接入 OpenSandbox 动态 Runner
This commit is contained in:
@@ -0,0 +1,295 @@
|
||||
---
|
||||
apiVersion: sandbox.opensandbox.io/v1alpha1
|
||||
kind: Pool
|
||||
metadata:
|
||||
name: ci-vm
|
||||
namespace: opensandbox
|
||||
labels:
|
||||
app.kubernetes.io/name: gitea-ci-vm
|
||||
app.kubernetes.io/component: runner-pool
|
||||
spec:
|
||||
capacitySpec:
|
||||
bufferMax: 0
|
||||
bufferMin: 0
|
||||
poolMax: 2
|
||||
poolMin: 0
|
||||
recycleStrategy:
|
||||
type: Delete
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/name: gitea-ci-vm
|
||||
ci.ddupan.top/backend: vm
|
||||
spec:
|
||||
runtimeClassName: kata-clh-runtime-rs
|
||||
serviceAccountName: gitea-ci
|
||||
restartPolicy: Never
|
||||
terminationGracePeriodSeconds: 30
|
||||
shareProcessNamespace: true
|
||||
securityContext:
|
||||
fsGroup: 2000
|
||||
fsGroupChangePolicy: OnRootMismatch
|
||||
initContainers:
|
||||
- name: task-executor-installer
|
||||
image: sandbox-registry.cn-zhangjiakou.cr.aliyuncs.com/opensandbox/task-executor:v0.1.0
|
||||
command: [/bin/sh, -c]
|
||||
args:
|
||||
- cp /workspace/server /opt/opensandbox/task-executor && chmod 0755 /opt/opensandbox/task-executor
|
||||
volumeMounts:
|
||||
- name: opensandbox-bin
|
||||
mountPath: /opt/opensandbox
|
||||
- name: execd-installer
|
||||
image: sandbox-registry.cn-zhangjiakou.cr.aliyuncs.com/opensandbox/execd:v1.0.22
|
||||
command: [/bin/sh, -c]
|
||||
args:
|
||||
- cp ./execd /opt/opensandbox/execd && cp ./bootstrap.sh /opt/opensandbox/bootstrap.sh && chmod 0755 /opt/opensandbox/execd /opt/opensandbox/bootstrap.sh
|
||||
volumeMounts:
|
||||
- name: opensandbox-bin
|
||||
mountPath: /opt/opensandbox
|
||||
containers:
|
||||
- name: sandbox
|
||||
image: zot.ad.ddupan.top/panxiao81/gitea-dynamic-runner-runner@sha256:a45875fd2d0e67429b0b7bc3914735581669c705bb4e1a05d712134d2bceb86f
|
||||
imagePullPolicy: IfNotPresent
|
||||
command: [/opt/opensandbox/task-executor]
|
||||
args: [-listen-addr=0.0.0.0:5758, -log-dir=/tmp]
|
||||
env:
|
||||
- name: SANDBOX_MAIN_CONTAINER
|
||||
value: sandbox
|
||||
- name: EXECD_ENVS
|
||||
value: /opt/opensandbox/.env
|
||||
- name: EXECD
|
||||
value: /opt/opensandbox/execd
|
||||
- name: GITEA_INSTANCE_URL
|
||||
value: https://git.ddupan.top
|
||||
- name: HOME
|
||||
value: /data
|
||||
- name: DOCKER_HOST
|
||||
value: unix:///run/docker/docker.sock
|
||||
ports:
|
||||
- name: task-executor
|
||||
containerPort: 5758
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop: [ALL]
|
||||
runAsNonRoot: true
|
||||
runAsUser: 2000
|
||||
runAsGroup: 2000
|
||||
volumeMounts:
|
||||
- name: opensandbox-bin
|
||||
mountPath: /opt/opensandbox
|
||||
- name: runner-data
|
||||
mountPath: /data
|
||||
- name: docker-socket
|
||||
mountPath: /run/docker
|
||||
- name: spire-socket
|
||||
mountPath: /run/spire/agent-sockets
|
||||
- name: spire-agent
|
||||
image: ghcr.io/spiffe/spire-agent:1.15.3@sha256:41b0dcd8b258a69db9e2768292a060766fb76fd866e4bc925849981ea1b825ff
|
||||
args: [-config, /run/spire/config/agent.conf]
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop: [ALL]
