Fix running etcd as non-root (#219)

We need to create the /var/lib/mke directory early with the correct
permissions. Otherwise will the directory be created while creating the
etcd datadir with the etcd data dir permissions, will make the directory
unreadable by etcd user.

Set the correct owner of etcd directories and files.

Use mode 0751 for certificate root dir. This certificates in this
directory needs to be accessible from all mke processes, but they dont
need to read the contents of the directory.

Fixes #219

Signed-off-by: Natanael Copa <ncopa@mirantis.com>

cmd/server.go

@@ -23,8 +23,6 @@ import (
 	"syscall"
 	"time"
 
-	"github.com/Mirantis/mke/pkg/performance"
-
 	"github.com/avast/retry-go"
 	"github.com/pkg/errors"
 	"github.com/sirupsen/logrus"
@@ -36,6 +34,7 @@ import (
 	"github.com/Mirantis/mke/pkg/component/server"
 	"github.com/Mirantis/mke/pkg/component/worker"
 	"github.com/Mirantis/mke/pkg/constant"
+	"github.com/Mirantis/mke/pkg/performance"
 	"github.com/Mirantis/mke/pkg/util"
 
 	"github.com/Mirantis/mke/pkg/apis/v1beta1"
@@ -89,10 +88,16 @@ func startServer(ctx *cli.Context) error {
 	if err != nil {
 		return err
 	}
-	componentManager := component.NewManager()
+
+	// create directories early with the proper permissions
+	if err = util.InitDirectory(constant.DataDir, constant.DataDirMode); err != nil {
+		return err
+	}
 	if err := util.InitDirectory(constant.CertRootDir, constant.CertRootDirMode); err != nil {
 		return err
 	}
+
+	componentManager := component.NewManager()
 	certificateManager := certificate.Manager{}
 
 	var join = false

pkg/certificate/manager.go

@@ -63,10 +63,6 @@ func (m *Manager) EnsureCA(name, cn string) error {
 		return nil
 	}
 
-	if err := util.InitDirectory(filepath.Dir(keyFile), constant.CertRootDirMode); err != nil {
-		return errors.Wrapf(err, "failed to create pki dir")
-	}
-
 	req := new(csr.CertificateRequest)
 	req.KeyRequest = csr.NewKeyRequest()
 	req.KeyRequest.A = "rsa"

pkg/component/server/etcd.go

@@ -65,13 +65,24 @@ func (e *Etcd) Init() error {
 	if err != nil {
 		logrus.Warning(errors.Wrap(err, "Running etcd as root"))
 	}
+	e.gid, _ = util.GetGID(constant.Group)
 
 	err = util.InitDirectory(constant.EtcdDataDir, constant.EtcdDataDirMode) // https://docs.datadoghq.com/security_monitoring/default_rules/cis-kubernetes-1.5.1-1.1.11/
 	if err != nil {
 		return errors.Wrapf(err, "failed to create %s", constant.EtcdDataDir)
 	}
 
-	e.gid, _ = util.GetGID(constant.Group)
+	err = util.InitDirectory(constant.EtcdCertDir, constant.EtcdCertDirMode) // https://docs.datadoghq.com/security_monitoring/default_rules/cis-kubernetes-1.5.1-4.1.7/
+	if err != nil {
+		return errors.Wrapf(err, "failed to create etcd cert dir")
+	}
+
+	for _, f := range []string{constant.EtcdDataDir, constant.EtcdCertDir} {
+		err = os.Chown(f, e.uid, e.gid)
+		if err != nil {
+			return err
+		}
+	}
 
 	for _, f := range []string{
 		"ca.crt",
@@ -130,10 +141,6 @@ func (e *Etcd) Run() error {
 		if util.FileExists(etcdCaCert) && util.FileExists(etcdCaCertKey) {
 			logrus.Warnf("etcd ca certs already exists, not gonna overwrite. If you wish to re-sync them, delete the existing ones.")
 		} else {
-			err := util.InitDirectory(filepath.Dir(etcdCaCertKey), constant.CertSecureMode) // https://docs.datadoghq.com/security_monitoring/default_rules/cis-kubernetes-1.5.1-4.1.7/
-			if err != nil {
-				return errors.Wrapf(err, "failed to create etcd cert dir")
-			}
 			err = ioutil.WriteFile(etcdCaCertKey, etcdResponse.CA.Key, constant.CertSecureMode)
 			if err != nil {
 				return err
@@ -143,6 +150,11 @@ func (e *Etcd) Run() error {
 			if err != nil {
 				return err
 			}
+			for _, f := range []string{filepath.Dir(etcdCaCertKey), etcdCaCertKey, etcdCaCert} {
+				if err := os.Chown(f, e.uid, e.gid); err != nil {
+					return err
+				}
+			}
 		}
 
 		args = append(args, fmt.Sprintf("--initial-cluster=%s", strings.Join(etcdResponse.InitialCluster, ",")))

pkg/constant/constant.go

@@ -27,7 +27,7 @@ const (
 	// CertRootDir defines the root location for all pki related artifacts
 	CertRootDir = "/var/lib/mke/pki"
 	// CertRootDirMode is the expected directory permissions for CertRootDir.
-	CertRootDirMode = 0750
+	CertRootDirMode = 0751
 	//EtcdCertDir contains etcd certificates
 	EtcdCertDir = "/var/lib/mke/pki/etcd"
 	// EtcdCertDirMode is the expected directory permissions for EtcdCertDir