refactor(k8s): Reorganize into 5-layer structure with production kustomizations

2026-07-16 14:28:19 -07:00
parent a81b9b6169
commit 2d7330798b
214 changed files with 405 additions and 885 deletions
@@ -0,0 +1,100 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ .Release.Name }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app: {{ .Release.Name }}
+spec:
+  replicas: 1
+  strategy:
+    type: Recreate    # RWO PVCs — old pod must terminate before new one mounts them
+  selector:
+    matchLabels:
+      app: {{ .Release.Name }}
+  template:
+    metadata:
+      labels:
+        app: {{ .Release.Name }}
+    spec:
+      tolerations:
+        {{- toYaml .Values.tolerations | nindent 8 }}
+
+      initContainers:
+        - name: register
+          image: {{ .Values.runner.image.repository }}:{{ .Values.runner.image.tag }}
+          command: ["sh", "-c"]
+          args:
+            - |
+              test -f /data/.runner || forgejo-runner register --no-interactive \
+                --instance {{ .Values.runner.forgejoUrl }} \
+                --token $(RUNNER_TOKEN) \
+                --name {{ .Values.runner.name }} \
+                --labels "{{ .Values.runner.labels }}"
+          env:
+            - name: RUNNER_TOKEN
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Values.runner.tokenSecret }}
+                  key: token
+          volumeMounts:
+            - name: runner-data
+              mountPath: /data
+            - name: homelab-ca
+              mountPath: /etc/ssl/certs/homelab-ca.pem
+              subPath: ca.crt
+          workingDir: /data
+
+      containers:
+        - name: runner
+          image: {{ .Values.runner.image.repository }}:{{ .Values.runner.image.tag }}
+          command: ["sh", "-c", "forgejo-runner daemon"]
+          workingDir: /data
+          env:
+            - name: DOCKER_HOST
+              value: tcp://localhost:2376
+            - name: DOCKER_TLS_VERIFY
+              value: "1"
+            - name: DOCKER_CERT_PATH
+              value: /docker-certs/client
+          volumeMounts:
+            - name: runner-data
+              mountPath: /data
+            - name: docker-certs
+              mountPath: /docker-certs
+            - name: homelab-ca
+              mountPath: /etc/ssl/certs/homelab-ca.pem
+              subPath: ca.crt
+          resources:
+            {{- toYaml .Values.runner.resources | nindent 12 }}
+
+        - name: dind
+          image: {{ .Values.dind.image.repository }}:{{ .Values.dind.image.tag }}
+          securityContext:
+            privileged: true    # required for DinD; cicd namespace is labelled privileged
+          env:
+            - name: DOCKER_TLS_CERTDIR
+              value: /docker-certs
+          volumeMounts:
+            - name: docker-certs
+              mountPath: /docker-certs
+            - name: dind-storage
+              mountPath: /var/lib/docker
+            - name: homelab-ca
+              mountPath: /etc/ssl/certs/homelab-ca.pem
+              subPath: ca.crt
+          resources:
+            {{- toYaml .Values.dind.resources | nindent 12 }}
+
+      volumes:
+        - name: runner-data
+          persistentVolumeClaim:
+            claimName: runner-reg
+        - name: dind-storage
+          persistentVolumeClaim:
+            claimName: runner-dind
+        - name: docker-certs
+          emptyDir: {}    # DinD regenerates mTLS certs on each start
+        - name: homelab-ca
+          secret:
+            secretName: homelab-ca