rock
ce154c55e6
Build and push runner images / build-runners (pull_request) Failing after 40s
ROOT CAUSE: Docker socket (/var/run/docker.sock) only existed inside the dind container — the runner container couldn't see it. The runner connected to dind via TCP (tcp://localhost:2376) with TLS. But workflow containers created by the runner had NO way to access the docker daemon: - unix socket not mounted (runner can't see it) - DOCKER_HOST env var not passed (runner.envs not configured) FIX: Share /var/run between dind and runner via emptyDir volume. When dind starts, it creates /var/run/docker.sock in the shared volume. Runner can now see the socket. docker_host: automount in config tells the runner to mount the socket into job containers automatically. Architecture after fix: dind container → creates /var/run/docker.sock → shared emptyDir runner container → sees /var/run/docker.sock → uses automount workflow container → gets /var/run/docker.sock mounted by runner Also removed runner.envs (TCP+TLS approach) — unix socket is simpler and works with automount.
130 lines
4.6 KiB
YAML
130 lines
4.6 KiB
YAML
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: {{ .Release.Name }}
|
|
namespace: {{ .Release.Namespace }}
|
|
labels:
|
|
app: {{ .Release.Name }}
|
|
spec:
|
|
replicas: 1
|
|
strategy:
|
|
type: Recreate # RWO PVCs — old pod must terminate before new one mounts them
|
|
selector:
|
|
matchLabels:
|
|
app: {{ .Release.Name }}
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: {{ .Release.Name }}
|
|
spec:
|
|
# runner image runs as UID 1000; fsGroup makes the Longhorn /data PVC
|
|
# group-writable so `register` can write /data/.runner (else permission denied).
|
|
securityContext:
|
|
fsGroup: 1000
|
|
tolerations:
|
|
{{- toYaml .Values.tolerations | nindent 8 }}
|
|
{{- with .Values.nodeSelector }}
|
|
nodeSelector:
|
|
{{- toYaml . | nindent 8 }}
|
|
{{- end }}
|
|
|
|
initContainers:
|
|
- name: register
|
|
image: {{ .Values.runner.image.repository }}:{{ .Values.runner.image.tag }}
|
|
command: ["sh", "-c"]
|
|
args:
|
|
- |
|
|
test -f /data/.runner || forgejo-runner register --no-interactive \
|
|
--instance {{ .Values.runner.forgejoUrl }} \
|
|
--token $(RUNNER_TOKEN) \
|
|
--name {{ .Values.runner.name }} \
|
|
--labels "{{ .Values.runner.labels }}"
|
|
env:
|
|
- name: RUNNER_TOKEN
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: {{ .Values.runner.tokenSecret }}
|
|
key: token
|
|
volumeMounts:
|
|
- name: runner-data
|
|
mountPath: /data
|
|
- name: homelab-ca
|
|
mountPath: /etc/ssl/certs/homelab-ca.pem
|
|
subPath: ca.crt
|
|
workingDir: /data
|
|
|
|
containers:
|
|
- name: runner
|
|
image: {{ .Values.runner.image.repository }}:{{ .Values.runner.image.tag }}
|
|
command: ["sh", "-c", "forgejo-runner daemon --config /etc/forgejo-runner/config.yaml"]
|
|
workingDir: /data
|
|
env:
|
|
- name: DOCKER_HOST
|
|
value: tcp://localhost:2376
|
|
- name: DOCKER_TLS_VERIFY
|
|
value: "1"
|
|
- name: DOCKER_CERT_PATH
|
|
value: /docker-certs/client
|
|
volumeMounts:
|
|
- name: runner-data
|
|
mountPath: /data
|
|
- name: docker-certs
|
|
mountPath: /docker-certs
|
|
- name: docker-sock
|
|
mountPath: /var/run
|
|
- name: homelab-ca
|
|
mountPath: /etc/ssl/certs/homelab-ca.pem
|
|
subPath: ca.crt
|
|
- name: runner-config
|
|
mountPath: /etc/forgejo-runner
|
|
readOnly: true
|
|
resources:
|
|
{{- toYaml .Values.runner.resources | nindent 12 }}
|
|
|
|
- name: dind
|
|
image: {{ .Values.dind.image.repository }}:{{ .Values.dind.image.tag }}
|
|
securityContext:
|
|
privileged: true # required for DinD; cicd namespace is labelled privileged
|
|
env:
|
|
- name: DOCKER_TLS_CERTDIR
|
|
value: /docker-certs
|
|
volumeMounts:
|
|
- name: docker-certs
|
|
mountPath: /docker-certs
|
|
- name: docker-sock
|
|
mountPath: /var/run
|
|
- name: dind-storage
|
|
mountPath: /var/lib/docker
|
|
- name: homelab-ca
|
|
mountPath: /etc/ssl/certs/homelab-ca.pem
|
|
subPath: ca.crt
|
|
# dockerd resolves per-registry CAs from /etc/docker/certs.d/<host>/
|
|
# before falling back to the system pool. Mounting it here is what
|
|
# makes `docker push forgejo.riotpiao.com/...` trust the homelab CA
|
|
# rather than failing x509: signed by unknown authority.
|
|
- name: homelab-ca
|
|
mountPath: /etc/docker/certs.d/forgejo.riotpiao.com/ca.crt
|
|
subPath: ca.crt
|
|
resources:
|
|
{{- toYaml .Values.dind.resources | nindent 12 }}
|
|
|
|
volumes:
|
|
- name: runner-data
|
|
persistentVolumeClaim:
|
|
claimName: {{ .Release.Name }}-reg
|
|
- name: dind-storage
|
|
persistentVolumeClaim:
|
|
claimName: {{ .Release.Name }}-dind
|
|
- name: docker-certs
|
|
emptyDir: {} # DinD regenerates mTLS certs on each start
|
|
- name: docker-sock
|
|
emptyDir: {} # Shared docker socket between dind and runner
|
|
- name: homelab-ca
|
|
# homelab-ca is a ConfigMap (public CA trust bundle), not a Secret.
|
|
# The volumeMounts use subPath: ca.crt to project the single cert file.
|
|
configMap:
|
|
name: homelab-ca
|
|
- name: runner-config
|
|
configMap:
|
|
name: {{ .Release.Name }}-config
|