Populate missing config files when only part of /etc/crowdsec is mounted

[saruprim]

Problem

The container only populates /etc/crowdsec from /staging/etc/crowdsec when both config.yaml and local_api_credentials.yaml are missing:

if [ ! -e "/etc/crowdsec/local_api_credentials.yaml" ] && [ ! -e "/etc/crowdsec/config.yaml" ]; then
    rsync -av --ignore-existing /staging/etc/crowdsec/* /etc/crowdsec
fi

This means that if a user mounts only one of these files, the staging configuration is never copied and the missing file is not created.

Example

A valid use case is running an agent-only container with:

• DISABLE_LOCAL_API=true
• a bind-mounted local_api_credentials.yaml pointing to an external LAPI

For example:

url: http://lapi.example.com:8080
login: my-agent
password: secret

In this scenario, only local_api_credentials.yaml is provided by the user.

Because the file already exists, the condition above evaluates to false, config.yaml is never copied from /staging, and the container later fails because /etc/crowdsec/config.yaml is missing.

Expected behavior

If either config.yaml or local_api_credentials.yaml is missing, the container should populate any missing default configuration files from /staging without overwriting existing ones.

Since rsync is already called with --ignore-existing, it is safe to run even when some configuration files are already present.

One possible fix would be to remove the condition entirely and always execute:

mkdir -p /etc/crowdsec
rsync -av --ignore-existing /staging/etc/crowdsec/ /etc/crowdsec/

[github-actions]

@saruprim: There are no 'kind' label on this PR. You need a 'kind' label to generate the release automatically.

• /kind feature
• /kind enhancement
• /kind refactoring
• /kind fix
• /kind chore
• /kind dependencies

Details

I am a bot created to help the crowdsecurity developers manage community feedback and contributions. You can check out my manifest file to understand my behavior and what I can do. If you want to use this for your project, you can check out the BirthdayResearch/oss-governance-bot repository.

[github-actions]

@saruprim: There are no area labels on this PR. You can add as many areas as you see fit.

• /area agent
• /area local-api
• /area cscli
• /area appsec
• /area security
• /area configuration

Details

I am a bot created to help the crowdsecurity developers manage community feedback and contributions. You can check out my manifest file to understand my behavior and what I can do. If you want to use this for your project, you can check out the BirthdayResearch/oss-governance-bot repository.

[saruprim]

/kind fix

[saruprim]

/area configuration