Chown workspace for non-root containers

When running jobs on Kubernetes containers instead of the Jenkins built-in node,
containers running as a non-root user have problems cleaning the workspace.
Run chown on jnlp so the workspace matches runAsUser/runAsGroup before forceCleanupWS.

Signed-off-by: Noam Tsemah <ntsemah@nvidia.com>

Author: ntsemah

src/com/mellanox/cicd/Matrix.groovy

@@ -900,8 +900,12 @@ def runK8(image, branchName, config, axis, steps=config.steps) {
     def namespace = image.namespace ?: getConfigVal(config, ['kubernetes', 'namespace'], "default")
     def tolerations = image.tolerations ?: getConfigVal(config, ['kubernetes', 'tolerations'], "[]")
     def imagePullSecrets = parseImagePullSecrets(getConfigVal(config, ['kubernetes', 'imagePullSecrets'], "[]"))
+    def nonRoot = "${runAsUser}" != '0' || "${runAsGroup}" != '0'
+    def fsPolicy = nonRoot ? '\n    fsGroupChangePolicy: OnRootMismatch' : ''
     def yaml = """
 spec:
+  securityContext:
+    fsGroup: ${runAsGroup}${fsPolicy}
   containers:
     - name: ${cname}
       env:
@@ -913,6 +917,8 @@ spec:
         limits: ${limits}
         requests: ${requests}
       securityContext:
+        runAsUser: ${runAsUser}
+        runAsGroup: ${runAsGroup}
         capabilities:
           add: ${caps_add}
   tolerations: ${tolerations}
@@ -940,6 +946,15 @@ spec:
         retry(count: 2, conditions: [kubernetesAgent(), nonresumable()]) {
             node(POD_LABEL) {
                 stage (branchName) {
+                    if (nonRoot) {
+                        container('jnlp') {
+                            sh(script: '''#!/bin/bash
+set -eu
+WS="${WORKSPACE:?}"
+chmod -R g+rwX "${WS}@tmp" "${WS}" 2>/dev/null || true
+''', label: 'k8 chmod workspace for non-root')
+                        }
+                    }
                     container(cname) {
                         runSteps(image, config, branchName, axis, steps, 'k8')
                     }