From ea613ef03a2299bf1d5a5d371cc00dd1bdfa3597 Mon Sep 17 00:00:00 2001 From: sHa Date: Sun, 13 Sep 2026 13:14:08 +0300 Subject: [PATCH] Fix garage secret file permissions The secret volume's default file mode (0644) is world-readable, and Garage refuses to start with rpc_secret_file/admin_token_file/ metrics_token_file at anything looser than 0600. Set defaultMode: 0600 on the secrets volume. Co-Authored-By: Claude Sonnet 5 Claude-Session: https://claude.ai/code/session_014ZA4cJygj4VPCYVms4TDrH --- garage/Chart.yaml | 2 +- garage/templates/deployment.yaml | 1 + 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/garage/Chart.yaml b/garage/Chart.yaml index a2dfeff..190a896 100644 --- a/garage/Chart.yaml +++ b/garage/Chart.yaml @@ -4,5 +4,5 @@ description: A Helm chart for Garage, a lightweight S3-compatible object store type: application annotations: version-source: dockerhub-tags-pattern:dxflrs/garage:^v[0-9]+\.[0-9]+\.[0-9]+$ -version: 0.1.1 +version: 0.1.2 appVersion: "v2.4.1" diff --git a/garage/templates/deployment.yaml b/garage/templates/deployment.yaml index fbbe0ae..7b9f550 100644 --- a/garage/templates/deployment.yaml +++ b/garage/templates/deployment.yaml @@ -72,6 +72,7 @@ spec: - name: secrets secret: secretName: {{ .Values.existingSecret }} + defaultMode: 0600 items: - key: {{ .Values.secretKeys.rpcSecret }} path: rpc-secret