Merge pull request '彻底删除旧静态 Gitea Runner' (#130) from retire/static-gitea-runner-phase2 into main

2026-09-21 10:23:05 +00:00
parent b0791e4095 bb24c76704
commit 47ff73cefb
11 changed files with 0 additions and 312 deletions
@@ -1,14 +0,0 @@
-apiVersion: kustomize.toolkit.fluxcd.io/v1
-kind: Kustomization
-metadata:
-  name: gitea-actions
-  namespace: flux-system
-spec:
-  interval: 10m
-  path: ./platform/gitea-runner
-  prune: true
-  sourceRef:
-    kind: GitRepository
-    name: flux-system
-  timeout: 3m
-  wait: false
@@ -7,7 +7,6 @@ resources:
  - apps/envoy-gateway.yaml
  - apps/external-secrets.yaml
  - apps/gitea.yaml
-  - apps/gitea-actions.yaml
  - apps/http-echo.yaml
  - apps/openebs.yaml
  - apps/nats.yaml
@@ -1,114 +0,0 @@
-# Gitea Actions runner
-
-This is the bootstrap runner for Gitea Actions. One persistent runner Pod accepts
-up to four jobs; each job runs in a dynamically created container inside a
-Docker-in-Docker daemon. The official chart runs DinD privileged. Rootless DinD
-would still be privileged and is blocked by the node's AppArmor user-namespace
-policy, so this deployment uses regular DinD instead of weakening that host-wide
-policy. Only trusted workflows may target this runner.
-
-DinD 同时使用 `--mtu=1450` 和
-`--default-network-opt=bridge=com.docker.network.driver.mtu=1450`，与 k3s Pod 的
-`eth0` 一致。前者只覆盖 Docker 默认 bridge；act 为每个 job 创建 user-defined
-bridge，必须由后者设置默认 MTU。不要在未验证节点 Pod MTU 的情况下删除或修改这
-两个参数：MTU 1500 的 job 容器虽然能够解析 GitHub、甚至建立 TCP 连接，但较大的
-TLS 数据包会在嵌套网络路径中丢失，表现为 `github.com` / `api.github.com` 超时或
-`setup-go` 每次请求卡满 6 分钟后重试。Pod 网络和默认 Docker bridge 正常不代表
-Actions job bridge 正常。
-
-The runner is registered at instance scope so it is available to every repository
-on this Gitea instance. Repository permissions and protected-branch review are
-therefore the security boundary; do not enable Actions for untrusted repositories.
-
-The runner registration token is authoritative in OpenBao at
-`kv/k8s/gitea-runner`. External Secrets Operator projects its `token` property to
-the `gitea-runner-token` Secret. Never put the token in this directory or a Helm
-command line.
-
-## SPIRE 与 OCI 发布
-
-runner Pod 使用专用 ServiceAccount `gitea-actions`，并由精确匹配 namespace、
-ServiceAccount 隐含的 Pod、以及 chart labels 的 `ClusterSPIFFEID` 获得：
-
-```text
-spiffe://ddupan.top/ci/gitea-actions
-```
-
-SPIFFE CSI socket 同时只读挂载到 runner 和 DinD。act 的 volume allowlist 只允许
-`/run/spire/agent-sockets`；workflow 仍必须在 job container 中显式请求该 bind
-mount。原因是 bind mount 由 DinD 内的 dockerd 解析，只挂 runner 容器无法让 job
-访问 Workload API。
-
-该身份不是通用 registry 管理员。zot 只对明确列出的 CI 镜像仓库授予
-`read/create/update`，不授予 delete 或其他仓库写入。workflow 应获取
-`aud=zot` 的短期 JWT-SVID，并经 stdin 传给 registry client，不得把 JWT、X.509
-SVID 或 Docker auth 写入 workspace/artifact。
-
-## Flux 接管状态
-
-该 release 最初通过下述 review-first 流程手动 bootstrap。下一个 GitOps 阶段将
-使用 Flux `HelmRelease` 接管它，并首先固定现有 chart `0.1.1`，不在接管 PR 中升级。
-
-迁移前审计发现：Helm 保存的 user-supplied values 和 release manifest 仍描述失败的
-rootless DinD 尝试，但 live StatefulSet 与本目录 `values.yaml` 都已经使用 regular
-DinD。首次 reconcile 的验收条件是修正 Helm 存储状态，同时 live Pod spec、PVC
-identity、runner capacity 和在线状态保持不变。接管稳定后再用独立 PR 升级 chart。
-
-接管分两阶段：第一阶段提交 `suspend: true` 的 HelmRelease、HelmRepository 和由
-`values.yaml` 生成的 ConfigMap。Flux 只登记这些对象，不执行 Helm action。合并后
-检查 HelmRepository Ready，并用固定 chart 重复比较期望清单与 live StatefulSet；
-第二阶段解除 suspend。第一阶段已经确认 source Ready、完整 chart render 与 live
-资源零差异，且登记过程中现有 runner 没有 rollout。失败重试使用
-`RetryOnFailure`，不会用 stored rootless release 做 rollback。
-
-## 历史 review-first bootstrap
-
-这是 Flux 安装前执行过的一次性手动部署流程，保留用于恢复和审计：
-
-1. Merge the reviewed PR.
