Myasnikov DaniilandClaude Opus 4.6 4b76a93dc1 [linstor-gui] Fix secret mount mode so nginx can read mTLS client certs ...

The linstor-client-tls secret was mounted with defaultMode 0400 and
owned by root, so the nginx process (UID 101) got EACCES on tls.crt
and crash-looped with:

  [emerg] cannot load certificate "/etc/linstor/client/tls.crt":
  BIO_new_file() failed ... Permission denied

Set defaultMode to 0444. The secret volume is pod-local and
readOnlyRootFilesystem is on, so making it world-readable inside the
pod is not a broader disclosure.

Verified on dev10: pod Ready, /healthz 200, /v1/nodes proxied through
mTLS to linstor-controller:3371 returns real node data.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>

2026-04-13 12:41:58 +05:00

..

apps

[virtual-machine] Exclude external VM services from Cilium BPF LB

2026-04-08 15:20:58 +02:00

core

[linstor-gui] Add package for LINBIT linstor-gui web UI

2026-04-13 11:48:35 +05:00

extra

Release v1.2.1 (#2306)

2026-04-02 18:56:08 +02:00

library

[cozy-lib] Add a hexToInt helper

2026-03-19 07:29:50 +03:00

system

[linstor-gui] Fix secret mount mode so nginx can read mTLS client certs

2026-04-13 12:41:58 +05:00

tests/cozy-lib-tests

refactor: replace Helm lookup with valuesFrom mechanism

2026-01-05 16:10:55 +01:00