panxiao81/homelab-infra
1
0
Fork 0
Code Issues 10 Pull Requests Actions Packages Projects Releases Wiki Activity

避免动态 Runner 凭据覆盖服务账号令牌路径 #71

Merged
panxiao81 merged 1 commits from fix/dynamic-runner-secret-mount into main 2026-09-16 15:25:04 +00:00
Conversation 0 Commits 1 Files Changed 2
+5 -5
panxiao81 commented 2026-09-16 15:24:31 +00:00
Owner
Copy Link
Copy Source

Alpine 中 /var/run 指向 /run。原有业务 Secret 挂载到 /run/secrets 后，会遮蔽 Kubernetes 默认 projected ServiceAccount token 的 /var/run/secrets/kubernetes.io/serviceaccount 路径；由于 Secret volume 只读，kubelet 无法补建子目录，Pod 在 OCI runtime 阶段启动失败。

将 controller 和 Pod worker 的业务凭据迁移到 /run/dynamic-runner-secrets，与 Kubernetes 标准 token 路径隔离。

验证：k3s kubectl kustomize platform/dynamic-runner 成功。

Alpine 中 `/var/run` 指向 `/run`。原有业务 Secret 挂载到 `/run/secrets` 后，会遮蔽 Kubernetes 默认 projected ServiceAccount token 的 `/var/run/secrets/kubernetes.io/serviceaccount` 路径；由于 Secret volume 只读，kubelet 无法补建子目录，Pod 在 OCI runtime 阶段启动失败。 将 controller 和 Pod worker 的业务凭据迁移到 `/run/dynamic-runner-secrets`，与 Kubernetes 标准 token 路径隔离。 验证：`k3s kubectl kustomize platform/dynamic-runner` 成功。
panxiao81 added 1 commit 2026-09-16 15:24:32 +00:00
避免动态 Runner 凭据覆盖服务账号令牌路径
yaml / yaml (pull_request) Successful in 11s
Details
13279256a5
panxiao81 merged commit f767cd9a5e into main 2026-09-16 15:25:04 +00:00
panxiao81 deleted branch fix/dynamic-runner-secret-mount 2026-09-16 15:25:04 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
panxiao81 (Xiao Pan)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: panxiao81/homelab-infra#71