Add Gitea Actions runner bootstrap

2026-09-09 17:24:22 +00:00
parent 88a02ababa
commit 6b524fed96
7 changed files with 174 additions and 29 deletions
@@ -0,0 +1,63 @@
+# Gitea Actions runner
+
+This is the bootstrap runner for Gitea Actions. One persistent runner Pod accepts
+up to four jobs; each job runs in a dynamically created container inside a
+rootless Docker-in-Docker daemon. Rootless DinD still requires a privileged Pod
+to create its user namespace, so this runner is restricted to this repository
+and trusted workflows.
+
+The runner registration token is authoritative in OpenBao at
+`kv/k8s/gitea-runner`. External Secrets Operator projects its `token` property to
+the `gitea-runner-token` Secret. Never put the token in this directory or a Helm
+command line.
+
+## Review-first bootstrap
+
+This is a one-time manual deployment because Flux is not installed yet:
+
+1. Merge the reviewed PR.
+2. Create a repository-scoped runner registration token in Gitea.
+3. Store it as the `token` property at `kv/k8s/gitea-runner` without exposing it
+   in shell history:
+
+   ```bash
+   read -rsp 'Runner token: ' runner_token
+   printf '%s' "$runner_token" | bao kv put kv/k8s/gitea-runner token=-
+   unset runner_token
+   ```
+
+4. From the updated `main`, create the namespace and ExternalSecret, then wait
+   for `SecretSynced=True`:
+
+   ```bash
+   KUBECONFIG="$HOME/.kube/config" k3s kubectl apply \
+     -f platform/gitea-runner/namespace.yaml
+   KUBECONFIG="$HOME/.kube/config" k3s kubectl apply \
+     -f platform/gitea-runner/external-secret.yaml
+   KUBECONFIG="$HOME/.kube/config" k3s kubectl wait \
+     --namespace gitea-actions \
+     --for=condition=Ready externalsecret/gitea-runner-token \
+     --timeout=60s
+   ```
+
+5. Install chart `actions` version `0.1.1` from
+   `https://dl.gitea.com/charts/` with this `values.yaml`:
+
+   ```bash
+   helm repo add gitea-charts https://dl.gitea.com/charts/
+   helm repo update gitea-charts
+   helm upgrade --install gitea-actions gitea-charts/actions \
+     --namespace gitea-actions \
+     --version 0.1.1 \
+     --values platform/gitea-runner/values.yaml \
+     --wait --timeout 10m
+   ```
+
+6. Confirm the runner is online, then re-run the queued lint workflow.
+
+Do not deploy from an unmerged feature branch. Do not use `--set` for the token.
+
+The 1 GiB PVC preserves `.runner` identity. Docker image layers are ephemeral;
+the Pod has a 20 GiB ephemeral-storage limit. Terraform apply jobs must use a
+workflow concurrency group because runner capacity does not serialize access to
+a shared state.
@@ -0,0 +1,18 @@
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: gitea-runner-token
+  namespace: gitea-actions
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: openbao
+  target:
+    creationPolicy: Owner
+    name: gitea-runner-token
+  data:
+    - secretKey: token
+      remoteRef:
+        key: k8s/gitea-runner
+        property: token
@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: gitea-actions
@@ -0,0 +1,57 @@
+enabled: true
+
+giteaRootURL: http://gitea-http.gitea.svc.cluster.local:3000
+existingSecret: gitea-runner-token
+existingSecretKey: token
+
+statefulset:
+  replicas: 1
+  timezone: Etc/UTC
+  securityContext:
+    fsGroup: 1000
+  # Chart 0.1.1 applies this block to both runner and DinD containers.
+  resources:
+    requests:
+      cpu: 250m
+      memory: 512Mi
+      ephemeral-storage: 2Gi
+    limits:
+      cpu: "4"
+      memory: 6Gi
+      ephemeral-storage: 20Gi
+  persistence:
+    size: 1Gi
+
+  runner:
+    registry: docker.io
+    repository: gitea/runner
+    tag: 2.3.0
+    pullPolicy: IfNotPresent
+    config: |
+      log:
+        level: info
+      runner:
+        file: .runner
+        capacity: 4
+        timeout: 3h
+        shutdown_timeout: 3h
+        labels:
+          - self-hosted:docker://docker.gitea.com/runner-images:ubuntu-latest
+      cache:
+        enabled: false
+      container:
+        require_docker: true
+        docker_timeout: 300s
+
+  dind:
+    rootless: true
+    uid: 1000
+    registry: docker.io
+    repository: docker
+    tag: 29.7.1-dind-rootless
+    pullPolicy: IfNotPresent
+    extraEnvs:
+      - name: DOCKERD_ROOTLESS_ROOTLESSKIT_NET
+        value: slirp4netns
+      - name: DOCKERD_ROOTLESS_ROOTLESSKIT_MTU
+        value: "65520"