Fix nexus-ui runAsNonRoot crash; prompt for the Istio hostname on install - #89
Conversation
…tall nginx:1.27-alpine's Dockerfile USER directive is "nginx" (a name, not a numeric UID) — kubelet can't statically verify that satisfies runAsNonRoot without an explicit runAsUser, and refuses to start the container: "container has runAsNonRoot and image has non-numeric user (nginx), cannot verify user is non-root". Confirmed the actual UID by running `id nginx` inside the real image on the cluster: uid=101(nginx) gid=101(nginx) — matches containerSecurityContext's existing podSecurityContext.fsGroup: 101, which was clearly set with this same value in mind but never paired with the matching runAsUser. Also adds an interactive hostname prompt to nexus-ui/install.sh, matching nexus-server's password-prompt pattern: routing is always Istio-based (routing.mode: istio) here, so it always sets --set routing.istio.hosts[0]=<hostname>. Checks the currently deployed VirtualService's host first (--ignore-not-found, fail-closed on real kubectl errors, same pattern as nexus-server's postgres-data PVC check) and requires an explicit "YES" confirmation if the entered hostname would actually change it — hostname changes have real DNS/TLS implications, so this guards against fat-fingering a typo into a routine redeploy. Also updates NS to "nexus" to match the actual target namespace. Verified: helm lint clean; `helm template --set routing.istio.hosts[0]=...` correctly overrides both the Gateway and VirtualService; rendered containerSecurityContext includes runAsUser: 101 alongside runAsNonRoot: true; bash -n clean; applied directly against the live cluster (helm upgrade with both --set overrides) — release now shows STATUS: deployed. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01A5KE4fZxHqbeiDaUJenSfU Signed-off-by: ckm007 <chandrakeshavmishra@gmail.com>
|
Warning Review limit reached
Next review available in: 51 minutes You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
WalkthroughThe Nexus UI installer now uses the ChangesNexus UI installation
Estimated code review effort: 3 (Moderate) | ~25 minutes Sequence Diagram(s)sequenceDiagram
participant Operator
participant Installer
participant Istio
participant Helm
Operator->>Installer: Start Nexus UI installation
Installer->>Istio: Query existing nexus-ui hostname
Istio-->>Installer: Return hostname
Installer-->>Operator: Request hostname and confirmation
Operator->>Installer: Confirm hostname
Installer->>Helm: Install with routing.istio.hosts[0]
Helm-->>Operator: Complete installation
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@MosipNexus/deploy/nexus-ui/install.sh`:
- Around line 56-59: Update the hostname prompt loop to check the return status
of read before continuing; when read fails, return a nonzero error immediately
instead of retrying with an empty hostname. Preserve the existing repetition for
successful reads that provide an empty value.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 4f979d16-cb74-4186-9491-fecf32e04e89
📒 Files selected for processing (2)
MosipNexus/deploy/nexus-ui/install.shMosipNexus/helm/nexus-ui/values.yaml
CodeRabbit review on #89: read failing (EOF on stdin, interrupted) left the loop spinning — hostname stays empty, the while condition stays true, and a failed non-blocking read doesn't block on a closed stdin, so it would busy-loop forever instead of erroring out. Preserves the existing behavior for a successful read that returns an empty string (re-prompts), only treats a genuine read failure as a hard error. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01A5KE4fZxHqbeiDaUJenSfU Signed-off-by: ckm007 <chandrakeshavmishra@gmail.com>
1 participant
Summary
containerSecurityContext.runAsUser: 101—nginx:1.27-alpine's DockerfileUSERdirective isnginx(a name, not a numeric UID). Kubelet can't statically verify that satisfiesrunAsNonRootwithout an explicitrunAsUser, and refuses to start the container:container has runAsNonRoot and image has non-numeric user (nginx), cannot verify user is non-root. Confirmed the actual UID by runningid nginxinside the real image on the cluster:uid=101(nginx) gid=101(nginx)— matchespodSecurityContext.fsGroup: 101, which was clearly set with this same value in mind but never paired with the matchingrunAsUser.nexus-ui/install.sh, matchingnexus-server's password-prompt pattern: routing is always Istio-based here (routing.mode: istio), so it always sets--set routing.istio.hosts[0]=<hostname>. Checks the currently deployedVirtualService's host first (--ignore-not-found, fail-closed on real kubectl errors — same pattern asnexus-server'spostgres-dataPVC check) and requires an explicitYESconfirmation if the entered hostname would actually change it, since that has real DNS/TLS implications.NStonexusto match the actual target namespace (wasmosip-nexus).Verification
helm lint— cleanhelm template --set routing.istio.hosts[0]=...— correctly overrides both theGatewayandVirtualServicecontainerSecurityContextincludesrunAsUser: 101alongsiderunAsNonRoot: truebash -n— cleanhelm upgradewith both--setoverrides) — release now showsSTATUS: deployedhttps://claude.ai/code/session_01A5KE4fZxHqbeiDaUJenSfU
Summary by CodeRabbit
New Features
nexusnamespace and applies the selected hostname to UI routing.Bug Fixes