Problem installing rust on self-hosted kubernetes

[daniel-b2c2]

How are you running Renovate?

Self-hosted Renovate

If you're self-hosting Renovate, tell us which platform (GitHub, GitLab, etc) and which version of Renovate.

Kubernetes, GitHub

Please tell us more about your question or problem

I have a repo with a rust dependency (cargo update) that needs upgrading.

The PR is failing because as part of this process renovate installs rust, and it is this installation of rust that is failing.

I can see the following entry in the logs when an attempt is made to install rust:

"stdout": "[04:47:05.907] INFO (762): Installing tool rust@1.82.0...\ninstalling v2 tool rust v1.82.0\nmkdir: cannot create directory ‘/opt/containerbase/tools/rust/1.82.0’: Permission denied\nmkdir: cannot create directory ‘/opt/containerbase/tools/rust/1.82.0’: Permission denied\ninstall: error: can't write to destination. consider `sudo`.\n[04:47:20.087] ERROR (762): Command failed with exit code 1: /usr/local/containerbase/bin/install-tool.sh rust 1.82.0\n[04:47:20.088] FATAL (762): Install tool rust failed in 14.1s.\n",
         "stderr": "",
         "cmd": "/bin/sh -c install-tool rust 1.82.0",

I have tried to remedy it with the following security context:

    runAsUser: 1001
    runAsGroup: 1002
    fsGroup: 1002

but no luck

The following mounts are present:

    volumeMounts:
      - name: shared-volume
        mountPath: /tmp/renovate/
      - name: shared-volume
        mountPath: /opt/renovate/

these are backed by 5gb of gp2 storage

Logs (if relevant)

Logs

"stdout": "[04:47:05.907] INFO (762): Installing tool rust@1.82.0...\ninstalling v2 tool rust v1.82.0\nmkdir: cannot create directory ‘/opt/containerbase/tools/rust/1.82.0’: Permission denied\nmkdir: cannot create directory ‘/opt/containerbase/tools/rust/1.82.0’: Permission denied\ninstall: error: can't write to destination. consider `sudo`.\n[04:47:20.087] ERROR (762): Command failed with exit code 1: /usr/local/containerbase/bin/install-tool.sh rust 1.82.0\n[04:47:20.088] FATAL (762): Install tool rust failed in 14.1s.\n",
         "stderr": "",
         "cmd": "/bin/sh -c install-tool rust 1.82.0",

[github-actions[bot]]

Hi there,

We need more information about your environment.

Please explain in detail how you are running Renovate. For example:

• Are you running via an official Renovate image, or using the Renovate npm package?
• Which exact image tag are you running?
• Which config/parameters are you using when running the image?
• Which config are you using in your CI/CD pipeline, if relevant?

Thanks, the Renovate team

[daniel-b2c2]

Running in a k8s cluster via a non-overlapping cronjob every 15 minutes.

Official Renovate Image as follows:

    image:
      repository: "renovate/renovate"
      tag: "39.20.3"

Configuration Params:

    env:
      - name: LOG_LEVEL
        value: debug
      - name: RENOVATE_DETECT_HOST_RULES_FROM_ENV
        value: "true"

Persistence:

    volumeMounts:
      - name: shared-volume
        mountPath: /tmp/renovate/
      - name: shared-volume
        mountPath: /opt/renovate/
    persistence:
      storage: 5Gi
      storageClass: gp2

It's not part of a CI/CD Pipeline

Attempted with and without runAs* settings as shown in original post.

Our configuration is very vanilla as renovate has largely 'just worked' out of the box with little configuration, until recently I hadn't even provided the volumeMounts, I added these in as I saw they were recommended via the example kubernetes snippet in the docs.

renovate.json (if interested)

{
  "dependencyDashboard": true,
  "extends": [
    "config:recommended"
  ],
  "prConcurrentLimit": 1,
  "labels": ["library-upgrades"]
}

[viceice]

check v39 breaking changes. primary uid changed

[rarkins]

Yes, find a way to delete/reset those mounted paths and start over for v39

[daniel-b2c2]

Yes that seems to be part of it,

I found the kubernetes cluster I was running in uses a different set of defaults for user, group.

So based on running id inside the docker container and checking the Dockerfile definition I see it closes with USER 12021 with the following settings it 'partially works'. I presume this the primary uid change you are referring to. 👍

securityContext:
    runAsUser: 12021
    runAsGroup: 12021
    fsGroup: 12021

Renovate now shows a different warning: it suggests I'm not running as root and can't run ldconfig, but I can probably take it from here since it has at least generated the lock file.

Will try deleting the PVC

[viceice]

that warning is not from renovate, please provide context, so we can maybe help to solve the cause

[daniel-b2c2]

sure, the warning I'm getting is on the rust installation line still, happens when dealing with any cargo upgrade:

WARNING: failed to run ldconfig. this may happen when not installing as root

Full line containing the warning:

"stdout": "[16:27:38.047] INFO (832): Installing tool rust@1.82.0...\ninstalling v2 tool rust v1.82.0\ninstall: creating uninstall script at /opt/containerbase/tools/rust/1.82.0/lib/rustlib/uninstall.sh\ninstall: installing component 'cargo'\ninstall: installing component 'rust-std-x86_64-unknown-linux-gnu'\ninstall: installing component 'rustc'\ninstall: WARNING: failed to run ldconfig. this may happen when not installing as root. run with --verbose to see the error\n\n    rust installed.\n\nlinking tool rust v1.82.0\ncargo 1.82.0 (8f40fc59f 2024-08-21)\nrustc 1.82.0 (f6e511eec 2024-10-15)\n[16:27:54.922] INFO (832): Install tool rust succeeded in 16.8s.\n",

Cleaned up:

"stdout": "[16:27:38.047] INFO (832): Installing tool rust@1.82.0...
installing v2 tool rust v1.82.0
install: creating uninstall script at /opt/containerbase/tools/rust/1.82.0/lib/rustlib/uninstall.sh
install: installing component 'cargo'
install: installing component 'rust-std-x86_64-unknown-linux-gnu'
install: installing component 'rustc'
install: WARNING: failed to run ldconfig. this may happen when not installing as root. run with --verbose to see the error

    rust installed.
    
    linking tool rust v1.82.0
    cargo 1.82.0 (8f40fc59f 2024-08-21)
    rustc 1.82.0 (f6e511eec 2024-10-15)
    [16:27:54.922] INFO (832): Install tool rust succeeded in 16.8s.