External-Mirrors/kubespray
2
0
Fork 0
mirror of https://github.com/kubernetes-sigs/kubespray.git synced 2026-08-08 13:51:48 -02:30
Code Issues Packages Projects Releases Wiki Activity

kubelet, crio service: standardize unit file permissions to 0644 (#13408)

Browse Source 
* kubelet.service: use standard permissions

systemd[1]: Configuration file /etc/systemd/system/kubelet.service is marked world-inaccessible. This has no effect as configuration data is accessible via APIs without restrictions. Proceeding anyway.

* crio.service: reduce execute permission

systemd[1]: Configuration file /etc/systemd/system/crio.service is marked executable. Please remove executable permission bits. Proceeding anyway.
This commit is contained in:
Shaleen Bathla
2026-08-06 18:52:55 +05:30
committed by GitHub
parent 7198b21b3f
commit a7391a1461
2 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
roles/container-engine/cri-o/tasks/main.yaml
View File

@@ -150,7 +150,7 @@
copy: copy:
src: "{{ local_release_dir }}/cri-o/contrib/crio.service" src: "{{ local_release_dir }}/cri-o/contrib/crio.service"
dest: /etc/systemd/system/crio.service dest: /etc/systemd/system/crio.service
mode: "0755" mode: "0644"
remote_src: true remote_src: true
notify: Restart crio notify: Restart crio

2
roles/kubernetes/node/tasks/kubelet.yml
View File

@@ -33,7 +33,7 @@
src: "kubelet.service.j2" src: "kubelet.service.j2"
dest: "/etc/systemd/system/kubelet.service" dest: "/etc/systemd/system/kubelet.service"
backup: true backup: true
mode: "0600" mode: "0644"
validate: "sh -c '[ -f /usr/bin/systemd/system/factory-reset.target ] || exit 0 && systemd-analyze verify %s:kubelet.service'" validate: "sh -c '[ -f /usr/bin/systemd/system/factory-reset.target ] || exit 0 && systemd-analyze verify %s:kubelet.service'"
# FIXME: check that systemd version >= 250 (factory-reset.target was introduced in that release) # FIXME: check that systemd version >= 250 (factory-reset.target was introduced in that release)
# Remove once we drop support for systemd < 250 # Remove once we drop support for systemd < 250