fix(ci): mount /docker-certs/client into the build job container

2026-08-21 15:55:23 -07:00
parent 0e6ebe7353
commit 7b265b8338
1 changed files with 11 additions and 3 deletions
@@ -18,10 +18,18 @@ jobs:
    runs-on: docker
    container:
      image: docker:27-cli
-      # The runner's dind sidecar shares the pod network and the mTLS cert
-      # emptyDir, so the daemon is reachable on localhost with the client certs
-      # dind generated at startup.
+      # The runner's dind sidecar shares the pod network, so the daemon is
+      # reachable on localhost -- that part needs no extra config. The mTLS
+      # certs dind generates at startup do NOT come along for free, though:
+      # they live in an emptyDir mounted into the runner/dind containers, not
+      # into containers a workflow spins up. Job containers get no bind mounts
+      # at all unless the path is in the runner's container.valid_volumes
+      # allowlist (empty by default -- confirmed live, this exact mount was
+      # rejected until the runner's Helm chart added a config.yaml scoping
+      # valid_volumes to exactly this path).
      options: --network host
+      volumes:
+        - /docker-certs/client:/docker-certs/client:ro
    env:
      DOCKER_HOST: tcp://localhost:2376
      DOCKER_TLS_VERIFY: "1"