aaron/infra-core
1
0
Fork 2
Code Issues Pull requests 12 Projects Releases 1 Packages Wiki Activity Actions

HOMELAB-988: fix(forgejo-runner): fsGroup 1000 + defaultMode 0440 for mounts #189

Merged
aaron merged 1 commit from plane/HOMELAB-988-runner-fsgroup into live 2026-04-26 00:23:17 +00:00
Conversation 0 Commits 1 Files changed 1 +7 -2
aaron commented 2026-04-26 00:23:16 +00:00
Owner
Copy link

Follow-up to #188 — the age-key and aws-credentials Secret mounts couldn't be read by the runner user (uid=1000) because they were root-owned with mode 0400. Adding fsGroup=1000 to the Pod securityContext + bumping the file mode to 0440 so group-readable.

Follow-up to #188 — the age-key and aws-credentials Secret mounts couldn't be read by the runner user (uid=1000) because they were root-owned with mode 0400. Adding fsGroup=1000 to the Pod securityContext + bumping the file mode to 0440 so group-readable.
HOMELAB-988: fix(forgejo-runner): fsGroup 1000 + defaultMode 0440 for mounts
Some checks failed
0/0 projects applied successfully.
CI Review / pr-title (pull_request) Has been cancelled
Details
CI Review / helm-validate (pull_request) Has been cancelled
Details
CI Review / ai-review (pull_request) Has been cancelled
Details
Lint & Validate / terraform-validate (pull_request) Has been cancelled
Details
Lint & Validate / yaml-lint (pull_request) Has been cancelled
Details
Lint & Validate / shellcheck (pull_request) Has been cancelled
Details
81d13bc735 
The age-key and aws-credentials Secret volumes in PR-B-2 mounted with mode
0400 owned by root, so the runner user (uid=1000) couldn't read them
("Permission denied" when terraform tries to load them).

Fix: add fsGroup=1000 in the Pod's securityContext (matches runner's gid)
so K8s chgrp's the volume to that group, and bump the file mode to 0440
(owner+group readable) so the runner user gets in via group membership.

Verified post-fix: runner can read both files; FORGEJO_TOKEN env still set;
both standard env paths intact.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
aaron merged commit e282493544 into live 2026-04-26 00:23:17 +00:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
aaron/infra-core!189
No description provided.