fix(radius): run FreeRADIUS from a non-world-writable config dir #1556

2026-11-04T08:05:52Z

claude-bot commented

2026-11-04 08:05:52 +00:00

FreeRADIUS refuses to start when its -d directory is world-writable (Configuration directory /etc/raddb is globally writable. Refusing to start due to insecure configuration.). The kubelet-created root of the projected raddb volume is world-writable, so both freeradius pods crash-loop.

initContainer raddb-copy (same image and Flux marker, same securityContext) copies the projected volume (/etc/raddb-src, read-only) into /run/raddb/raddb on a Memory emptyDir and sets it to 0750.
radiusd, both probes and raddbdir use /run/raddb/raddb; the emptyDir is mounted read-only in the main container.
Config, secret and certificate changes still take effect through the existing Reloader annotations (freeradius-config, radius-secrets, radius-tls).
tests/radius/run.sh now makes the projected mount root world-writable like kubelet and runs the initContainer from the manifest. Against the previous manifest it fails with the error above; with this change all checks pass.

🤖 Generated with Claude Code

FreeRADIUS refuses to start when its `-d` directory is world-writable (`Configuration directory /etc/raddb is globally writable. Refusing to start due to insecure configuration.`). The kubelet-created root of the projected `raddb` volume is world-writable, so both `freeradius` pods crash-loop. - initContainer `raddb-copy` (same image and Flux marker, same securityContext) copies the projected volume (`/etc/raddb-src`, read-only) into `/run/raddb/raddb` on a Memory emptyDir and sets it to `0750`. - radiusd, both probes and `raddbdir` use `/run/raddb/raddb`; the emptyDir is mounted read-only in the main container. - Config, secret and certificate changes still take effect through the existing Reloader annotations (`freeradius-config`, `radius-secrets`, `radius-tls`). - `tests/radius/run.sh` now makes the projected mount root world-writable like kubelet and runs the initContainer from the manifest. Against the previous manifest it fails with the error above; with this change all checks pass. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

claude-bot added 2 commits 2026-11-04 08:05:53 +00:00

fix(radius): run FreeRADIUS from a copied, non-world-writable raddb 1e785e028e

FreeRADIUS refuses a config dir that is globally writable; the kubelet
projected volume root is. Mount it at /etc/raddb-src, copy it into an
emptyDir with an initContainer and run radiusd from the copy. The test
harness now makes the mount world-writable and runs the initContainer
from the manifest.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

fix(radius): idempotent raddb copy in the init container

ci/woodpecker/pr/ci-manifests-test Pipeline was successful

Details

ci/woodpecker/pr/ci-scripts-test Pipeline was successful

Details

61fc16ff67

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

k.renner merged commit 7798a17ba5 into main

2026-11-04 08:08:25 +00:00

hermes-bot referenced this pull request

2026-11-04 08:21:17 +00:00

Alert monitor: noise log #326

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: konairius/homelab#1556