fix(worker): mount docker socket when privileged=true

brigade-worker/src/k8s.ts

@@ -245,9 +245,22 @@ export class JobRunner implements jobs.JobRunner {
       this.secret.data["main.sh"] = b64enc(newCmd)
     }
 
+    // If job is privileged, add docker socket and mark pod privileged.
     if (job.privileged) {
+      const sockPath = "/var/run/docker.sock"
+      const sockName = "docker-socket"
+
+      var dockerVol = new kubernetes.V1Volume()
+      dockerVol.name = sockName
+      dockerVol.hostPath = { path: sockPath }
+      this.runner.spec.volumes.push(dockerVol)
+
       for (let i = 0; i < this.runner.spec.containers.length; i++) {
+        var dockerMnt = new kubernetes.V1VolumeMount()
+        dockerMnt.mountPath = sockPath
+        dockerMnt.name = sockName
         this.runner.spec.containers[i].securityContext.privileged = true
+        this.runner.spec.containers[i].volumeMounts.push(dockerMnt)
       }
     }
 

brigade-worker/test/k8s.ts

@@ -224,7 +224,23 @@ describe("k8s", function() {
           let jr = new k8s.JobRunner(j, e, p)
           for (let c of jr.runner.spec.containers) {
             assert.isTrue(c.securityContext.privileged)
+            let foundMnt = false
+            for (let vm of c.volumeMounts) {
+              if (vm.name == "docker-socket") {
+                foundMnt = true
+                assert.equal(vm.mountPath, "/var/run/docker.sock")
+              }
+            }
+            assert.isTrue(foundMnt, "volume mount for docker socket is set")
+          }
+          let foundVol = false
+          for (let vol of jr.runner.spec.volumes) {
+            if (vol.name == "docker-socket") {
+              foundVol = true
+              assert.equal(vol.hostPath.path, "/var/run/docker.sock")
+            }
           }
+          assert.isTrue(foundVol, "found volume")
         })
       })
       context("when image pull secrets are supplied", function() {