From 1f8d254037c6e89f06f287feda36ea44edcad790 Mon Sep 17 00:00:00 2001 From: rock Date: Wed, 28 Oct 2026 00:09:24 -0700 Subject: [PATCH] fix(paperless-ai): let the token sidecar read its own key A Secret volume is owned by root and the sidecar runs as 65532, so defaultMode 0400 left it unable to open /var/run/llm-key/key: the container restarted with 'permission denied' on every start and never minted a token. Set mode 0440 and give the pod fsGroup 65532, so the group that owns the volume can read the key while nothing else on the host can. --- k8s/apps/paperless/paperless-ai.yaml | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/k8s/apps/paperless/paperless-ai.yaml b/k8s/apps/paperless/paperless-ai.yaml index 25c9659..81d9e2b 100644 --- a/k8s/apps/paperless/paperless-ai.yaml +++ b/k8s/apps/paperless/paperless-ai.yaml @@ -39,7 +39,10 @@ spec: - name: llm-key secret: secretName: paperless-llm-key - defaultMode: 0400 + # 0440 with the pod's fsGroup. A Secret volume is owned by root, and the + # vendor container runs as 65532, so 0400 left the sidecar unable to read + # its own key: "permission denied" on every start. + defaultMode: 0440 # No init container. The token used to be fetched once at pod start with a # client_credentials grant against a web app, which cannot work: a web app has # no such grant, and even a token that was minted would be dead within the hour @@ -49,6 +52,9 @@ spec: # exchanges it for a token, and rewrites /app/data/llm_token.txt at 80% of the # token lifetime. The vendor image keeps reading CUSTOM_API_KEY_FILE unchanged. # The key is re-read on every mint, so a rotation lands without a restart. + securityContext: + fsGroup: 65532 + fsGroupChangePolicy: OnRootMismatch containers: - name: llm-token-vendor image: forgejo.riotpiao.com/riotpiao-poimen/llm-token-vendor:0.1.0