From 33627573c39472a1366ce742421d01e3d7a6b56d Mon Sep 17 00:00:00 2001 From: panxiao81 Date: Thu, 10 Sep 2026 07:30:09 +0000 Subject: [PATCH] =?UTF-8?q?=E4=BF=AE=E5=A4=8D=20Gitea=20runner=20=E7=9A=84?= =?UTF-8?q?=20DinD=20MTU?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- CHANGELOG.md | 1 + platform/gitea-runner/README.md | 6 ++++++ platform/gitea-runner/values.yaml | 5 +++++ 3 files changed, 12 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 5c98d27..37590cf 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -34,6 +34,7 @@ What changed in this homelab, when, and why. Newest first. | Gitea 1.26 result | Flux 以 Helm revision 16 成功完成 chart `12.6.0` / Gitea `1.26.4-rootless` 的 Recreate upgrade 和 migration 323–330；Pod 内/统一域名 API、临时 branch push/delete、Flux source 及 main/smoke 的全部 CI jobs 均通过，Pod 在约 15 分钟采样中保持零重启，Authelia OIDC init 同步与浏览器交互式管理员登录也已确认成功 | | Gitea 1.27 preparation | 预拉取 `1.27.3-rootless` 并将第二跳 desired state 原子设置为 chart `12.7.0`、显式 image `1.27.3` 和 `suspend: true`；合并只暂停并登记目标，不执行 migration，激活前必须从当前 1.26.4 数据建立新的配套回滚点 | | Gitea 1.27 activation | 按明确决定跳过新的 1.26.4 数据库/PVC 备份，激活变更只移除 HelmRelease 的 `suspend`；接受 migration 失败后不能无损回退到 1.26.4 的风险，现有 1.25.5 本地备份仅能作为会丢失第一跳后状态的灾难恢复点 | +| CI runner network | 修复 Actions job 容器访问 GitHub 超时：k3s Pod MTU 为 1450，而 DinD 动态 bridge 默认为 1500；为 Docker daemon 固定 `--mtu=1450`。隔离测试证明相同 curl 镜像在默认 bridge 超时、在 MTU 1450 bridge 下访问 GitHub 与 API 均约 0.1 秒成功 | ### Incident: Gitea 备份后的恢复命令被 stdin 校验阻塞 diff --git a/platform/gitea-runner/README.md b/platform/gitea-runner/README.md index 6826b12..2d0382c 100644 --- a/platform/gitea-runner/README.md +++ b/platform/gitea-runner/README.md @@ -7,6 +7,12 @@ would still be privileged and is blocked by the node's AppArmor user-namespace policy, so this deployment uses regular DinD instead of weakening that host-wide policy. Only trusted workflows may target this runner. +DinD 显式使用 `--mtu=1450`，与 k3s Pod 的 `eth0` 一致。不要在未验证节点 Pod +MTU 的情况下删除或修改它：DinD 默认创建 MTU 1500 的 Actions bridge，容器虽然 +能够解析 GitHub、甚至建立 TCP 连接，但较大的 TLS 数据包会在嵌套网络路径中丢失， +表现为 `github.com` / `api.github.com` 超时。Pod 网络和 `--network host` 正常不代表 +job bridge 正常。 + The runner is registered at instance scope so it is available to every repository on this Gitea instance. Repository permissions and protected-branch review are therefore the security boundary; do not enable Actions for untrusted repositories. diff --git a/platform/gitea-runner/values.yaml b/platform/gitea-runner/values.yaml index ba1260f..107df4c 100644 --- a/platform/gitea-runner/values.yaml +++ b/platform/gitea-runner/values.yaml @@ -51,3 +51,8 @@ statefulset: repository: docker tag: 29.7.1-dind pullPolicy: IfNotPresent + # k3s uses a 1450-byte pod MTU. Without matching it here, nested Actions + # networks advertise 1500 and GitHub TLS packets disappear on the outer + # overlay path while direct pod traffic remains healthy. + extraArgs: + - --mtu=1450 -- 2.54.0