Is this patch missing permissions setting? talos/patches/global/machine-files.yaml

[rishid]

Hi,

Using main HEAD branch without any changes. Just generated my talos machine configs and was reviewing them. Is the permissions 0o0 intentional? This seems wrong to me.

files:
    - content: |-
        [plugins."io.containerd.cri.v1.images"]
          discard_unpacked_layers = false
      permissions: 0o0
      path: /etc/cri/conf.d/20-customization.part
      op: create

[onedr0p]

My configs were generated without the permissions, so not sure how permissions: 0o0 got in there for you?

[onedr0p]

Hm I agree that looks odd, but maybe it doesn't affect anything?

[rishid]

Given these permissions, it will make cri not allowed to read the file and not see the discard_unpacked_layers config. It obviously doesn't affect anything from a usability stand point but it isn't correct. You should probably add permissions: 0o400 to the patch.

[rishid]

Example here: https://www.talos.dev/v1.9/reference/configuration/v1alpha1/config/#Config.machine.files.

[onedr0p]

I have updated it 562886f

Thanks for the pointer!

[onedr0p]

For what it's worth I don't think it matters, Talos will override the permissions on this file, no matter what permissions you give it, this will always be the permissions:

❯ talosctl -n k8s-0 ls -l /etc/cri/conf.d/20-customization.part
NODE    MODE         UID   GID   SIZE(B)   LASTMOD           LABEL   NAME
k8s-0   -rw-------   0     0     74        Mar  6 21:08:54           20-customization.part