111 lines
3.7 KiB
YAML
111 lines
3.7 KiB
YAML
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: {{ .Release.Name }}
|
|
namespace: {{ .Release.Namespace }}
|
|
labels:
|
|
app: {{ .Release.Name }}
|
|
spec:
|
|
replicas: 1
|
|
strategy:
|
|
type: Recreate # RWO PVCs — old pod must terminate before new one mounts them
|
|
selector:
|
|
matchLabels:
|
|
app: {{ .Release.Name }}
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: {{ .Release.Name }}
|
|
spec:
|
|
# runner image runs as UID 1000; fsGroup makes the Longhorn /data PVC
|
|
# group-writable so `register` can write /data/.runner (else permission denied).
|
|
securityContext:
|
|
fsGroup: 1000
|
|
tolerations:
|
|
{{- toYaml .Values.tolerations | nindent 8 }}
|
|
{{- with .Values.nodeSelector }}
|
|
nodeSelector:
|
|
{{- toYaml . | nindent 8 }}
|
|
{{- end }}
|
|
|
|
initContainers:
|
|
- name: register
|
|
image: {{ .Values.runner.image.repository }}:{{ .Values.runner.image.tag }}
|
|
command: ["sh", "-c"]
|
|
args:
|
|
- |
|
|
test -f /data/.runner || forgejo-runner register --no-interactive \
|
|
--instance {{ .Values.runner.forgejoUrl }} \
|
|
--token $(RUNNER_TOKEN) \
|
|
--name {{ .Values.runner.name }} \
|
|
--labels "{{ .Values.runner.labels }}"
|
|
env:
|
|
- name: RUNNER_TOKEN
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: {{ .Values.runner.tokenSecret }}
|
|
key: token
|
|
volumeMounts:
|
|
- name: runner-data
|
|
mountPath: /data
|
|
- name: homelab-ca
|
|
mountPath: /etc/ssl/certs/homelab-ca.pem
|
|
subPath: ca.crt
|
|
workingDir: /data
|
|
|
|
containers:
|
|
- name: runner
|
|
image: {{ .Values.runner.image.repository }}:{{ .Values.runner.image.tag }}
|
|
command: ["sh", "-c", "forgejo-runner daemon"]
|
|
workingDir: /data
|
|
env:
|
|
- name: DOCKER_HOST
|
|
value: tcp://localhost:2376
|
|
- name: DOCKER_TLS_VERIFY
|
|
value: "1"
|
|
- name: DOCKER_CERT_PATH
|
|
value: /docker-certs/client
|
|
volumeMounts:
|
|
- name: runner-data
|
|
mountPath: /data
|
|
- name: docker-certs
|
|
mountPath: /docker-certs
|
|
- name: homelab-ca
|
|
mountPath: /etc/ssl/certs/homelab-ca.pem
|
|
subPath: ca.crt
|
|
resources:
|
|
{{- toYaml .Values.runner.resources | nindent 12 }}
|
|
|
|
- name: dind
|
|
image: {{ .Values.dind.image.repository }}:{{ .Values.dind.image.tag }}
|
|
securityContext:
|
|
privileged: true # required for DinD; cicd namespace is labelled privileged
|
|
env:
|
|
- name: DOCKER_TLS_CERTDIR
|
|
value: /docker-certs
|
|
volumeMounts:
|
|
- name: docker-certs
|
|
mountPath: /docker-certs
|
|
- name: dind-storage
|
|
mountPath: /var/lib/docker
|
|
- name: homelab-ca
|
|
mountPath: /etc/ssl/certs/homelab-ca.pem
|
|
subPath: ca.crt
|
|
resources:
|
|
{{- toYaml .Values.dind.resources | nindent 12 }}
|
|
|
|
volumes:
|
|
- name: runner-data
|
|
persistentVolumeClaim:
|
|
claimName: runner-reg
|
|
- name: dind-storage
|
|
persistentVolumeClaim:
|
|
claimName: runner-dind
|
|
- name: docker-certs
|
|
emptyDir: {} # DinD regenerates mTLS certs on each start
|
|
- name: homelab-ca
|
|
# homelab-ca is a ConfigMap (public CA trust bundle), not a Secret.
|
|
# The volumeMounts use subPath: ca.crt to project the single cert file.
|
|
configMap:
|
|
name: homelab-ca
|