ansible/awx

awxfifo creation fails when write access to container is prohibited.

Open

#14,052 opened on May 26, 2023

View on GitHub
 (1 comment) (0 reactions) (0 assignees)Python (3,333 forks)batch import
communityhelp wantedtype:bug

Repository metrics

Stars
 (13,071 stars)
PR merge metrics
 (Avg merge 24d 6h) (30 merged PRs in 30d)

Description

Please confirm the following

  • I agree to follow this project's code of conduct.
  • I have checked the current issues for duplicates.
  • I understand that AWX is open source software provided for free and that I might not receive a timely response.
  • I am NOT reporting a (potential) security vulnerability. (These should be emailed to security@ansible.com instead.)

Bug Summary

awxfifo file specified in uwsgi.ini might not be created in Kubernetes environment where writing to file system is forbidden/prohibited.

https://github.com/ansible/awx/blob/22.3.0/tools/ansible/roles/dockerfile/files/uwsgi.ini#L9

AWX version

22.3.0

Select the relevant components

  • UI
  • UI (tech preview)
  • API
  • Docs
  • Collection
  • CLI
  • Other

Installation method

kubernetes

Modifications

no

Ansible version

No response

Operating system

No response

Web browser

No response

Steps to reproduce

  • Apply security policy with "readOnlyRootFilesystem" context to Kubernetes cluster.
  • Start AWX installation with AWX Operator.

Expected results

If the file was located in different directory or subdirectory of /var/lib/awx, then with help of awx-operator emptyDir can be mounted to such location. Thus allowing awxfifo file to be created.

---
spec:
...
  extra_volumes:
    - name: awx-fifo
       emptyDir: {}

task_extra_volume_mounts: |
   - name: awx-fifo
     mountPath: /var/lib/awx/fifo

master-fifo = /var/lib/awx/fifo/awxfifo

Actual results

uwsgi will prevent startup of web container due to inability of writing to /var/lib/awx directory.

Additional information

No response

Contributor guide