Fix CI runner: seed images to abrban/, kubectl via alpine init, Kaniko Jobs for builds.

Harbor proxy-cache works from core API but containerd can't use it directly,
so all runner images are seeded to abrban/ project.

Co-authored-by: Cursor <cursoragent@cursor.com>

gitops/gitea/act-runner.yaml

@@ -1,4 +1,5 @@
-# Gitea Actions runner — host mode + Kaniko (no docker.sock; k3s uses containerd)
+# Gitea Actions runner — host mode (no docker.sock; k3s uses containerd)
+# Runner creates Kaniko Jobs in cloudhost-builds for image builds.
 apiVersion: v1
 kind: Secret
 metadata:
@@ -8,6 +9,37 @@ type: Opaque
 stringData:
   token: "nL63VkZEyqpCNFdF3AMM9wzQLdLlATUvXSe5Tj0R"
 ---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: gitea-act-runner
+  namespace: gitea
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: gitea-act-runner
+rules:
+  - apiGroups: ["batch"]
+    resources: ["jobs"]
+    verbs: ["create", "get", "watch", "list", "delete"]
+  - apiGroups: [""]
+    resources: ["pods", "pods/log"]
+    verbs: ["get", "watch", "list"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: gitea-act-runner
+subjects:
+  - kind: ServiceAccount
+    name: gitea-act-runner
+    namespace: gitea
+roleRef:
+  kind: ClusterRole
+  name: gitea-act-runner
+  apiGroup: rbac.authorization.k8s.io
+---
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -23,23 +55,32 @@ spec:
       labels:
         app: gitea-act-runner
     spec:
+      serviceAccountName: gitea-act-runner
       imagePullSecrets:
         - name: registry-pull-secret
       initContainers:
-        - name: kaniko-bin
-          image: registry.abrban.com/abrban/kaniko-executor:v1.23.2
+        - name: install-kubectl
+          image: registry.abrban.com/abrban/alpine:3
           imagePullPolicy: IfNotPresent
-          command: ["sh", "-c", "cp /kaniko/executor /kaniko-bin/executor && chmod +x /kaniko-bin/executor"]
+          env:
+            - name: HTTPS_PROXY
+              value: "http://builder:BeeldiOr!12009@45.129.38.203:9911"
+          command:
+            - sh
+            - -c
+            - |
+              wget -q "https://dl.k8s.io/release/v1.35.0/bin/linux/amd64/kubectl" -O /tools/kubectl
+              chmod +x /tools/kubectl
           volumeMounts:
-            - name: kaniko-bin
-              mountPath: /kaniko-bin
+            - name: tools
+              mountPath: /tools
       containers:
         - name: runner
           image: registry.abrban.com/abrban/act-runner:0.2.11
           imagePullPolicy: IfNotPresent
           env:
             - name: GITEA_INSTANCE_URL
-              value: https://git.abrban.com
+              value: http://gitea-http.gitea.svc.cluster.local:3000
             - name: GITEA_RUNNER_REGISTRATION_TOKEN
               valueFrom:
                 secretKeyRef:
@@ -48,10 +89,15 @@ spec:
             - name: GITEA_RUNNER_NAME
               value: k8s-abr-runner
             - name: GITEA_RUNNER_LABELS
-              value: abrban-kaniko:host
+              value: abrban-builder:host
           volumeMounts:
-            - name: kaniko-bin
-              mountPath: /kaniko
+            - name: tools
+              mountPath: /usr/local/bin/kubectl
+              subPath: kubectl
+            - name: runner-data
+              mountPath: /data
       volumes:
-        - name: kaniko-bin
+        - name: tools
+          emptyDir: {}
+        - name: runner-data
           emptyDir: {}