From 4e1e4e6f26758b9b73dfd9f793d88aa86704bd43 Mon Sep 17 00:00:00 2001 From: jgrusewski Date: Thu, 12 Mar 2026 08:52:42 +0100 Subject: [PATCH] fix(argo): set fsGroup=0 for workspace PVC write access across steps Without fsGroup, workspace PVC created by root-running compile step is not writable by other steps. fsGroup=0 ensures all pods in the workflow can write to the shared workspace volume. Co-Authored-By: Claude Opus 4.6 --- infra/k8s/argo/compile-and-train-template.yaml | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/infra/k8s/argo/compile-and-train-template.yaml b/infra/k8s/argo/compile-and-train-template.yaml index 6c5503805..37a8d3967 100644 --- a/infra/k8s/argo/compile-and-train-template.yaml +++ b/infra/k8s/argo/compile-and-train-template.yaml @@ -24,8 +24,10 @@ spec: labels: app.kubernetes.io/part-of: foxhunt app.kubernetes.io/component: compile-and-train - # No pod-level securityContext — compile (ci-builder) and Kaniko need root, - # training steps (foxhunt-training-runtime) run as UID 1000 in the image. + # No runAsUser — compile (ci-builder) needs root, training runtime defaults + # to its image user. fsGroup ensures workspace PVC is writable by all pods. + securityContext: + fsGroup: 0 ttlStrategy: secondsAfterCompletion: 3600 activeDeadlineSeconds: 28800 # 8 hours (compile + full training)