nextcloud-cron does not work in OpenShift

[antoinetran]

Describe your Issue

In OpenShift kubernetes cluster, with restricted-v2 pod policy, the UID is within a range. The volume data belongs to the first UID of this range, instead of www-data, which will result in a permission error.

Logs and Errors

crond: USER www-data pid 333 cmd php -f /var/www/html/cron.php
crond: can't set groups: Operation not permitted
crond: USER www-data pid 337 cmd php -f /var/www/html/cron.php
crond: can't set groups: Operation not permitted
crond: USER www-data pid 341 cmd php -f /var/www/html/cron.php
crond: can't set groups: Operation not permitted
crond: USER www-data pid 342 cmd php -f /var/www/html/cron.php

Describe your Environment

• Kubernetes distribution:
  OKD 4.15

• Helm Version (or App that manages helm):

• Helm Chart Version:
  nextcloud helm 6.6.7

• values.yaml:

cronjob:
  #enabled: false
  enabled: true
  #securityContext: {}
  securityContext:
    runAsUser: null
    runAsGroup: null
    runAsNonRoot: true

Additional context, if any

Inside the container, some info:

1004080000@my-nextcloud-6b9695ccfb-spplh:/var/www/html$ id
uid=1004080000(1004080000) gid=0(root) groups=0(root),1004080000

1004080000@my-nextcloud-6b9695ccfb-spplh:/var/www/html$ ls -al /var/www/html/cron.php
-rw-r--r--. 1 1004080000 1004080000 7550 May 27 12:50 /var/www/html/cron.php

1004080000@my-nextcloud-6b9695ccfb-spplh:/var/www/html$ cat /etc/passwd | grep -e www-data -e 1004080000
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
1004080000:x:1004080000:0:1004080000 user:/:/sbin/nologin

1004080000@my-nextcloud-6b9695ccfb-spplh:/var/www/html$ cat /var/spool/cron/crontabs/www-data
*/5 * * * * php -f /var/www/html/cron.php

[antoinetran]

Would be fixed if for example the crond is run as CronJob instead of inside a container like #683

[artichoked1]

Is there a fix or workaround for this?

[DreamingRaven]

Just following up on this you can likely solve this with: #740 feel free to re-open if it doesnt work for you

[antoinetran]

Just following up on this you can likely solve this with: #740 feel free to re-open if it doesnt work for you

Hi, I tested #740 . It is better because the cronjob type does not need root. However it does not work because there is a big prerequisite: it requires the nextcloud volume to be attachable to multiple pods at the same time. I got

Warning   FailedAttachVolume       pod/my-nextcloud-cron-29400265-9qkgw      Multi-Attach error for volume "pvc-744fb96b-26ef-4b2d-a552-a2b32f7262cb" Volume is already used by pod(s) my-nextcloud-55c8bbf888-rh9jd-x-nextcloud-x-my-vcluster

In my Kubernetes cluster, the volumes cannot be attached more than once per pod. Probably this has been tested in GCP or other cloud with this ability.

Can you reopen this issue @DreamingRaven ? I do not have the permission.

What I can suggest is:
1/ either change the sidecar image to another cron that does not need root. This is what I have been doing until now:

cronjob:
  enabled: true

  type: sidecar
  sidecar:

    ## Cronjob sidecar resource requests and limits
    ## ref: http://kubernetes.io/docs/user-guide/compute-resources/
    ##
    resources: {}

    # Allow configuration of lifecycle hooks
    # ref: https://kubernetes.io/docs/tasks/configure-pod-container/attach-handler-lifecycle-event/
    lifecycle: {}
      # postStartCommand: []
      # preStopCommand: []
    # Set securityContext parameters. For example, you may need to define runAsNonRoot directive
    #securityContext: {}
    #   runAsUser: 33
    #   runAsGroup: 33
    #   runAsNonRoot: true
    #   readOnlyRootFilesystem: true
    #securityContext: {}
    securityContext:
      runAsUser: null
      runAsGroup: null
      runAsNonRoot: true

    # The command the cronjob container executes.
    command:
    - /bin/bash
    - "-x"
    - "-c"
    - |
      # This is the original content of /var/spool/cron/crontabs/www-data
      cronPath="/var/spool/cron/crontabs/$(id -nu)"
      cat <<EOF >"${cronPath}"
      SHELL=/bin/sh
      */5 * * * * php -f /var/www/html/cron.php
      EOF
      chgrp root "${cronPath}"
      #exec /cron.sh
      #exec busybox crond -f -L /dev/stdout -c /var/spool/cron/crontabs -l0
      cd /var/spool/cron/crontabs
      curl -L -o supercronic https://github.com/aptible/supercronic/releases/download/v0.2.33/supercronic-linux-amd64
      chmod 755 supercronic
      exec ./supercronic --debug "${cronPath}"

2/ Or change the cronjob to NOT need the volume. In fact, we can just do a simple regular curl to nextcloud cron php with its service name (https://docs.nextcloud.com/server/stable/admin_manual/configuration_server/background_jobs_configuration.html#webcron)

[antoinetran]

I can do a PR with either solution, whatever is the best.