# Gitea Actions runner — host mode (no docker.sock; k3s uses containerd)
# Runner creates Kaniko Jobs in cloudhost-builds for image builds.
#
# Secrets (never commit real values):
#
#   # Registration token: managed as SealedSecret in the cloud-host-gitops repo
#   # (sealed-secrets/gitea-act-runner-token.yaml). To rotate manually:
#   #   token from Gitea UI → Site Administration → Actions → Runners, then:
#   kubectl -n gitea create secret generic gitea-act-runner-token \
#     --from-literal=token='<RUNNER_REGISTRATION_TOKEN>'
#
#   # Egress proxy (copied from cloudhost namespace, needed by the kubectl download):
#   kubectl -n cloudhost get secret registry-egress-proxy -o yaml \
#     | sed 's/namespace: cloudhost/namespace: gitea/' | kubectl apply -f -
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: gitea-act-runner
  namespace: gitea
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: gitea-act-runner
rules:
  - apiGroups: ["batch"]
    resources: ["jobs"]
    verbs: ["create", "get", "watch", "list", "delete"]
  - apiGroups: [""]
    resources: ["pods", "pods/log"]
    verbs: ["get", "watch", "list"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: gitea-act-runner
subjects:
  - kind: ServiceAccount
    name: gitea-act-runner
    namespace: gitea
roleRef:
  kind: ClusterRole
  name: gitea-act-runner
  apiGroup: rbac.authorization.k8s.io
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: gitea-act-runner
  namespace: gitea
spec:
  replicas: 1
  selector:
    matchLabels:
      app: gitea-act-runner
  template:
    metadata:
      labels:
        app: gitea-act-runner
    spec:
      serviceAccountName: gitea-act-runner
      imagePullSecrets:
        - name: registry-pull-secret
      initContainers:
        - name: install-kubectl
          image: registry.abrban.com/abrban/alpine:3
          imagePullPolicy: IfNotPresent
          env:
            - name: HTTPS_PROXY
              valueFrom:
                secretKeyRef:
                  name: registry-egress-proxy
                  key: HTTPS_PROXY
          command:
            - sh
            - -c
            - |
              wget -q "https://dl.k8s.io/release/v1.35.0/bin/linux/amd64/kubectl" -O /tools/kubectl
              chmod +x /tools/kubectl
          volumeMounts:
            - name: tools
              mountPath: /tools
      containers:
        - name: runner
          image: registry.abrban.com/abrban/act-runner:0.2.11
          imagePullPolicy: IfNotPresent
          env:
            - name: GITEA_INSTANCE_URL
              value: http://gitea-http.gitea.svc.cluster.local:3000
            - name: GITEA_RUNNER_REGISTRATION_TOKEN
              valueFrom:
                secretKeyRef:
                  name: gitea-act-runner-token
                  key: token
            - name: GITEA_RUNNER_NAME
              value: k8s-abr-runner
            - name: GITEA_RUNNER_LABELS
              value: abrban-builder:host
          volumeMounts:
            - name: tools
              mountPath: /usr/local/bin/kubectl
              subPath: kubectl
            - name: runner-data
              mountPath: /data
      volumes:
        - name: tools
          emptyDir: {}
        - name: runner-data
          emptyDir: {}