panxiao81andClaude Opus 5.5
55bb5be8b6
从旧工作区 chore/recover-old-workspace 清理时保存，内容与 2026-09-17
stash@{0} 快照中的版本一致；未合并、未在 main 上使用，仅作参考，不开 PR。
被 gitignore 的 tfstate 与凭据文件不在此分支，仍留在本地工作区。
Co-Authored-By: Claude Opus 5.5 <[email protected]>
112 lines
3.0 KiB
YAML
112 lines
3.0 KiB
YAML
apiVersion: v1
|
|
kind: Pod
|
|
metadata:
|
|
generateName: kata-ephemeral-runner-
|
|
namespace: gitea-actions
|
|
labels:
|
|
app.kubernetes.io/name: kata-ephemeral-runner
|
|
spec:
|
|
runtimeClassName: kata
|
|
restartPolicy: Never
|
|
terminationGracePeriodSeconds: 330
|
|
automountServiceAccountToken: false
|
|
initContainers:
|
|
# Native sidecar: startupProbe gates the runner, and kubelet terminates this
|
|
# container after the ephemeral runner exits so the Kata sandbox can end.
|
|
- name: docker
|
|
image: zot.ad.ddupan.top/panxiao81/dind-fuse:29.7.1
|
|
imagePullPolicy: Never
|
|
restartPolicy: Always
|
|
env:
|
|
- name: DOCKER_TLS_CERTDIR
|
|
value: ""
|
|
- name: DIND_LOOPBACK_SIZE
|
|
value: 6G
|
|
- name: DIND_LOOPBACK_FILE
|
|
value: /loopback/docker.img
|
|
args:
|
|
- --host=tcp://0.0.0.0:2375
|
|
- --tls=false
|
|
- --mtu=1450
|
|
- --default-network-opt=bridge=com.docker.network.driver.mtu=1450
|
|
securityContext:
|
|
privileged: true
|
|
resources:
|
|
requests:
|
|
cpu: 250m
|
|
memory: 512Mi
|
|
ephemeral-storage: 1Gi
|
|
limits:
|
|
cpu: "4"
|
|
memory: 6Gi
|
|
ephemeral-storage: 8Gi
|
|
volumeMounts:
|
|
- name: docker-data
|
|
mountPath: /var/lib/docker
|
|
- name: loopback-data
|
|
mountPath: /loopback
|
|
startupProbe:
|
|
tcpSocket:
|
|
port: 2375
|
|
periodSeconds: 2
|
|
failureThreshold: 150
|
|
readinessProbe:
|
|
tcpSocket:
|
|
port: 2375
|
|
periodSeconds: 5
|
|
containers:
|
|
- name: runner
|
|
image: docker.io/gitea/runner:2.3.0
|
|
imagePullPolicy: Never
|
|
env:
|
|
- name: CONFIG_FILE
|
|
value: /config/config.yaml
|
|
- name: DOCKER_HOST
|
|
value: tcp://127.0.0.1:2375
|
|
- name: GITEA_INSTANCE_URL
|
|
value: https://git.ddupan.top
|
|
- name: GITEA_RUNNER_EPHEMERAL
|
|
value: "1"
|
|
- name: GITEA_RUNNER_NAME
|
|
valueFrom:
|
|
fieldRef:
|
|
fieldPath: metadata.name
|
|
- name: GITEA_RUNNER_LABELS
|
|
value: kata-poc:docker://docker.io/library/alpine:3.22
|
|
- name: GITEA_RUNNER_REGISTRATION_TOKEN_FILE
|
|
value: /registration/token
|
|
resources:
|
|
requests:
|
|
cpu: 100m
|
|
memory: 128Mi
|
|
limits:
|
|
cpu: "1"
|
|
memory: 1Gi
|
|
volumeMounts:
|
|
- name: config
|
|
mountPath: /config
|
|
readOnly: true
|
|
- name: registration
|
|
mountPath: /registration
|
|
readOnly: true
|
|
- name: runner-state
|
|
mountPath: /runner-state
|
|
volumes:
|
|
- name: config
|
|
configMap:
|
|
name: kata-ephemeral-runner-config
|
|
- name: registration
|
|
secret:
|
|
secretName: gitea-runner-registration
|
|
- name: runner-state
|
|
emptyDir:
|
|
medium: Memory
|
|
sizeLimit: 16Mi
|
|
- name: docker-data
|
|
emptyDir:
|
|
sizeLimit: 8Gi
|
|
- name: loopback-data
|
|
emptyDir:
|
|
medium: Memory
|
|
sizeLimit: 6Gi
|