Skip to content

Cannot access PodSecurityContext in config.toml

Summary

No matter what I try, I cannot get one of our CIs to work because I cannot set supplementalGroups security context on pod level via the config.toml. I require this urgently because one runner requires an NFS mount which requires the supplemental group for correct access.

Steps to reproduce

Try to find a way to modify the pod security context. Create a runner config which uses a NFS which is only accessible by a certain GID. build container runs as root, but NFS root squash is enabled, so access is denied because supplemental GID is missing.

Actual behavior

Cannot find a way. Build errors out because permission is denied to NFS volume claim

Expected behavior

Pod Security Context can be set. Alternatively, propose a workaround by setting ENV variables or whatever else achieves the same effect to make the NFS mount accessible from within the container.

Environment description

Runner configured on a Openshift 3.9 cluster. anyuid SCC is implemented, all CI runners work except for the one requiring supplemental GIDs

Used GitLab Runner version

11.0.0

Edited by Markus