Repository navigation
Conversation
|
Important
This repository does not receive automatic reviews because it has fewer than 10 stars.
 |
|
/test mariadb-operator-build-deploy-chainsaw |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: dciabrin, zzzeek The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
mysql_root_auth.sh caches the cluster root password in plaintext at /var/local/my.cnf/mysql_pw_cache.cnf. Commit 68cee7b moved that cache off the PVC, and e2b182e later made /var/local an EmptyDir when kolla's chown went away, which put it back on the node's filesystem. Set Medium: StorageMediumMemory on the var-local EmptyDir so the cache lives on tmpfs and the plaintext password is never written to any disk. Volume lifetime is unchanged: an EmptyDir is created empty at pod start and discarded when the pod is deleted, on either medium. SizeLimit bounds the tmpfs against the pod's memory limit; the cache file itself is well under a hundred bytes. Also assert in the root-auth-cache chainsaw test that /var/local is tmpfs. The suite checked the cache file's existence, format and mode but nothing about its backing store, which is why the move onto disk went unnoticed. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
|
im rebasing this because it needs TargetVersion |
df1b6d4 to
a7d60f3
Compare
|
New changes are detected. LGTM label has been removed. |
mysql_root_auth.sh caches the cluster root password in plaintext at /var/local/my.cnf/mysql_pw_cache.cnf. Commit 68cee7b moved that cache off the PVC, and e2b182e later made /var/local an EmptyDir when kolla's chown went away, which put it back on the node's filesystem.
Set Medium: StorageMediumMemory on the var-local EmptyDir so the cache lives on tmpfs and the plaintext password is never written to any disk. Volume lifetime is unchanged: an EmptyDir is created empty at pod start and discarded when the pod is deleted, on either medium.
SizeLimit bounds the tmpfs against the pod's memory limit; the cache file itself is well under a hundred bytes.
Also assert in the root-auth-cache chainsaw test that /var/local is tmpfs. The suite checked the cache file's existence, format and mode but nothing about its backing store, which is why the move onto disk went unnoticed.