fingerprint + Kubernetes

[jerome-morgado]

Hello,

We use SFTPGo inside Kubernetes with multiple Pods. The pod that host SFTPGo reboots and the Fingerprint changed probably because the Pod has been deployed on another Node.

How to be sure that the fingerprint won't change ?

I use

Chart : sagikazarmark/[email protected]
Code : sftpgo:v2.1.0

I will upgrade to

Chart : sagikazarmark/[email protected]
Code : sftpgo:v2.2.2

[drakkan]

Use kubernetes secrets for your host keys

[jerome-morgado]

Shall I save the Fingerprint or the ssh public and private keys ?

[drakkan]

this is not SFTPGo specific, just Google for "kubernetes secrets ssh host keys"

[jerome-morgado]

Hello @drakkan,

I set the 6 files inside a secret which is mounted on /var/lib/sftpgo folder

Inside, I have the 6 files with the tls folder containing my certificates :
id_ecdsa + id_ecdsa.pub
id_ed25519 + id_ed25519.pub
id_rsa + id_rsa.pub

When I deploy SFTPGo, the fingerprint issue is fixed, BUT I can't upload files to SFTPGo.
I have the following error :

"
Erreur : /FTPReady_2022-09-02_05-38-54_Sevenoaks_-_Kent_2022_09_02_05_38_07.txt.1662093902506180.txt: open for write: received failure with description 'failure: open read-only file system'
Erreur : File transfer failed
"

Is it related to the Storage itself of the keys ? Keys are the only change.
Shall I save in my vault all the 6 files or only some specific files ?

If this can't be fixed by code, we need to mount the volume and then copy to this location using Init-Container or PostStart-hook

Regards

[drakkan]

Hello @drakkan,

I set the 6 files inside a secret which is mounted on /var/lib/sftpgo folder

Inside, I have the 6 files with the tls folder containing my certificates : id_ecdsa + id_ecdsa.pub id_ed25519 + id_ed25519.pub id_rsa + id_rsa.pub

When I deploy SFTPGo, the fingerprint issue is fixed, BUT I can't upload files to SFTPGo. I have the following error :

" Erreur : /FTPReady_2022-09-02_05-38-54_Sevenoaks_-_Kent_2022_09_02_05_38_07.txt.1662093902506180.txt: open for write: received failure with description 'failure: open read-only file system' Erreur : File transfer failed "

Is it related to the Storage itself of the keys ? Keys are the only change. Shall I save in my vault all the 6 files or only some specific files ?

This seems unrelated. Please check the home directory for your users. It seems you are using / as home dir, try to leave it blank (for an appropriate default) or set it to a location where the user with id 1000 can write

If this can't be fixed by code, we need to mount the volume and then copy to this location using Init-Container or PostStart-hook

Regards

[Larzack]

@drakkan, where can I fix the default home directory for users in the configuration ?
Actually the default directory is /var/lib/sftpgo where the certificates and the secrets are.

[drakkan]

@drakkan, where can I fix the default home directory for users in the configuration ? Actually the default directory is /var/lib/sftpgo where the certificates and the secrets are.

In docker images the users_base_dir in configuration file is set to /srv/sftpgo/data so the user's home dir is /srv/sftpgo/data/<username>, you can change the home dir on a per-user basis from the WebAdmin UI. This is all documented, I don't have time/motivation for step by step support. Please read the support policy. I will not reply anymore, sorry

[rashmimaharana]

@Larzack

I expect that you have enabled TLS for data provider and mounted the certificate in pod either through volume or Kubernetes secret. But the permission and ownership to those TLS files might be the issue. Try changing the permission before starting the SFTPGo container.

Example:
chmod 0600 /var/lib/postgres-tls/client-key.pem << This is path to client certificate>>
chown -R 1000:1000 /var/lib/postgres-tls << This is path to TLS folder>>

Error :
Erreur : /FTPReady_2022-09-02_05-38-54_Sevenoaks_-_Kent_2022_09_02_05_38_07.txt.1662093902506180.txt: open for write: received failure with description 'failure: open read-only file system'
Erreur : File transfer failed