Skip to content

The harvester workers should not run as root #133

Description

@ahaywardtvuk

As part of https://github.com/EOEPCA/system-tasks/issues/69 I'm going through the processes running as root on the EOEPCA dev cluster, which includes these:

Namespace Pod Name Command
registration-harvester-api registration-harvester-worker-landsat-bc8ccb4f8-zjhfw [dpkg-preconfigu]
registration-harvester-api registration-harvester-worker-landsat-bc8ccb4f8-zjhfw /usr/local/bin/python /usr/local/bin/fastapi run src/worker/main.py --port 8080
registration-harvester-api registration-harvester-worker-sentinel-57bd97d595-cn7dk /usr/local/bin/python /usr/local/bin/fastapi run src/worker/main.py --port 8080
registration-harvester-api registration-harvester-worker-stac-86dccb4b9c-skw7m /usr/local/bin/python /usr/local/bin/fastapi run src/worker/main.py --port 8080

To avoid security weaknesses and problems running on platforms with a 'no root' policy, these should run as another user.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions