Change:
Since I've been having troubles with installation, I've digged a bit and found out that the permissions inside Kubernetes tarballs changed between 0.16.0 and 0.17.0. I've downloaded both tarballs, extracted them into separate directories and then extracted the Kubernetes server tarballs. This is what I get: I suppose, there has been a concious decision to restrict the world's access to those binaries. However, this breaks the installation routine mentioned above and probably makes life a bit more difficult in several other places. I'd be thankful for a correction if this wasn't intended or a pointer to the appropriate commit it this is legit -- I'd correct the installation.
assigning this to you to decide who the eventual assignee should be :)
Any news on this front? 0.20.1 is still restricted.
Apologies for the issue. It wasn't intentional -- likely an artifact of build scripts being run by different people? I'll check out 0.20.2 as I build it to make sure it has the right perms.
Apologies, but 0.20.2 didn't include fixed permissions. I now understand the issue, : "make release" builds a tarball using the permissions on files in your local git tree. I had "umask 027" set when I cloned, so those in-the-repo files had no world-readable perms. Setting "umask 022" before running "make release" is not enough -- it has to be part of creating the local tree when cloning. I'll update instructions and the next release (20.3 or 21.0) should fix this issue. And longer term, we need to put a bit more effort into releasing from a known-good environment and not rely on a developer's workstation's idiosyncrasies -- sorry this bit you.
I can't repro Trying again a different way, but I don't think the umask before clone should do anything (in particular, umasks aren't "sticky" on files, they're sticky to processes.)
And let's pretend on my personal fork isn't woefully out of date (who uses master on their personal fork? I should really just delete that that thing.) Comment updated.
Ah, I see the problem now. works fine for the server tar, but the full tar also packages examples, etc., and for that, tar tends to just pick up the permissions of the git tree. Got it.
I'll take this. I'm going to write a script to build official bits, and this is easy enough to fix along the way.
Seems not fixed as of Kubernetes 1.0.7
sorry about that. is doing the 1.1.1 release and has been improving release scripts -- is 1.1.1 good re: permissions?
was not built by .
Reassigning to as release-oncall. Quinton, I can mentor or advise as necessary.
And yeah, is fine: There's no real bug here. There was a process issue that occurred with 1.0.7. We can rebuild the binaries if we need to.
FYI, leaving this issue closed, as per 's comment above. If anyone disagrees, please re-open this issue.

Discussion:
<ins> #!/bin/bash # Copyright 2015 The Kubernetes Authors All rights reserved. # # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. # You may obtain a copy of the License at # #     http://www.apache.org/licenses/LICENSE-2.0 # # Unless required by applicable law or agreed to in writing, software # distributed under the License is distributed on an "AS IS" BASIS, # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. # See the License for the specific language governing permissions and # limitations under the License. # Builds an official release based on a git tag, with instructions for # how to proceed after the bits are built. set -o errexit set -o nounset set -o pipefail # Get the md5 (duplicated from common.sh, but don't want to pull in # all of common.sh here) function md5() { if which md5 >/dev/null 2>&1; then md5 -q "$1" else md5sum "$1" | awk '{ print $1 }' fi } # Get the sha1 (duplicated from common.sh, but don't want to pull in # all of common.sh here) function sha1() { if which shasum >/dev/null 2>&1; then shasum -a1 "$1" | awk '{ print $1 }' else sha1sum "$1" | awk '{ print $1 }' fi } declare -r KUBE_GITHUB="https://github.com/GoogleCloudPlatform/kubernetes.git" declare -r KUBE_RELEASE_VERSION=${1-} declare -r KUBE_RELEASE_UMASK=${KUBE_RELEASE_UMASK:-022} VERSION_REGEX="^v(0|[1-9][0-9]*).(0|[1-9][0-9]*).(0|[1-9][0-9]*)$" [[ ${KUBE_RELEASE_VERSION} =~ ${VERSION_REGEX} ]] || { echo "!!! You must specify the version you are releasing in the form of '${VERSION_REGEX}'" >&2 exit 1 } declare -r KUBE_BUILD_DIR="/tmp/kubernetes-release-${KUBE_RELEASE_VERSION}-$(date +%s)" # Set the default umask for the release. This ensures consistency # across our release builds. umask "${KUBE_RELEASE_UMASK}" echo "Cloning ${KUBE_GITHUB} at ${KUBE_RELEASE_VERSION}." echo echo "NOTE: Ignore the deatched HEAD warning you're about to get. We want that." echo git clone ${KUBE_GITHUB} -b "${KUBE_RELEASE_VERSION}" "${KUBE_BUILD_DIR}" # !!! REMINDER !!! # # Past this point, you are dealing with a different release. Don't # assume you're executing code from the same repo as this script is # running in. This needs to be a version agnostic build. echo echo "Cloned, building release." echo cd "${KUBE_BUILD_DIR}" export KUBE_RELEASE_RUN_TESTS=n export KUBE_SKIP_CONFIRMATIONS=y make release if ${KUBE_BUILD_DIR}/cluster/kubectl.sh version | grep Client | grep dirty; then echo "!!! Tag at invalid point, or something else is bad. Build is dirty. Don't push this build." >&2 exit 1 fi ln -s ${KUBE_BUILD_DIR}/_output/release-tars/kubernetes.tar.gz ${KUBE_BUILD_DIR} MD5=$(md5 "${KUBE_BUILD_DIR}/kubernetes.tar.gz") SHA1=$(sha1 "${KUBE_BUILD_DIR}/kubernetes.tar.gz") echo "" echo "Success! You must now do the following: (you may want to cut" echo "  and paste these instructions elsewhere, step 1 can be spammy)" echo "" echo "  1) (cd ${KUBE_BUILD_DIR}; build/push-official-release.sh ${KUBE_RELEASE_VERSION})" echo "  2) Go to https://github.com/GoogleCloudPlatform/kubernetes/releases" echo "     and create a new 'Release ${KUBE_RELEASE_VERSION} Candidate' release" echo "     with the ${KUBE_RELEASE_VERSION} tag. Mark it as a pre-release." echo "  3) Upload the ${KUBE_BUILD_DIR}/kubernetes.tar.gz to GitHub" echo "  4) Use this template for the release:" echo "" echo "## [Documentation](http://releases.k8s.io/${KUBE_RELEASE_VERSION}/docs)" echo "## [Examples](http://releases.k8s.io/${KUBE_RELEASE_VERSION}/examples)" echo "## Changes since <last release> (last PR <last PR>)" echo "" echo "<release notes>" echo "" echo "binary | hash alg | hash" echo "------ | -------- | ----" echo "`kubernetes.tar.gz` | md5 | `${MD5}`" echo "`kubernetes.tar.gz` | sha1 | `${SHA1}`" echo "" echo "     We'll fill in the release notes in the next stage." echo "  5) Ensure all the binaries are in place on GitHub and GCS before cleaning." echo "  6) (cd ${KUBE_BUILD_DIR}; make clean; cd -; rm -rf ${KUBE_BUILD_DIR})" echo "" </ins>

#   DOCKER_MOUNT_ARGS function kube::build::verify_prereqs() { kube::log::status "Verifying Prerequisites...." <ins> kube::build::ensure_tar </ins> if [[ "${1-}" != "clean" ]]; then if [[ -z "$(which docker)" ]]; then

[[ "$(uname)" == "Darwin" ]] } <ins> function kube::build::ensure_tar() { if [[ -n "${TAR:-}" ]]; then return fi # Find gnu tar if it is available, bomb out if not. TAR=tar if which gtar &>/dev/null; then TAR=gtar else if which gnutar &>/dev/null; then TAR=gnutar fi fi if ! "${TAR}" --version | grep -q GNU; then echo "  !!! Cannot find GNU tar. Build on Linux or install GNU tar" echo "      on Mac OS X (brew install gnu-tar)." return 1 fi } </ins> function kube::build::clean_output() { # Clean out the output directory if it exists. if kube::build::has_docker ; then

# Set up the context directory for the kube-build image and build it. function kube::build::build_image() { <ins> kube::build::ensure_tar </ins> local -r build_context_dir="${LOCAL_OUTPUT_IMAGE_STAGING}/${KUBE_BUILD_IMAGE}" kube::build::build_image_cross mkdir -p "${build_context_dir}" <del> tar czf "${build_context_dir}/kube-source.tar.gz" $(kube::build::source_targets) </del> <ins> "${TAR}" czf "${build_context_dir}/kube-source.tar.gz" $(kube::build::source_targets) </ins> kube::version::get_version_vars kube::version::save_version_vars "${build_context_dir}/kube-version-defs"

# of the files to be packaged.  This assumes that ${2}/kubernetes is what is # being packaged. function kube::release::create_tarball() { <ins> kube::build::ensure_tar </ins> local tarfile=$1 local stagingdir=$2 <del> # Find gnu tar if it is available local tar=tar if which gtar &>/dev/null; then tar=gtar else if which gnutar &>/dev/null; then tar=gnutar fi fi local tar_cmd=("$tar" "czf" "${tarfile}" "-C" "${stagingdir}" "kubernetes") if "$tar" --version | grep -q GNU; then tar_cmd=("${tar_cmd[@]}" "--owner=0" "--group=0") else echo "  !!! GNU tar not available.  User names will be embedded in output and" echo "      release tars are not official. Build on Linux or install GNU tar" echo "      on Mac OS X (brew install gnu-tar)" fi "${tar_cmd[@]}" </del> <ins> "${TAR}" czf "${tarfile}" -C "${stagingdir}" kubernetes --owner=0 --group=0 </ins> } # ---------------------------------------------------------------------------

} function kube::release::gcs::stage_and_hash() { <ins> kube::build::ensure_tar </ins> # Split the args into srcs... and dst local -r args=( "$@" ) local -r split=$((${#args[@]}-1)) # Split point for src/dst args

srcdir=$(dirname ${src}) srcthing=$(basename ${src}) mkdir -p ${GCS_STAGE}/${dst} <del> tar c -C ${srcdir} ${srcthing} | tar x -C ${GCS_STAGE}/${dst} </del> <ins> "${TAR}" c -C ${srcdir} ${srcthing} | "${TAR}" x -C ${GCS_STAGE}/${dst} </ins> done }

KUBE_ROOT=$(dirname "${BASH_SOURCE}")/.. source "$KUBE_ROOT/build/common.sh" <ins> if ${KUBE_ROOT}/cluster/kubectl.sh version | grep Client | grep dirty; then echo "!!! Tag at invalid point, or something else is bad. Build is dirty. Don't push this build." >&2 exit 1 fi </ins> kube::release::gcs::release kube::release::gcs::publish_latest_official