82 lines
2.4 KiB
YAML
82 lines
2.4 KiB
YAML
enabled: true
|
|
|
|
giteaRootURL: http://gitea-http.gitea.svc.cluster.local:3000
|
|
existingSecret: gitea-runner-token
|
|
existingSecretKey: token
|
|
|
|
statefulset:
|
|
replicas: 1
|
|
timezone: Etc/UTC
|
|
serviceAccountName: gitea-actions
|
|
extraVolumes:
|
|
- name: spiffe-workload-api
|
|
csi:
|
|
driver: csi.spiffe.io
|
|
readOnly: true
|
|
securityContext:
|
|
fsGroup: 1000
|
|
# Chart 0.1.1 applies this block to both runner and DinD containers.
|
|
resources:
|
|
requests:
|
|
cpu: 250m
|
|
memory: 512Mi
|
|
ephemeral-storage: 2Gi
|
|
limits:
|
|
cpu: "4"
|
|
memory: 6Gi
|
|
ephemeral-storage: 20Gi
|
|
persistence:
|
|
size: 1Gi
|
|
|
|
runner:
|
|
registry: docker.io
|
|
repository: gitea/runner
|
|
tag: 2.3.0
|
|
pullPolicy: IfNotPresent
|
|
extraVolumeMounts:
|
|
- name: spiffe-workload-api
|
|
mountPath: /run/spire/agent-sockets
|
|
readOnly: true
|
|
config: |
|
|
log:
|
|
level: info
|
|
runner:
|
|
file: .runner
|
|
capacity: 4
|
|
timeout: 3h
|
|
shutdown_timeout: 3h
|
|
labels:
|
|
- self-hosted:docker://docker.gitea.com/runner-images:ubuntu-latest
|
|
cache:
|
|
enabled: false
|
|
container:
|
|
require_docker: true
|
|
docker_timeout: 300s
|
|
# Workflows must still request this exact bind mount explicitly. The
|
|
# allowlist prevents arbitrary host paths from reaching job containers.
|
|
valid_volumes:
|
|
- /run/spire/agent-sockets
|
|
|
|
dind:
|
|
# The node enforces AppArmor's unprivileged-userns restriction, which blocks
|
|
# rootlesskit even though this chart must run DinD privileged either way.
|
|
rootless: false
|
|
registry: docker.io
|
|
repository: docker
|
|
tag: 29.7.1-dind
|
|
pullPolicy: IfNotPresent
|
|
# Bind mounts are resolved by dockerd, so the CSI socket must exist in the
|
|
# DinD container as well as in the runner container.
|
|
extraVolumeMounts:
|
|
- name: spiffe-workload-api
|
|
mountPath: /run/spire/agent-sockets
|
|
readOnly: true
|
|
# k3s uses a 1450-byte pod MTU. Without matching it here, nested Actions
|
|
# networks advertise 1500 and GitHub TLS packets disappear on the outer
|
|
# overlay path while direct pod traffic remains healthy.
|
|
extraArgs:
|
|
- --mtu=1450
|
|
# --mtu only changes Docker's default bridge. act creates a user-defined
|
|
# bridge per job, so give every new bridge the same explicit default.
|
|
- --default-network-opt=bridge=com.docker.network.driver.mtu=1450
|