The GitHub Actions job "Required Checks" on texera.git/feat/geesefs-helm-packaging has failed. Run started by GitHub user aicam (triggered by aicam).
Head commit for run: 3a7a47bb8bc06bce7e9c08265a26e7e5c6db9753 / ali <[email protected]> feat(k8s): mount LakeFS repos via a per-node mounter so CU pods stay unprivileged Previously each computing-unit (CU) pod ran the GeeseFS FUSE mount itself and so had to be `privileged: true`. A privileged container that runs untrusted user code (Python UDFs) is a container-escape risk whose blast radius is the whole node, and running as non-root does not close it. Move the privileged mount out of the user pod into a trusted, per-node `texera-mounter` DaemonSet: - New `texera-mounter` (bin/mounter/mounter.py + bin/dockerfiles/mounter.dockerfile): a small stdlib-only Python service, one privileged pod per node. On POST /mount it runs GeeseFS (with `allow_other`, since the CU pod's UDF is a different UID) against file-service's JWT S3 proxy and mounts read-only under a per-CU host directory. A reaper unmounts a CU's directory once its pod is gone. - The mount reaches the CU pod via Kubernetes mount propagation: the mounter's hostPath is Bidirectional; the CU pod mounts its per-cuid host subdir HostToContainer, so it only ever sees its own mounts and needs no privilege. - KubernetesClient: CU pods are no longer privileged; they get the propagation volume plus a NODE_IP (downward API) / cuid / mounter-port / in-pod-root env. - DatasetMountManager: instead of exec'ing GeeseFS, it POSTs to the node mounter and waits for the propagated mount to appear. - CU image drops GeeseFS/fuse/setcap; new helm templates (DaemonSet + RBAC) and `mounter` values; kubernetes.conf mounter-port / mounter-host-root. The JWT->file-service-proxy authorization model is unchanged — the mounter holds no credentials and forwards the pod's JWT to GeeseFS. Validated end-to-end on minikube: an unprivileged CU pod (uid 1001, no securityContext) loaded a ~2 GB sharded model from the propagated mount with bit-exact output. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]> Claude-Session: https://claude.ai/code/session_019kk9qbcuFpHjbbGuqcNyTL Signed-off-by: ali <[email protected]> Report URL: https://github.com/apache/texera/actions/runs/29871467249 With regards, GitHub Actions via GitBox
