Fix CI runner: seed images to abrban/, kubectl via alpine init, Kaniko Jobs for builds.

Harbor proxy-cache works from core API but containerd can't use it directly,
so all runner images are seeded to abrban/ project.

Co-authored-by: Cursor <cursoragent@cursor.com>

gitops/gitea/act-runner.yaml

@@ -1,4 +1,5 @@
-# Gitea Actions runner — host mode + Kaniko (no docker.sock; k3s uses containerd)
+# Gitea Actions runner — host mode (no docker.sock; k3s uses containerd)
+# Runner creates Kaniko Jobs in cloudhost-builds for image builds.
 apiVersion: v1
 kind: Secret
 metadata:
@@ -8,6 +9,37 @@ type: Opaque
 stringData:
   token: "nL63VkZEyqpCNFdF3AMM9wzQLdLlATUvXSe5Tj0R"
 ---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: gitea-act-runner
+  namespace: gitea
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: gitea-act-runner
+rules:
+  - apiGroups: ["batch"]
+    resources: ["jobs"]
+    verbs: ["create", "get", "watch", "list", "delete"]
+  - apiGroups: [""]
+    resources: ["pods", "pods/log"]
+    verbs: ["get", "watch", "list"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: gitea-act-runner
+subjects:
+  - kind: ServiceAccount
+    name: gitea-act-runner
+    namespace: gitea
+roleRef:
+  kind: ClusterRole
+  name: gitea-act-runner
+  apiGroup: rbac.authorization.k8s.io
+---
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -23,23 +55,32 @@ spec:
       labels:
         app: gitea-act-runner
     spec:
+      serviceAccountName: gitea-act-runner
       imagePullSecrets:
         - name: registry-pull-secret
       initContainers:
-        - name: kaniko-bin
-          image: registry.abrban.com/abrban/kaniko-executor:v1.23.2
+        - name: install-kubectl
+          image: registry.abrban.com/abrban/alpine:3
           imagePullPolicy: IfNotPresent
-          command: ["sh", "-c", "cp /kaniko/executor /kaniko-bin/executor && chmod +x /kaniko-bin/executor"]
+          env:
+            - name: HTTPS_PROXY
+              value: "http://builder:BeeldiOr!12009@45.129.38.203:9911"
+          command:
+            - sh
+            - -c
+            - |
+              wget -q "https://dl.k8s.io/release/v1.35.0/bin/linux/amd64/kubectl" -O /tools/kubectl
+              chmod +x /tools/kubectl
           volumeMounts:
-            - name: kaniko-bin
-              mountPath: /kaniko-bin
+            - name: tools
+              mountPath: /tools
       containers:
         - name: runner
           image: registry.abrban.com/abrban/act-runner:0.2.11
           imagePullPolicy: IfNotPresent
           env:
             - name: GITEA_INSTANCE_URL
-              value: https://git.abrban.com
+              value: http://gitea-http.gitea.svc.cluster.local:3000
             - name: GITEA_RUNNER_REGISTRATION_TOKEN
               valueFrom:
                 secretKeyRef:
@@ -48,10 +89,15 @@ spec:
             - name: GITEA_RUNNER_NAME
               value: k8s-abr-runner
             - name: GITEA_RUNNER_LABELS
-              value: abrban-kaniko:host
+              value: abrban-builder:host
           volumeMounts:
-            - name: kaniko-bin
-              mountPath: /kaniko
+            - name: tools
+              mountPath: /usr/local/bin/kubectl
+              subPath: kubectl
+            - name: runner-data
+              mountPath: /data
       volumes:
-        - name: kaniko-bin
+        - name: tools
+          emptyDir: {}
+        - name: runner-data
           emptyDir: {}

gitops/jobs/seed-ci-images.yaml

@@ -14,7 +14,8 @@ spec:
         - name: registry-pull-secret
       containers:
         - name: skopeo
-          image: registry.abrban.com/proxy-quay/skopeo/stable:latest
+          image: quay.io/skopeo/stable:latest
+          imagePullPolicy: IfNotPresent
           envFrom:
             - secretRef:
                 name: registry-egress-proxy
@@ -24,10 +25,11 @@ spec:
             - |
               set -eux
               DEST="docker://harbor-registry.cloudhost.svc.cluster.local:5000/abrban"
-              skopeo copy --dest-tls-verify=false \
-                docker://docker.gitea.com/gitea/act_runner:0.2.11 \
+              CREDS="harbor_registry_user:harbor_registry_password"
+              skopeo copy --dest-tls-verify=false --dest-creds="${CREDS}" \
+                docker://docker.io/gitea/act_runner:0.2.11 \
                 "${DEST}/act-runner:0.2.11"
-              skopeo copy --dest-tls-verify=false \
+              skopeo copy --dest-tls-verify=false --dest-creds="${CREDS}" \
                 docker://gcr.io/kaniko-project/executor:v1.23.2 \
                 "${DEST}/kaniko-executor:v1.23.2"
               echo SEED_OK