Skip to content

help request: Why does nginx.conf has root permissions by default? #10480

Description

@GuyT2002

Description

Trying to run apisix, I have all the required resources, however I get the following log from the apisix pod:

/usr/local/openresty//luajit/bin/luajit ./apisix/cli/apisix.lua init
WARNING: using fixed Admin API token has security risk.
Please modify "admin_key" in conf/config.yaml .
failed to update nginx.conf: failed to open file: /usr/local/apisix/conf/nginx.conf, error info:/usr/local/apisix/conf/nginx.conf: Permission denied

However, I can't seem to find why the file is created with only root permissions, and not sufficient permission for apisix service account? (which exists in my cluster).
I'm using openshift containers platform 4.12.
I've seen the issue refered here, However, I don't understand why adding anyuid is a necessity here.
I can't really understand lua (hence the help request) but It does not seem like something that must be, since the nginx does not listen in port 80.

Environment

  • APISIX version (run apisix version): 3.6.0
  • Operating system (run uname -a): Linux apisix-client-1-68ddb78b56-jl788-debug-6stlf 4.18.0-372.73.1.el8_6.x86_64 change: added doc of how to load plugin. #1 SMP Fri Sep 8 13:16:27 EDT 2023 x86_64 GNU/Linux
  • OpenResty / Nginx version (run openresty -V or nginx -V): nginx version: openresty/1.21.4.2

Irrelevant:

  • etcd version, if relevant (run curl http://127.0.0.1:9090/v1/server_info):
  • APISIX Dashboard version, if relevant:
  • Plugin runner version, for issues related to plugin runners:
  • LuaRocks version, for installation issues (run luarocks --version):

Metadata

Metadata

Assignees

No one assigned

    Labels

    questionlabel for questions asked by users

    Type

    No type

    Projects

    Status
    ✅ Done

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions