接入 OpenSandbox 动态 Runner

platform/dynamic-runner/deployment.yaml

@@ -15,44 +15,21 @@ spec:
     spec:
       serviceAccountName: dynamic-runner-controller
       automountServiceAccountToken: false
-      initContainers:
-        - name: fetch-internal-ca
-          image: curlimages/curl:8.16.0@sha256:463eaf6072688fe96ac64fa623fe73e1dbe25d8ad6c34404a669ad3ce1f104b6
-          args:
-            - --fail
-            - --silent
-            - --show-error
-            - --output
-            - /trust/ca.pem
-            - https://bao.ad.ddupan.top:8200/v1/pki/ca/pem
-          securityContext:
-            allowPrivilegeEscalation: false
-            capabilities:
-              drop: [ALL]
-            readOnlyRootFilesystem: true
-            runAsNonRoot: true
-            runAsUser: 101
-            runAsGroup: 102
-            seccompProfile:
-              type: RuntimeDefault
-          volumeMounts:
-            - name: trust
-              mountPath: /trust
       containers:
         - name: controller
-          # Bootstrap import on laptop. Replace with a zot digest after the
-          # repository's image publishing workflow has a dedicated identity.
-          image: gitea-dynamic-runner-controller:0.3.0-bootstrap
-          imagePullPolicy: Never
+          image: zot.ad.ddupan.top/panxiao81/gitea-dynamic-runner-controller@sha256:1e481726cbcf6da50f1ef61aa5a1b070d2859209329842e954463293c27c0e66
+          imagePullPolicy: IfNotPresent
           env:
-            - name: NATS_URL
-              value: tls://nats.ad.ddupan.top:4222
-            - name: NATS_CA_FILE
-              value: /run/trust/ca.pem
-            - name: NATS_PASSWORD_FILE
-              value: /run/dynamic-runner-secrets/nats-password
             - name: WEBHOOK_SECRET_FILE
               value: /run/dynamic-runner-secrets/webhook-secret
+            - name: REGISTRATION_TOKEN_FILE
+              value: /run/dynamic-runner-secrets/token
+            - name: OPENSANDBOX_API
+              value: http://10.60.0.13:8080
+            - name: OPENSANDBOX_API_KEY_FILE
+              value: /run/dynamic-runner-secrets/opensandbox-api-key
+            - name: RUNNER_TOKEN_BASE_URL
+              value: http://192.168.10.127:8787/token
           ports:
             - name: http
               containerPort: 8787
@@ -88,9 +65,6 @@ spec:
             - name: secret
               mountPath: /run/dynamic-runner-secrets
               readOnly: true
-            - name: trust
-              mountPath: /run/trust
-              readOnly: true
       securityContext:
         fsGroup: 65532
         fsGroupChangePolicy: OnRootMismatch
@@ -101,6 +75,3 @@ spec:
           secret:
             secretName: dynamic-runner
             defaultMode: 0400
-        - name: trust
-          emptyDir:
-            sizeLimit: 1Mi