|
||||
volumeMounts:
|
||||
- name: spire-config
|
||||
mountPath: /run/spire/config
|
||||
readOnly: true
|
||||
- name: spire-bundle
|
||||
mountPath: /run/spire/bundle
|
||||
readOnly: true
|
||||
- name: spire-token
|
||||
mountPath: /run/spire/tokens
|
||||
readOnly: true
|
||||
- name: spire-data
|
||||
mountPath: /run/spire/data
|
||||
- name: spire-socket
|
||||
mountPath: /run/spire/agent-sockets
|
||||
- name: docker
|
||||
image: docker.io/library/docker:29.1.5-dind
|
||||
command: [/bin/sh, -c]
|
||||
args:
|
||||
- test -e /dev/kmsg || mknod /dev/kmsg c 1 11; exec dockerd --host=unix:///run/docker/docker.sock --group=2000 --storage-driver=overlay2
|
||||
securityContext:
|
||||
privileged: true
|
||||
volumeMounts:
|
||||
- name: docker-socket
|
||||
mountPath: /run/docker
|
||||
- name: docker-data
|
||||
mountPath: /var/lib/docker
|
||||
volumes:
|
||||
- name: opensandbox-bin
|
||||
emptyDir: {}
|
||||
- name: runner-data
|
||||
emptyDir: {}
|
||||
- name: docker-data
|
||||
emptyDir: {}
|
||||
- name: docker-socket
|
||||
emptyDir:
|
||||
medium: Memory
|
||||
- name: spire-data
|
||||
emptyDir:
|
||||
medium: Memory
|
||||
- name: spire-socket
|
||||
emptyDir:
|
||||
medium: Memory
|
||||
- name: spire-config
|
||||
configMap:
|
||||
name: gitea-ci-spire-agent
|
||||
- name: spire-bundle
|
||||
configMap:
|
||||
name: spire-bundle-pem
|
||||
- name: spire-token
|
||||
projected:
|
||||
sources:
|
||||
- serviceAccountToken:
|
||||
audience: spire-server
|
||||
expirationSeconds: 3600
|
||||
path: token
|
||||
---
|
||||
apiVersion: sandbox.opensandbox.io/v1alpha1
|
||||
kind: Pool
|
||||
metadata:
|
||||
name: ci-pod
|
||||
namespace: opensandbox
|
||||
labels:
|
||||
app.kubernetes.io/name: gitea-ci-pod
|
||||
app.kubernetes.io/component: runner-pool
|
||||
spec:
|
||||
capacitySpec:
|
||||
bufferMax: 0
|
||||
bufferMin: 0
|
||||
poolMax: 4
|
||||
poolMin: 0
|
||||
recycleStrategy:
|
||||
type: Delete
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/name: gitea-ci-pod
|
||||
ci.ddupan.top/backend: pod
|
||||
spec:
|
||||
serviceAccountName: gitea-ci
|
||||
restartPolicy: Never
|
||||
terminationGracePeriodSeconds: 30
|
||||
shareProcessNamespace: true
|
||||
securityContext:
|
||||
fsGroup: 2000
|
||||
fsGroupChangePolicy: OnRootMismatch
|
||||
initContainers:
|
||||
- name: task-executor-installer
|
||||
image: sandbox-registry.cn-zhangjiakou.cr.aliyuncs.com/opensandbox/task-executor:v0.1.0
|
||||
command: [/bin/sh, -c]
|
||||
args:
|
||||
- cp /workspace/server /opt/opensandbox/task-executor && chmod 0755 /opt/opensandbox/task-executor
|
||||
volumeMounts:
|
||||
- name: opensandbox-bin
|
||||
mountPath: /opt/opensandbox
|
||||
- name: execd-installer
|
||||
image: sandbox-registry.cn-zhangjiakou.cr.aliyuncs.com/opensandbox/execd:v1.0.22
|
||||
command: [/bin/sh, -c]
|
||||
args:
|
||||
- cp ./execd /opt/opensandbox/execd && cp ./bootstrap.sh /opt/opensandbox/bootstrap.sh && chmod 0755 /opt/opensandbox/execd /opt/opensandbox/bootstrap.sh
|
||||
volumeMounts:
|
||||
