir }}/calico-{{ calico_version }}-kdd-crds.yaml" checksum: "{{ calico_crds_checksums.no_arch[calico_version] }}" url: "{{ calico_crds_download_url }}" - owner: "root" - mode: "0755" groups: - kube_control_plane @@ -795,8 +755,6 @@ downloads: checksum: "{{ helm_archive_checksum }}" url: "{{ helm_download_url }}" unarchive: true - owner: "root" - mode: "0755" groups: - kube_control_plane @@ -863,8 +821,6 @@ downloads: dest: "{{ local_release_dir }}/gateway-api-{{ gateway_api_channel }}-install.yaml" checksum: "{{ lookup('vars', 'gateway_api_' + gateway_api_channel + '_crds_checksums').no_arch[gateway_api_version] }}" url: "{{ gateway_api_crds_download_url }}" - owner: "root" - mode: "0755" groups: - kube_control_plane @@ -875,8 +831,6 @@ downloads: dest: "{{ local_release_dir }}/prometheus-operator-crds.yaml" checksum: "{{ prometheus_operator_crds_checksums.no_arch[prometheus_operator_crds_version] }}" url: "{{ prometheus_operator_crds_download_url }}" - owner: "root" - mode: "0755" groups: - kube_control_plane @@ -965,8 +919,6 @@ downloads: checksum: "{{ yq_binary_checksum }}" url: "{{ yq_download_url }}" unarchive: false - owner: "root" - mode: "0755" groups: - kube_control_plane @@ -978,8 +930,6 @@ downloads: checksum: "{{ argocd_install_checksum }}" url: "{{ argocd_install_url }}" unarchive: false - owner: "root" - mode: "0644" groups: - kube_control_plane @@ -991,5 +941,3 @@ download_defaults: dest: None url: None unarchive: false - owner: "{{ kube_owner }}" - mode: None