# Gitea Actions runner — host mode (no docker.sock; k3s uses containerd)
# Runner creates Kaniko Jobs in cloudhost-builds for image builds.
apiVersion: v1
kind: Secret
metadata:
  name: gitea-act-runner-token
  namespace: gitea
type: Opaque
stringData:
  token: "nL63VkZEyqpCNFdF3AMM9wzQLdLlATUvXSe5Tj0R"
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: gitea-act-runner
  namespace: gitea
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: gitea-act-runner
rules:
  - apiGroups: ["batch"]
    resources: ["jobs"]
    verbs: ["create", "get", "watch", "list", "delete"]
  - apiGroups: [""]
    resources: ["pods", "pods/log"]
    verbs: ["get", "watch", "list"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: gitea-act-runner
subjects:
  - kind: ServiceAccount
    name: gitea-act-runner
    namespace: gitea
roleRef:
  kind: ClusterRole
  name: gitea-act-runner
  apiGroup: rbac.authorization.k8s.io
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: gitea-act-runner
  namespace: gitea
spec:
  replicas: 1
  selector:
    matchLabels:
      app: gitea-act-runner
  template:
    metadata:
      labels:
        app: gitea-act-runner
    spec:
      serviceAccountName: gitea-act-runner
      imagePullSecrets:
        - name: registry-pull-secret
      initContainers:
        - name: install-kubectl
          image: registry.abrban.com/abrban/alpine:3
          imagePullPolicy: IfNotPresent
          env:
            - name: HTTPS_PROXY
              value: "http://builder:BeeldiOr!12009@45.129.38.203:9911"
          command:
            - sh
            - -c
            - |
              wget -q "https://dl.k8s.io/release/v1.35.0/bin/linux/amd64/kubectl" -O /tools/kubectl
              chmod +x /tools/kubectl
          volumeMounts:
            - name: tools
              mountPath: /tools
      containers:
        - name: runner
          image: registry.abrban.com/abrban/act-runner:0.2.11
          imagePullPolicy: IfNotPresent
          env:
            - name: GITEA_INSTANCE_URL
              value: http://gitea-http.gitea.svc.cluster.local:3000
            - name: GITEA_RUNNER_REGISTRATION_TOKEN
              valueFrom:
                secretKeyRef:
                  name: gitea-act-runner-token
                  key: token
            - name: GITEA_RUNNER_NAME
              value: k8s-abr-runner
            - name: GITEA_RUNNER_LABELS
              value: abrban-builder:host
          volumeMounts:
            - name: tools
              mountPath: /usr/local/bin/kubectl
              subPath: kubectl
            - name: runner-data
              mountPath: /data
      volumes:
        - name: tools
          emptyDir: {}
        - name: runner-data
          emptyDir: {}