fix(cloudflared): fsGroup so uid 65532 can read the 0440 credentials Secret #154

Merged

jakman85 merged 1 commits from fix/cloudflared-creds-permission into main

2026-11-08 21:57:47 +00:00

Author	SHA1	Message	Date
jakman85andClaude Opus 5.5	d9ab57f2d1	fix(cloudflared): fsGroup so uid 65532 can read the 0440 credentials Secret gate / gate (pull_request) Successful in 42s Details gate / conformance (pull_request) Skipped Details The pod ran as 65532:65532 with no fsGroup, so the kubelet laid the Secret's credentials.json down root:root 0440 — unreadable to the container. cloudflared logged "permission denied" and then the red-herring "Error locating origin cert". - deployment.yaml: securityContext.fsGroup 65532 (mode stays 0440) - L0 cloudflared-ingress-rules (7): Secret volumes must be readable by the container's run-as uid/groups; mutation self-tested - runbook: permission-denied troubleshooting entry, credential rotation section - decisions/2026-11-08-cloudflared-creds-permission.md Co-Authored-By: Claude Opus 5.5 <[email protected]>	2026-11-08 15:49:56 -06:00

Author

SHA1

Message

Date

jakman85andClaude Opus 5.5

d9ab57f2d1

fix(cloudflared): fsGroup so uid 65532 can read the 0440 credentials Secret

gate / gate (pull_request) Successful in 42s

Details

gate / conformance (pull_request) Skipped

Details

The pod ran as 65532:65532 with no fsGroup, so the kubelet laid the Secret's
credentials.json down root:root 0440 — unreadable to the container. cloudflared
logged "permission denied" and then the red-herring "Error locating origin cert".

- deployment.yaml: securityContext.fsGroup 65532 (mode stays 0440)
- L0 cloudflared-ingress-rules (7): Secret volumes must be readable by the
  container's run-as uid/groups; mutation self-tested
- runbook: permission-denied troubleshooting entry, credential rotation section
- decisions/2026-11-08-cloudflared-creds-permission.md

Co-Authored-By: Claude Opus 5.5 <[email protected]>

2026-11-08 15:49:56 -06:00