-2. As a Gitea site administrator, create an instance-scoped runner registration
-   token under **Site Administration → Actions → Runners**.
-3. Store it as the `token` property at `kv/k8s/gitea-runner` without exposing it
-   in shell history:
-
-   ```bash
-   read -rsp 'Runner token: ' runner_token
-   printf '%s' "$runner_token" | bao kv put kv/k8s/gitea-runner token=-
-   unset runner_token
-   ```
-
-4. From the updated `main`, create the namespace and ExternalSecret, then wait
-   for `SecretSynced=True`:
-
-   ```bash
-   KUBECONFIG="$HOME/.kube/config" k3s kubectl apply \
-     -f platform/gitea-runner/namespace.yaml
-   KUBECONFIG="$HOME/.kube/config" k3s kubectl apply \
-     -f platform/gitea-runner/external-secret.yaml
-   KUBECONFIG="$HOME/.kube/config" k3s kubectl wait \
-     --namespace gitea-actions \
-     --for=condition=Ready externalsecret/gitea-runner-token \
-     --timeout=60s
-   ```
-
-5. Install chart `actions` version `0.1.1` from
-   `https://dl.gitea.com/charts/` with this `values.yaml`:
-
-   ```bash
-   helm repo add gitea-charts https://dl.gitea.com/charts/
-   helm repo update gitea-charts
-   helm upgrade --install gitea-actions gitea-charts/actions \
-     --namespace gitea-actions \
-     --version 0.1.1 \
-     --values platform/gitea-runner/values.yaml \
-     --wait --timeout 10m
-   ```
-
-6. Confirm the runner is online, then re-run the queued lint workflow.
-
-Do not deploy from an unmerged feature branch. Do not use `--set` for the token.
-
-The 1 GiB PVC preserves `.runner` identity. Docker image layers are ephemeral;
-the Pod has a 20 GiB ephemeral-storage limit. Terraform apply jobs must use a
-workflow concurrency group because runner capacity does not serialize access to
-a shared state.
@@ -1,17 +0,0 @@
-apiVersion: spire.spiffe.io/v1alpha1
-kind: ClusterSPIFFEID
-metadata:
-  name: gitea-actions
-spec:
-  className: spire-mgmt-spire
-  spiffeIDTemplate: spiffe://{{ .TrustDomain }}/ci/gitea-actions
-  namespaceSelector:
-    matchLabels:
-      kubernetes.io/metadata.name: gitea-actions
-  podSelector:
-    matchLabels:
-      app.kubernetes.io/instance: gitea-actions
-      app.kubernetes.io/name: actions-runner
-  workloadSelectorTemplates:
-    - k8s:ns:gitea-actions
-    - k8s:sa:gitea-actions
@@ -1,18 +0,0 @@
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: gitea-runner-token
-  namespace: gitea-actions
-spec:
-  refreshInterval: 1h
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: openbao
-  target:
-    creationPolicy: Owner
-    name: gitea-runner-token
-  data:
-    - secretKey: token
-      remoteRef:
-        key: k8s/gitea-runner
-        property: token
@@ -1,31 +0,0 @@
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: gitea-actions
-  namespace: gitea-actions
-spec:
-  chart:
-    spec:
-      chart: actions
-      interval: 1h
-      sourceRef:
-        kind: HelmRepository
-        name: gitea-charts
-      version: 0.1.1
-  driftDetection:
-    mode: enabled
-  install:
-    strategy:
-      name: RetryOnFailure
-      retryInterval: 5m
-  interval: 30m
-  releaseName: gitea-actions
-  targetNamespace: gitea-actions
-  timeout: 10m
-  upgrade:
-    strategy:
-      name: RetryOnFailure
-      retryInterval: 5m
-  valuesFrom:
-    - kind: ConfigMap
-      name: gitea-actions-values
@@ -1,8 +0,0 @@
-apiVersion: source.toolkit.fluxcd.io/v1
