keyhan
7e66d1edf3
Build and Deploy Platform / build-and-deploy (push) Failing after 20m1s
- Workflow now pushes image tags to the separate cloud-host-gitops repo
(no more CI loop risk) and authenticates via CI_TOKEN secret
- Fix undefined ${REGISTRY} in Kaniko jobs, add concurrency group,
targeted tag update, and mounted kaniko-harbor-auth docker config
- Argo CD Application is now multi-source (chart from cloud-host,
values from cloud-host-gitops)
- Remove plaintext runner token and proxy credentials from manifests;
secrets are now SealedSecrets in the gitops repo
Co-authored-by: Cursor <cursoragent@cursor.com>
111 lines
3.3 KiB
YAML
111 lines
3.3 KiB
YAML
# Gitea Actions runner — host mode (no docker.sock; k3s uses containerd)
|
|
# Runner creates Kaniko Jobs in cloudhost-builds for image builds.
|
|
#
|
|
# Secrets (never commit real values):
|
|
#
|
|
# # Registration token: managed as SealedSecret in the cloud-host-gitops repo
|
|
# # (sealed-secrets/gitea-act-runner-token.yaml). To rotate manually:
|
|
# # token from Gitea UI → Site Administration → Actions → Runners, then:
|
|
# kubectl -n gitea create secret generic gitea-act-runner-token \
|
|
# --from-literal=token='<RUNNER_REGISTRATION_TOKEN>'
|
|
#
|
|
# # Egress proxy (copied from cloudhost namespace, needed by the kubectl download):
|
|
# kubectl -n cloudhost get secret registry-egress-proxy -o yaml \
|
|
# | sed 's/namespace: cloudhost/namespace: gitea/' | kubectl apply -f -
|
|
---
|
|
apiVersion: v1
|
|
kind: ServiceAccount
|
|
metadata:
|
|
name: gitea-act-runner
|
|
namespace: gitea
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRole
|
|
metadata:
|
|
name: gitea-act-runner
|
|
rules:
|
|
- apiGroups: ["batch"]
|
|
resources: ["jobs"]
|
|
verbs: ["create", "get", "watch", "list", "delete"]
|
|
- apiGroups: [""]
|
|
resources: ["pods", "pods/log"]
|
|
verbs: ["get", "watch", "list"]
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRoleBinding
|
|
metadata:
|
|
name: gitea-act-runner
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: gitea-act-runner
|
|
namespace: gitea
|
|
roleRef:
|
|
kind: ClusterRole
|
|
name: gitea-act-runner
|
|
apiGroup: rbac.authorization.k8s.io
|
|
---
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: gitea-act-runner
|
|
namespace: gitea
|
|
spec:
|
|
replicas: 1
|
|
selector:
|
|
matchLabels:
|
|
app: gitea-act-runner
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: gitea-act-runner
|
|
spec:
|
|
serviceAccountName: gitea-act-runner
|
|
imagePullSecrets:
|
|
- name: registry-pull-secret
|
|
initContainers:
|
|
- name: install-kubectl
|
|
image: registry.abrban.com/abrban/alpine:3
|
|
imagePullPolicy: IfNotPresent
|
|
env:
|
|
- name: HTTPS_PROXY
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: registry-egress-proxy
|
|
key: HTTPS_PROXY
|
|
command:
|
|
- sh
|
|
- -c
|
|
- |
|
|
wget -q "https://dl.k8s.io/release/v1.35.0/bin/linux/amd64/kubectl" -O /tools/kubectl
|
|
chmod +x /tools/kubectl
|
|
volumeMounts:
|
|
- name: tools
|
|
mountPath: /tools
|
|
containers:
|
|
- name: runner
|
|
image: registry.abrban.com/abrban/act-runner:0.2.11
|
|
imagePullPolicy: IfNotPresent
|
|
env:
|
|
- name: GITEA_INSTANCE_URL
|
|
value: http://gitea-http.gitea.svc.cluster.local:3000
|
|
- name: GITEA_RUNNER_REGISTRATION_TOKEN
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: gitea-act-runner-token
|
|
key: token
|
|
- name: GITEA_RUNNER_NAME
|
|
value: k8s-abr-runner
|
|
- name: GITEA_RUNNER_LABELS
|
|
value: abrban-builder:host
|
|
volumeMounts:
|
|
- name: tools
|
|
mountPath: /usr/local/bin/kubectl
|
|
subPath: kubectl
|
|
- name: runner-data
|
|
mountPath: /data
|
|
volumes:
|
|
- name: tools
|
|
emptyDir: {}
|
|
- name: runner-data
|
|
emptyDir: {}
|