flux2: flux build/diff: fs-security-constraint error

Describe the bug

When running flux build ..., an error is shown that indicates security issue. For example:

flux build kustomization my-app --path ./corpsol --kustomization-file ./corpsol/kustomization.yaml

will display the following error

✗ kustomize build failed: fs-security-constraint abs ./corpsol: path './corpsol' is not in or below 'C:\'

The kustomization.yaml looks like this

apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- helm-release.yaml
- ../../../../.common/helm_templates/flux_manifests/alert.yaml

Steps to reproduce

  • Install Flux
  • Run flux build kustomization my-app --path ./corpsol --kustomization-file ./corpsol/kustomization.yaml
  • See the error - fs-security-constraint (no files are built)

Expected behavior

The kustomization should be built successfully, so that a preview is shown.

Screenshots and recordings

No response

OS / Distro

Windows 10

Flux version

v0.30.2

Flux check

flux check ► checking prerequisites ✔ Kubernetes 1.22.6 >=1.20.6-0 ► checking controllers ✔ helm-controller: deployment ready ► ghcr.io/fluxcd/helm-controller:v0.21.0 ✔ kustomize-controller: deployment ready ► ghcr.io/fluxcd/kustomize-controller:v0.25.0 ✔ notification-controller: deployment ready ► ghcr.io/fluxcd/notification-controller:v0.23.5 ✔ source-controller: deployment ready ► ghcr.io/fluxcd/source-controller:v0.24.4 ✔ all checks passed

Git provider

No response

Container Registry provider

No response

Additional context

No response

Code of Conduct

  • I agree to follow this project’s Code of Conduct

About this issue

  • Original URL
  • State: closed
  • Created 2 years ago
  • Comments: 18 (7 by maintainers)

Most upvoted comments

okay, with this build it is actually working! sweeeet.

.\flux.exe diff kustomization --path C:\_git\xxx\infrastructure\core\ cluster-base
✓  Kustomization diffing...
► Namespace/yyy drifted

metadata.labels
  + one map entry added:
    test: test

⚠️ identified at least one change, exiting with non-zero exit code
⋊> ~ make build-dev                                                                                         10:14:28
⋊> ~ ./bin/flux diff kustomization ...

The error comes from our own filesystem implementation https://github.com/fluxcd/pkg/blob/main/kustomize/filesys/fs_secure.go