Story Crater Bot
720181c900
- Runner egress: allow 192.168.1.160/32:443. forgejo.riotpiao.com resolves to the ingress LB, inside the 192.168.1.0/24 block the NetworkPolicy denies, so docker push hung until timeout. - dind CA: also mount homelab-ca at /etc/docker/certs.d/forgejo.riotpiao.com/, the path dockerd actually reads for per-registry trust. - Pull secret: dockerconfigjson for the api namespace; /v2/ answers 401. - AppProject: allow the Forgejo repo as a source for api-gw.
57 lines
1.8 KiB
YAML
57 lines
1.8 KiB
YAML
runner:
|
|
image:
|
|
repository: code.forgejo.org/forgejo/runner
|
|
tag: "6" # pin exact release before apply
|
|
name: talos-runner
|
|
labels: "docker:docker://node:22-bookworm"
|
|
# In-cluster Service (:3000) — direct, avoids the ingress/public-hostname hop
|
|
# (the public URL is :443 which forgejo doesn't serve; runner got i/o timeout).
|
|
forgejoUrl: http://forgejo-gitea-http.cicd.svc.cluster.local:3000
|
|
# tokenSecret: name of the K8s Secret that holds the runner registration token
|
|
# created automatically by the helmfile presync hook (see helmfile.yaml.gotmpl)
|
|
tokenSecret: runner-token
|
|
resources:
|
|
requests:
|
|
cpu: 100m
|
|
memory: 256Mi
|
|
limits:
|
|
cpu: "2"
|
|
memory: 4Gi
|
|
|
|
dind:
|
|
image:
|
|
repository: docker
|
|
tag: "27-dind" # pin exact release before apply
|
|
resources:
|
|
requests:
|
|
cpu: 100m
|
|
memory: 256Mi
|
|
limits:
|
|
cpu: "2"
|
|
memory: 4Gi
|
|
|
|
persistence:
|
|
reg:
|
|
storageClass: longhorn # Unified StorageClass (3 replicas)
|
|
size: 1Gi # .runner registration file + config — survives pod restarts
|
|
dind:
|
|
storageClass: longhorn # Unified StorageClass (3 replicas)
|
|
size: 30Gi # docker layer cache — keeps rebuilds fast across restarts
|
|
|
|
tolerations:
|
|
- key: node-role.kubernetes.io/control-plane
|
|
operator: Exists
|
|
effect: NoSchedule
|
|
|
|
# Pin to az-a (talos-cp-1) — sole Longhorn node; RWO PVCs (reg/dind cache) only
|
|
# attach there.
|
|
nodeSelector:
|
|
topology.kubernetes.io/zone: az-a
|
|
|
|
# Egress exceptions. The NetworkPolicy denies the whole LAN /24 by default;
|
|
# this is the one address punched back through, because forgejo.riotpiao.com
|
|
# (the image registry) resolves to the ingress-nginx LoadBalancer.
|
|
# Must match the Cilium LB pool allocation — pool is 192.168.1.160/28.
|
|
egress:
|
|
ingressLoadBalancerIP: 192.168.1.160
|