Do GitLab Runner worker nodes need to have network access to GitLab?

Question

GitLab runner has an autoscale feature that allows the Runner Manager to dynamically spawn new worker nodes on demand.

The documentation says that: "GitLab Runner is going to need to talk to your GitLab instance over the network". This is obvious to me since the runner needs to download the source code and push build results and artifacts back to GitLab.

Is this required for the Runner Manager only or also for its worker nodes? Do the nodes communicate with GitLab directly or do they only talk to the Runner Manager, which then propagates their results to GitLab?

In other words: With a GitLab instance in my private corporate network and autoscaling GitLab Runner with AWS EC2, do I need to build a VPN between my corporate network and AWS VPC or will it work out of the box?

Answer 1

After performing some experiments: Yes, worker nodes need access to the GitLab instance. (At least on GitLab Runner 14.)

The Runner Manager will just spawn the workers and communication happens directly between the workers and the GitLab instances. When the workers cannot access GitLab, you'll probably see an error message like:

fatal: unable to access 'https://your.gitlab.instance/awesome/project.git/': Could not resolve host: your.gitlab.instance