You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Is your feature request related to a problem? Please describe.
In order to be able to run Icinga in a context with indeterminate User IDs, such as OpenShift, the group-injection logic from icinga.cpp seems to be an obstacle:
if (!pw) {
if (errno == 0) {
Log(LogCritical, "cli")
<< "Invalid user specified: " << user;
return EXIT_FAILURE;
} else {
Log(LogCritical, "cli")
<< "getpwnam() failed with error code " << errno << ", \"" << Utility::FormatErrorNumber(errno) << "\"";
return EXIT_FAILURE;
}
}
// also activate the additional groups the configured user is member of
...
Describe the solution you'd like
From my testing, activating additional groups in such a context is superfluous, since there are none; since the process is run as an arbitrary UID with GID 0, removing the if (!pw) { check and instead wrapping the group activating logic in
if (pw) {
// also activate the additional groups the configured user is member of
...
}
works fine
Describe alternatives you've considered
I've considered wrapping the image with dynamic user and group renaming, but this adds unnecessary complexity and image layers
The text was updated successfully, but these errors were encountered:
rezemble
changed the title
Allow Running as Arbitrary UID for unprivileged Container Environments (OpenShift)
Allow running as arbitrary UID for unprivileged Container Environments (OpenShift)
Jan 18, 2025
Is your feature request related to a problem? Please describe.
In order to be able to run Icinga in a context with indeterminate User IDs, such as OpenShift, the group-injection logic from
icinga.cpp
seems to be an obstacle:Describe the solution you'd like
From my testing, activating additional groups in such a context is superfluous, since there are none; since the process is run as an arbitrary UID with GID 0, removing the
if (!pw) {
check and instead wrapping the group activating logic inworks fine
Describe alternatives you've considered
I've considered wrapping the image with dynamic user and group renaming, but this adds unnecessary complexity and image layers
The text was updated successfully, but these errors were encountered: