fix(shard): apply default runtime identity to any pool image - #628
Draft
graveland wants to merge 1 commit into
Draft
fix(shard): apply default runtime identity to any pool image#628graveland wants to merge 1 commit into
graveland wants to merge 1 commit into
Conversation
This comment has been minimized.
This comment has been minimized.
effectivePgctldIdentity supplied the numeric UID/GID only when the image string was exactly DefaultPostgresImage, so overriding spec.images.postgres left containers carrying RunAsNonRoot with no RunAsUser. pgctld declares USER postgres by name, so the kubelet cannot prove the user is not root and every pool pod fails: CreateContainerConfigError: container has runAsNonRoot and image has non-numeric user (postgres) Reproduced with ghcr.io/multigres/pgctld:main, which differs from the pinned sha- tag by reference alone: the pool never converges and the e2e suite times out. The constant's own comment already gave the reason — pgctld declares USER by name — and that holds for every pgctld build rather than one tag. buildPostgresExporterContainer already supplies its identity unconditionally. effectiveMultipoolerIdentity carried the same gate, latent only because the multigres image uses numeric USER 65532. Leaving it would break the invariant validatePoolRuntimeIdentity enforces, that postgres and multipooler share a UID to reach PGDATA. An image that runs as a different numeric user must now set pool.Postgres.RunAsUser rather than inheriting its identity implicitly. Closes #466 Signed-off-by: Brent Graveland <graveland@supabase.io>
graveland
force-pushed
the
fix/pg-identity
branch
from
September 4, 2026 16:50
9763184 to
78d9e25
Compare
🔬 Go Test Coverage ReportSummary
Status✅ PASS DetailShow New Coverage |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What changed
Pool
postgres/multipoolercontainers now always get a default numericRunAsUser/RunAsGroupunless the CR sets one explicitly, instead of only when the image string exactly matches the pinned default.Why
The old gate meant the default identity applied only on an exact string match against
DefaultPostgresImage. Any drift — an image override, or just:mainvs. the pinnedsha-tag — leftRunAsNonRootset with noRunAsUser.pgctlddeclaresUSER postgresby name, so Kubernetes can't verify non-root and the pod fails:Reproduces on stock
minimal.yaml, no override needed. Closes #466.Notable details / risks
effectiveMultipoolerIdentityhad the same gate, latent only because the default multigres image happens to use numeric UID 65532 — fixed the same way, preserving the postgres/multipooler shared-UID invariantvalidatePoolRuntimeIdentityenforces. An image needing a different numeric user must now setpool.Postgres.RunAsUserexplicitly; it's no longer inferred.