diff --git a/Dockerfile b/Dockerfile index 8a6972f5562df..40350fd0a657b 100644 --- a/Dockerfile +++ b/Dockerfile @@ -47,7 +47,6 @@ RUN groupadd -g 999 argocd && \ mkdir -p /home/argocd && \ chown argocd:0 /home/argocd && \ chmod g=u /home/argocd && \ - chmod g=u /etc/passwd && \ apt-get update && \ apt-get dist-upgrade -y && \ apt-get install -y git git-lfs python3-pip tini gpg tzdata && \ @@ -62,9 +61,7 @@ COPY --from=builder /usr/local/bin/ks /usr/local/bin/ks COPY --from=builder /usr/local/bin/helm2 /usr/local/bin/helm2 COPY --from=builder /usr/local/bin/helm /usr/local/bin/helm COPY --from=builder /usr/local/bin/kustomize /usr/local/bin/kustomize -# script to add current (possibly arbitrary) user to /etc/passwd at runtime -# (if it's not already there, to be openshift friendly) -COPY uid_entrypoint.sh /usr/local/bin/uid_entrypoint.sh +COPY entrypoint.sh /usr/local/bin/entrypoint.sh # support for mounting configuration from a configmap RUN mkdir -p /app/config/ssh && \ diff --git a/entrypoint.sh b/entrypoint.sh new file mode 100755 index 0000000000000..88515e217e4be --- /dev/null +++ b/entrypoint.sh @@ -0,0 +1,9 @@ +#!/bin/bash + +# If we're started as PID 1, we should wrap command execution through tini to +# prevent leakage of orphaned processes ("zombies"). +if test "$$" = "1"; then + exec tini -- $@ +else + exec "$@" +fi diff --git a/manifests/base/repo-server/argocd-repo-server-deployment.yaml b/manifests/base/repo-server/argocd-repo-server-deployment.yaml index ec1a7e675c29d..0f66bb4a15b1b 100644 --- a/manifests/base/repo-server/argocd-repo-server-deployment.yaml +++ b/manifests/base/repo-server/argocd-repo-server-deployment.yaml @@ -21,7 +21,7 @@ spec: image: quay.io/argoproj/argocd:latest imagePullPolicy: Always command: - - uid_entrypoint.sh + - entrypoint.sh - argocd-repo-server - --redis - $(ARGOCD_REDIS_SERVICE):6379 diff --git a/manifests/core-install.yaml b/manifests/core-install.yaml index 0820a5ff95bc3..eced36789367e 100644 --- a/manifests/core-install.yaml +++ b/manifests/core-install.yaml @@ -2905,7 +2905,7 @@ spec: automountServiceAccountToken: false containers: - command: - - uid_entrypoint.sh + - entrypoint.sh - argocd-repo-server - --redis - argocd-redis:6379 diff --git a/manifests/ha/base/overlays/argocd-repo-server-deployment.yaml b/manifests/ha/base/overlays/argocd-repo-server-deployment.yaml index a417f3d2ff130..496bb136f602a 100644 --- a/manifests/ha/base/overlays/argocd-repo-server-deployment.yaml +++ b/manifests/ha/base/overlays/argocd-repo-server-deployment.yaml @@ -23,7 +23,7 @@ spec: containers: - name: argocd-repo-server command: - - uid_entrypoint.sh + - entrypoint.sh - argocd-repo-server - --redis - "argocd-redis-ha-haproxy:6379" diff --git a/manifests/ha/install.yaml b/manifests/ha/install.yaml index 09a662e34aec1..8fba5c8a0c39b 100644 --- a/manifests/ha/install.yaml +++ b/manifests/ha/install.yaml @@ -3818,7 +3818,7 @@ spec: automountServiceAccountToken: false containers: - command: - - uid_entrypoint.sh + - entrypoint.sh - argocd-repo-server - --redis - argocd-redis-ha-haproxy:6379 diff --git a/manifests/ha/namespace-install.yaml b/manifests/ha/namespace-install.yaml index f9eeeafe4a945..df7dbd12fc947 100644 --- a/manifests/ha/namespace-install.yaml +++ b/manifests/ha/namespace-install.yaml @@ -1205,7 +1205,7 @@ spec: automountServiceAccountToken: false containers: - command: - - uid_entrypoint.sh + - entrypoint.sh - argocd-repo-server - --redis - argocd-redis-ha-haproxy:6379 diff --git a/manifests/install.yaml b/manifests/install.yaml index 182f9fba16fce..a85cebe8439b3 100644 --- a/manifests/install.yaml +++ b/manifests/install.yaml @@ -3147,7 +3147,7 @@ spec: automountServiceAccountToken: false containers: - command: - - uid_entrypoint.sh + - entrypoint.sh - argocd-repo-server - --redis - argocd-redis:6379 diff --git a/manifests/namespace-install.yaml b/manifests/namespace-install.yaml index 6ce8b71695a74..00eafab67d338 100644 --- a/manifests/namespace-install.yaml +++ b/manifests/namespace-install.yaml @@ -534,7 +534,7 @@ spec: automountServiceAccountToken: false containers: - command: - - uid_entrypoint.sh + - entrypoint.sh - argocd-repo-server - --redis - argocd-redis:6379 diff --git a/uid_entrypoint.sh b/uid_entrypoint.sh deleted file mode 100755 index 3982327c7b7f7..0000000000000 --- a/uid_entrypoint.sh +++ /dev/null @@ -1,18 +0,0 @@ -#!/bin/bash - -# Make sure that if we are using an arbitrary UID that it appears in /etc/passwd, -# otherwise this will cause issues with things like cloning with git+ssh -# reference: https://access.redhat.com/documentation/en-us/openshift_container_platform/3.11/html/creating_images/creating-images-guidelines#use-uid -if ! whoami &> /dev/null; then - if [ -w /etc/passwd ]; then - echo "${USER_NAME:-default}:x:$(id -u):0:${USER_NAME:-default} user:/home/argocd:/sbin/nologin" >> /etc/passwd - fi -fi - -# If we're started as PID 1, we should wrap command execution through tini to -# prevent leakage of orphaned processes ("zombies"). -if test "$$" = "1"; then - exec tini -- $@ -else - exec "$@" -fi