-kind: HelmRepository
-metadata:
-  name: gitea-charts
-  namespace: gitea-actions
-spec:
-  interval: 1h
-  url: https://dl.gitea.com/charts/
@@ -1,18 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-generatorOptions:
-  disableNameSuffixHash: true
-  labels:
-    reconcile.fluxcd.io/watch: Enabled
-configMapGenerator:
-  - name: gitea-actions-values
-    namespace: gitea-actions
-    files:
-      - values.yaml=values.yaml
-resources:
-  - namespace.yaml
-  - serviceaccount.yaml
-  - clusterspiffeid.yaml
-  - external-secret.yaml
-  - helmrepository.yaml
-  - helmrelease.yaml
@@ -1,4 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: gitea-actions
@@ -1,6 +0,0 @@
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: gitea-actions
-  namespace: gitea-actions
-automountServiceAccountToken: false
@@ -1,81 +0,0 @@
-enabled: true
-
-giteaRootURL: http://gitea-http.gitea.svc.cluster.local:3000
-existingSecret: gitea-runner-token
-existingSecretKey: token
-
-statefulset:
-  replicas: 0
-  timezone: Etc/UTC
-  serviceAccountName: gitea-actions
-  extraVolumes:
-    - name: spiffe-workload-api
-      csi:
-        driver: csi.spiffe.io
-        readOnly: true
-  securityContext:
-    fsGroup: 1000
-  # Chart 0.1.1 applies this block to both runner and DinD containers.
-  resources:
-    requests:
-      cpu: 250m
-      memory: 512Mi
-      ephemeral-storage: 2Gi
-    limits:
-      cpu: "4"
-      memory: 6Gi
-      ephemeral-storage: 20Gi
-  persistence:
-    size: 1Gi
-
-  runner:
-    registry: docker.io
-    repository: gitea/runner
-    tag: 2.3.0
-    pullPolicy: IfNotPresent
-    extraVolumeMounts:
-      - name: spiffe-workload-api
-        mountPath: /run/spire/agent-sockets
-        readOnly: true
-    config: |
-      log:
-        level: info
-      runner:
-        file: .runner
-        capacity: 4
-        timeout: 3h
-        shutdown_timeout: 3h
-        labels:
-          - self-hosted:docker://docker.gitea.com/runner-images:ubuntu-latest
-      cache:
-        enabled: false
-      container:
-        require_docker: true
-        docker_timeout: 300s
-        # Workflows must still request this exact bind mount explicitly. The
-        # allowlist prevents arbitrary host paths from reaching job containers.
-        valid_volumes:
-          - /run/spire/agent-sockets
-
-  dind:
-    # The node enforces AppArmor's unprivileged-userns restriction, which blocks
-    # rootlesskit even though this chart must run DinD privileged either way.
-    rootless: false
-    registry: docker.io
-    repository: docker
-    tag: 29.7.1-dind
-    pullPolicy: IfNotPresent
-    # Bind mounts are resolved by dockerd, so the CSI socket must exist in the
-    # DinD container as well as in the runner container.
-    extraVolumeMounts:
-      - name: spiffe-workload-api
-        mountPath: /run/spire/agent-sockets
-        readOnly: true
-    # k3s uses a 1450-byte pod MTU. Without matching it here, nested Actions
-    # networks advertise 1500 and GitHub TLS packets disappear on the outer
-    # overlay path while direct pod traffic remains healthy.
-    extraArgs:
-      - --mtu=1450
-      # --mtu only changes Docker's default bridge. act creates a user-defined
-      # bridge per job, so give every new bridge the same explicit default.
-      - --default-network-opt=bridge=com.docker.network.driver.mtu=1450