Skip to content

Commit 4b76a93

Browse files
myasnikovdaniilclaude
myasnikovdaniil
and
claude
committed
[linstor-gui] Fix secret mount mode so nginx can read mTLS client certs
The linstor-client-tls secret was mounted with defaultMode 0400 and owned by root, so the nginx process (UID 101) got EACCES on tls.crt and crash-looped with: [emerg] cannot load certificate "/etc/linstor/client/tls.crt": BIO_new_file() failed ... Permission denied Set defaultMode to 0444. The secret volume is pod-local and readOnlyRootFilesystem is on, so making it world-readable inside the pod is not a broader disclosure. Verified on dev10: pod Ready, /healthz 200, /v1/nodes proxied through mTLS to linstor-controller:3371 returns real node data. Co-Authored-By: Claude Opus 4.6 <[email protected]> Signed-off-by: Myasnikov Daniil <[email protected]>
1 parent ba9f9e9 commit 4b76a93

1 file changed

Lines changed: 3 additions & 1 deletion

File tree

‎packages/system/linstor-gui/templates/deployment.yaml‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -93,7 +93,9 @@ spec:
9393
- name: linstor-client-tls
9494
secret:
9595
secretName: {{ .Values.linstor.clientSecret }}
96-
defaultMode: 0400
96+
# 0444 so nginx (UID 101) can read the mTLS client keypair;
97+
# the secret volume is pod-local, not a broader disclosure.
98+
defaultMode: 0444
9799
- name: tmp
98100
emptyDir: {}
99101
- name: nginx-cache

0 commit comments

Comments
 (0)