From e7c02bbbed2fee5667340b7dd150101fdfd549f3 Mon Sep 17 00:00:00 2001 From: Konstantin Renner Date: Thu, 14 May 2026 15:05:00 +0200 Subject: [PATCH] libation: use install -m 660 so SQLite migrations can write the DB The bootstrap Secret mounts read-only (defaultMode: 0400), and the init container's plain `cp` was propagating that mode into the libation-config PVC. Result: LibationCli failed on the first scan with "Libation cannot write its SQLite database (migrations need write access)" against /config-internal/LibationContext.db. `install -m 660` sets owner+group rw explicitly; fsGroup 1000 already gives every container gid 1000, so 0660 is enough for the libation container to update both AccountsSettings.json (token refresh) and LibationContext.db (library state) across runs. Co-Authored-By: Claude Opus 4.7 (1M context) --- kubernetes/apps/libation/cronjob.yaml | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) diff --git a/kubernetes/apps/libation/cronjob.yaml b/kubernetes/apps/libation/cronjob.yaml index ca918491..dca6c762 100644 --- a/kubernetes/apps/libation/cronjob.yaml +++ b/kubernetes/apps/libation/cronjob.yaml @@ -50,14 +50,22 @@ spec: command: ["/bin/sh", "-eu", "-c"] args: - | + # `install -m 660` sets read+write for owner and group on + # each file. The bootstrap Secret mount is read-only + # (defaultMode: 0400), so a plain `cp` would propagate + # 0400 and LibationCli's SQLite migrations would fail + # with "cannot write database". fsGroup 1000 on the pod + # gives every container gid 1000, so 0660 + gid 1000 is + # enough for both the init copy and the main libation + # process to read and write the files. if [ -f /libation-state/.bootstrapped ]; then echo "libation-config already bootstrapped; skipping seed" exit 0 fi echo "seeding libation-config from bootstrap secret" - cp /bootstrap/AccountsSettings.json /libation-state/AccountsSettings.json - cp /bootstrap/Settings.json /libation-state/Settings.json - cp /bootstrap/LibationContext.db /libation-state/LibationContext.db + install -m 660 /bootstrap/AccountsSettings.json /libation-state/AccountsSettings.json + install -m 660 /bootstrap/Settings.json /libation-state/Settings.json + install -m 660 /bootstrap/LibationContext.db /libation-state/LibationContext.db touch /libation-state/.bootstrapped ls -la /libation-state volumeMounts: