Page MenuHomePhabricator

[webservice] php 7.4 containers don't pass through the environment variables to the scripts
Closed, ResolvedPublicBUG REPORT

Description

Steps to replicate the issue (include links if applicable):

  • Create a new php7.4 webservice using the old shared images (not buildservice)
  • Add a script like so:
$ mkdir -p public_html
$ cat > public_html/test.php <<EOS
<?php
echo "PHP: ".getenv("TOOL_TOOLSDB_USER")."\n";
?>
EOS

What happens?:
It shows a null value

What should have happened instead?:
It should have shown the toolsdb user instead

Other information (browser name/version, screenshots, etc.):
The environment variables are set in the container:

tools.jupytest@tools-sgebastion-10:~$ kubectl get pods -o yaml | grep -A 2 TOOL
      - name: TOOL_REPLICA_PASSWORD
        valueFrom:
          secretKeyRef:
            key: TOOL_REPLICA_PASSWORD
            name: toolforge.envvar.v1.tool-replica-password
      - name: TOOL_REPLICA_USER
        valueFrom:
          secretKeyRef:
            key: TOOL_REPLICA_USER
            name: toolforge.envvar.v1.tool-replica-user
      - name: TOOL_TOOLSDB_PASSWORD
        valueFrom:
          secretKeyRef:
            key: TOOL_TOOLSDB_PASSWORD
            name: toolforge.envvar.v1.tool-toolsdb-password
      - name: TOOL_TOOLSDB_USER
        valueFrom:
          secretKeyRef:
            key: TOOL_TOOLSDB_USER
            name: toolforge.envvar.v1.tool-toolsdb-user
      - name: HOME

But they seem to be scrubbed somewhere in between.

Event Timeline

dcaro claimed this task.
dcaro moved this task from Next Up to In Progress on the Toolforge (Toolforge iteration 02) board.

Yep, this is it:
https://gerrit.wikimedia.org/r/plugins/gitiles/operations/software/tools-webservice/+/06e418c6952fcee64d2e63e6d70bdf0dd0c2cad5/toolsws/wstypes/lighttpd.py#609

ENABLE_PHP_CONFIG_TEMPLATE = """
fastcgi.server += ( ".php" =>
        ((
                "bin-path" => "/usr/bin/php-cgi",
                "socket" => "/var/run/lighttpd/php.socket.{toolname}",
                "max-procs" => 2,
                "bin-environment" => (
                        "PHP_FCGI_CHILDREN" => "2",
                        "PHP_FCGI_MAX_REQUESTS" => "500"
                ),
                "bin-copy-environment" => (
                        "PATH", "SHELL", "USER"
                ),
                "broken-scriptfilename" => "enable",
                "allow-x-send-file" => "enable"
         ))
)

bin-copy-environment will remove all the other environment variables and pass through only the given ones.

dcaro changed the task status from Open to In Progress.Jan 4 2024, 11:17 AM
dcaro moved this task from In Progress to In Review on the Toolforge (Toolforge iteration 02) board.

Change 988498 had a related patch set uploaded (by David Caro; author: David Caro):

[operations/docker-images/toollabs-images@master] lighthttpd: don't remove environment vars

https://gerrit.wikimedia.org/r/988498

Change 988498 merged by jenkins-bot:

[operations/docker-images/toollabs-images@master] lighthttpd: don't remove environment vars

https://gerrit.wikimedia.org/r/988498

Mentioned in SAL (#wikimedia-cloud) [2024-01-30T12:39:20Z] <dcaro> rebuilding all the toolforge images (T354320)

This should be sorted out already, did a test in tools to verify:

tools.jupytest@tools-sgebastion-10:~$ cat public_html/test.php 
<?php
echo "PHP: -- ".getenv("TOOL_TOOLSDB_USER")."\n";
?>


tools.jupytest@tools-sgebastion-10:~$ curl --silent https://jupytest.toolforge.org/test.php
PHP: -- s55672
dcaro moved this task from In Progress to Done on the Toolforge (Toolforge iteration 04) board.