- name: opensandbox-bin
|
||||
mountPath: /opt/opensandbox
|
||||
containers:
|
||||
- name: sandbox
|
||||
image: zot.ad.ddupan.top/panxiao81/gitea-dynamic-runner-runner@sha256:a45875fd2d0e67429b0b7bc3914735581669c705bb4e1a05d712134d2bceb86f
|
||||
imagePullPolicy: IfNotPresent
|
||||
command: [/opt/opensandbox/task-executor]
|
||||
args: [-listen-addr=0.0.0.0:5758, -log-dir=/tmp]
|
||||
env:
|
||||
- name: SANDBOX_MAIN_CONTAINER
|
||||
value: sandbox
|
||||
- name: EXECD_ENVS
|
||||
value: /opt/opensandbox/.env
|
||||
- name: EXECD
|
||||
value: /opt/opensandbox/execd
|
||||
- name: GITEA_INSTANCE_URL
|
||||
value: https://git.ddupan.top
|
||||
- name: HOME
|
||||
value: /data
|
||||
- name: DOCKER_HOST
|
||||
value: unix:///run/docker/docker.sock
|
||||
ports:
|
||||
- name: task-executor
|
||||
containerPort: 5758
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop: [ALL]
|
||||
runAsNonRoot: true
|
||||
runAsUser: 2000
|
||||
runAsGroup: 2000
|
||||
volumeMounts:
|
||||
- name: opensandbox-bin
|
||||
mountPath: /opt/opensandbox
|
||||
- name: runner-data
|
||||
mountPath: /data
|
||||
- name: docker-socket
|
||||
mountPath: /run/docker
|
||||
- name: spire-socket
|
||||
mountPath: /run/spire/agent-sockets
|
||||
- name: spire-agent
|
||||
image: ghcr.io/spiffe/spire-agent:1.15.3@sha256:41b0dcd8b258a69db9e2768292a060766fb76fd866e4bc925849981ea1b825ff
|
||||
args: [-config, /run/spire/config/agent.conf]
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop: [ALL]
|
||||
volumeMounts:
|
||||
- name: spire-config
|
||||
mountPath: /run/spire/config
|
||||
readOnly: true
|
||||
- name: spire-bundle
|
||||
mountPath: /run/spire/bundle
|
||||
readOnly: true
|
||||
- name: spire-token
|
||||
mountPath: /run/spire/tokens
|
||||
readOnly: true
|
||||
- name: spire-data
|
||||
mountPath: /run/spire/data
|
||||
- name: spire-socket
|
||||
mountPath: /run/spire/agent-sockets
|
||||
- name: docker
|
||||
image: docker.io/library/docker:29.1.5-dind
|
||||
command: [/bin/sh, -c]
|
||||
args:
|
||||
- test -e /dev/kmsg || mknod /dev/kmsg c 1 11; exec dockerd --host=unix:///run/docker/docker.sock --group=2000 --storage-driver=overlay2
|
||||
securityContext:
|
||||
privileged: true
|
||||
volumeMounts:
|
||||
- name: docker-socket
|
||||
mountPath: /run/docker
|
||||
- name: docker-data
|
||||
mountPath: /var/lib/docker
|
||||
volumes:
|
||||
- name: opensandbox-bin
|
||||
emptyDir: {}
|
||||
- name: runner-data
|
||||
emptyDir: {}
|
||||
- name: docker-data
|
||||
emptyDir: {}
|
||||
- name: docker-socket
|
||||
emptyDir:
|
||||
medium: Memory
|
||||
- name: spire-data
|
||||
emptyDir:
|
||||
medium: Memory
|
||||
- name: spire-socket
|
||||
emptyDir:
|
||||
medium: Memory
|
||||
- name: spire-config
|
||||
configMap:
|
||||
name: gitea-ci-spire-agent
|
||||
- name: spire-bundle
|
||||
configMap:
|
||||
name: spire-bundle-pem
|
||||
- name: spire-token
|
||||
projected:
|
||||
sources:
|
||||
- serviceAccountToken:
|
||||
audience: spire-server
|
||||
expirationSeconds: 3600
|
||||
path: token
|
||||
Reference in New Issue
Block a user