filesystem ownership and permissions for runner user inside containers

[ajitkumarnayak1976]

I am using Terraform and am my terraform creating folder and downloading the required package and then executing the infra set up module. But i am finding that it does not have required permissions and ownership for runners inside the containers. Also, can we set up certificates into runners/containers - Kubernetes so that can validate and execute the terraform apply.

[mumoshu]

@ajitkumarnayak1976 Hey! This sounds like more about Terraform than actions-runner-controller but anyway- the runner use should have enough rw permissions for everything under the runner workdir. Perhaps you should move the terraform workdir to the runner workdir?
If you could give us complete reproduction steps, exact error messages emitted by terraform, or corresponding ls -la output that indicates potential permission issues(are there really any?), it would help further investigation.
Lastly, forgive me for moving this to Discussions as that's what we use for Q/A and user support tickets!

[ajitkumarnayak1976]

Thank you. but is it possible to define volume and mount volume on runner specification as like:
apiVersion: actions.summerwind.dev/v1alpha1
kind: RunnerDeployment
metadata:
name: enterprise-runnerdeploy
spec:
replicas: 3
template:
spec:
dockerdContainerResources:
requests:
cpu: 100m
memory: 128Mi
organization: eks
resources:
requests:
cpu: 100m
memory: 128Mi
labels:
- enterprise-runner
imagePullSecrets:
- name: nexus-de-pullsecret
env: []
# volumeMounts:
# - name: trv-trust-bundle
mountPath: /etc/ssl/certs/
securityContext:
privileged: false
runAsUser: 1000
fsGroup: 1000

i am getting errors as error: error validating "runnerdeployment-Org-Mav.yaml": error validating data: ValidationError(RunnerDeployment.spec.template.spec.volumeMounts[0]): unknown field "securityContext" in dev.summerwind.actions.v1alpha1.RunnerDeployment.spec.template.spec.volumeMounts; if you choose to ignore these errors, turn validation off with --validate=false

[mumoshu]

I thought you'd also need a matching volume under volumes for a volumeMount and volumeMounts isn't pod-level but a container-level field so you might not find it there. Could you try running kubectl explain $CRD_NAME and drill down the API fields so that you'll find appropriate fields?

[samus-aran]

We're locking this discussion because it has not had recent activity and/or other members have asked for more information to assist you but received no response. Thank you for helping us maintain a productive and tidy community for all our members.