{"action":"created","issue":{"url":"https://api.github.com/repos/kubernetes/kubernetes/issues/57117","repository_url":"https://api.github.com/repos/kubernetes/kubernetes","labels_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/57117/labels{/name}","comments_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/57117/comments","events_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/57117/events","html_url":"https://github.com/kubernetes/kubernetes/issues/57117","id":281552288,"node_id":"MDU6SXNzdWUyODE1NTIyODg=","number":57117,"title":"libpq-based PostgreSQL clients will no longer read a PGPASSFILE mounted from a secret","user":{"login":"rhymoid","id":3854516,"node_id":"MDQ6VXNlcjM4NTQ1MTY=","avatar_url":"https://avatars1.githubusercontent.com/u/3854516?v=4","gravatar_id":"","url":"https://api.github.com/users/rhymoid","html_url":"https://github.com/rhymoid","followers_url":"https://api.github.com/users/rhymoid/followers","following_url":"https://api.github.com/users/rhymoid/following{/other_user}","gists_url":"https://api.github.com/users/rhymoid/gists{/gist_id}","starred_url":"https://api.github.com/users/rhymoid/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rhymoid/subscriptions","organizations_url":"https://api.github.com/users/rhymoid/orgs","repos_url":"https://api.github.com/users/rhymoid/repos","events_url":"https://api.github.com/users/rhymoid/events{/privacy}","received_events_url":"https://api.github.com/users/rhymoid/received_events","type":"User","site_admin":false},"labels":[{"id":105146071,"node_id":"MDU6TGFiZWwxMDUxNDYwNzE=","url":"https://api.github.com/repos/kubernetes/kubernetes/labels/kind/bug","name":"kind/bug","color":"e11d21","default":false},{"id":169428334,"node_id":"MDU6TGFiZWwxNjk0MjgzMzQ=","url":"https://api.github.com/repos/kubernetes/kubernetes/labels/sig/storage","name":"sig/storage","color":"d2b48c","default":false}],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":8,"created_at":"2017-12-12T21:59:49Z","updated_at":"2018-07-23T19:58:23Z","closed_at":"2018-05-11T23:37:51Z","author_association":"NONE","body":"/kind bug\r\n\r\n**What happened**: libpq refuses to load my PGPASSFILE, resulting in \"no password provided\" error messages.\r\n\r\n**What you expected to happen**: libpq reads the database password from the PGPASSFILE I'm pointing to.\r\n\r\n**How to reproduce it (as minimally and precisely as possible)**:\r\n1. Create a secret, containing [a `.pgpass` file](https://www.postgresql.org/docs/9.4/static/libpq-pgpass.html).\r\n2. Create a volume from the secret, taking care to set the mode bits to e.g. `r--------` (256 in decimal).\r\n3. Mount the volume in a container.\r\n4. Let the `PGPASSFILE` environment variable point to the `.pgpass` file.\r\n5. Use SQLAlchemy to connect to a PostgreSQL database, providing all information *except* the password.\r\n\r\n**Anything else we need to know?**:\r\n* This approach used to work, but likely broke due to #25285.\r\n* libpq not only demands that the PGPASSFILE is only accessible by its owner, but also requires that it is a regular file.\r\n* I've tried pointing to `secret-volume/..data/.pgpass` instead of `secret-volume/.pgpass` directly, but that doesn't seem to work either. I'm not sure, but maybe libpq really doesn't like symbolic links in the path to the PGPASSFILE.\r\n* I can work around this problem by setting `PGPASSWORD` instead, or by keeping the password in the database connection URL. It seems a tiny bit cleaner to me to be able to switch only the config mapped connection URL while keeping the same passwords file, but I'd understand a wontfix resolution.\r\n\r\n**Environment**:\r\n- Kubernetes version (use `kubectl version`): server v1.7.8-gke.0\r\n- Cloud provider or hardware configuration: Google Cloud Platform\r\n- OS (e.g. from /etc/os-release): Container-Optimized OS from Google\r\n- Kernel (e.g. `uname -a`): 4.4.64+"},"comment":{"url":"https://api.github.com/repos/kubernetes/kubernetes/issues/comments/407181662","html_url":"https://github.com/kubernetes/kubernetes/issues/57117#issuecomment-407181662","issue_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/57117","id":407181662,"node_id":"MDEyOklzc3VlQ29tbWVudDQwNzE4MTY2Mg==","user":{"login":"rata","id":70861,"node_id":"MDQ6VXNlcjcwODYx","avatar_url":"https://avatars1.githubusercontent.com/u/70861?v=4","gravatar_id":"","url":"https://api.github.com/users/rata","html_url":"https://github.com/rata","followers_url":"https://api.github.com/users/rata/followers","following_url":"https://api.github.com/users/rata/following{/other_user}","gists_url":"https://api.github.com/users/rata/gists{/gist_id}","starred_url":"https://api.github.com/users/rata/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rata/subscriptions","organizations_url":"https://api.github.com/users/rata/orgs","repos_url":"https://api.github.com/users/rata/repos","events_url":"https://api.github.com/users/rata/events{/privacy}","received_events_url":"https://api.github.com/users/rata/received_events","type":"User","site_admin":false},"created_at":"2018-07-23T19:58:23Z","updated_at":"2018-07-23T19:58:23Z","author_association":"MEMBER","body":"@blaggacao The link to pqlib is using stat() and not lstat(). See https://github.com/postgres/postgres/blob/b90d97e081415768468295cc4d10d7ee21881964/src/interfaces/libpq/fe-connect.c#L6410\r\n\r\nAnd note that, from the manage, it says:\r\n\r\n ```\r\nlstat() is identical to stat(), except that if path is a symbolic link, then the link itself is stat-ed, not the file that it refers to.\r\n```\r\n\r\nSo stat should return true to S_ISREG, as it is a regular file what this points to.\r\n\r\nI'll try to reproduce and report back anyways :)"}}
{"actor":{"display_login":"rata"}}