Compressed pod log files default to 644 permissions

[ksmith4616]

What happened?

When the pod logs rotate and get compressed, the gzipped file defaults to the permissions of 644. With the directories set to 755 this allows the logs to be world readable at that point.

This appears to be where this issue is happening at - https://github.com/kubernetes/kubernetes/blob/master/pkg/kubelet/logs/container_log_manager.go#L422

What did you expect to happen?

For the compressed logs to either inherit the original log file permissions (600) or for this file permission to be configurable in the kubelet configuration

How can we reproduce it (as minimally and precisely as possible)?

Generate logs & wait until they compress - https://kubernetes.io/docs/concepts/cluster-administration/logging/#basic-logging-in-kubernetes

Anything else we need to know?

No response

Kubernetes version

$ kubectl version
Client Version: v1.30.9
Kustomize Version: v5.0.4-0.20230601165947-6ce0bf390ce3
Server Version: v1.30.2

Cloud provider

OS version

# On Linux:
$ cat /etc/os-release
Rocky Linux 9.5
Version = 9.20250121.0.5 (Blue Onyx)
$ uname -a
5.14.0-503.21.1.el9_5.x86_64

# On Windows:
C:\> wmic os get Caption, Version, BuildNumber, OSArchitecture
# paste output here

Install tools

Container runtime (CRI) and version (if applicable)

Related plugins (CNI, CSI, ...) and versions (if applicable)

[kannon92]

/sig node

[niranjandarshann]

In environments containers, where logs may need to be accessed by multiple users or processes (such as for debugging or operational monitoring), 0644 ensures the file is readable by any user on the same machine, while still ensuring that only the owner can modify the file. Other users that are part of the same group or have general access to the system can read the logs without modifying them.

The above reason, i think 0600 is not given as permission because only owner will have rw permission even read permission is not given to group.
WDYT about 0600 permission why it should be ?

[AnishShah]

sig-node CI meeting notes:

• Is this permission the same as uncompressed logs?

[simonfogliato]

/assign

[ksmith4616]

Sorry for the delay in response. For my system I see the uncompressed logs as 0600, but once they go through compression they get assigned with 0644 -

-rw-------. 1 root root 9446029 Jan 25 06:59 0.log
-rw-r--r--. 1 root root 842586 Jan 24 11:57 0.log.20250123-145214.gz
-rw-------. 1 root root 10488863 Jan 24 11:57 0.log.20250124-115712
-rw-------. 1 root root 24136 Jan 25 07:22 1.log

[ffromani]

/triage accepted

[SergeyKanzhelev]

/priority backlog