panxiao81
e513739ba0
lint / terraform (push) Failing after 2s
lint / yaml (push) Failing after 52s
lint / terraform (pull_request) Failing after 2s
lint / yaml (pull_request) Failing after 52s
lint / ansible (push) Failing after 1m42s
lint / ansible (pull_request) Failing after 1m43s
70 lines
2.7 KiB
Markdown
70 lines
2.7 KiB
Markdown
# Gitea Actions runner
|
|
|
|
This is the bootstrap runner for Gitea Actions. One persistent runner Pod accepts
|
|
up to four jobs; each job runs in a dynamically created container inside a
|
|
Docker-in-Docker daemon. The official chart runs DinD privileged. Rootless DinD
|
|
would still be privileged and is blocked by the node's AppArmor user-namespace
|
|
policy, so this deployment uses regular DinD instead of weakening that host-wide
|
|
policy. Only trusted workflows may target this runner.
|
|
|
|
The runner is registered at instance scope so it is available to every repository
|
|
on this Gitea instance. Repository permissions and protected-branch review are
|
|
therefore the security boundary; do not enable Actions for untrusted repositories.
|
|
|
|
The runner registration token is authoritative in OpenBao at
|
|
`kv/k8s/gitea-runner`. External Secrets Operator projects its `token` property to
|
|
the `gitea-runner-token` Secret. Never put the token in this directory or a Helm
|
|
command line.
|
|
|
|
## Review-first bootstrap
|
|
|
|
This is a one-time manual deployment because Flux is not installed yet:
|
|
|
|
1. Merge the reviewed PR.
|
|
2. As a Gitea site administrator, create an instance-scoped runner registration
|
|
token under **Site Administration → Actions → Runners**.
|
|
3. Store it as the `token` property at `kv/k8s/gitea-runner` without exposing it
|
|
in shell history:
|
|
|
|
```bash
|
|
read -rsp 'Runner token: ' runner_token
|
|
printf '%s' "$runner_token" | bao kv put kv/k8s/gitea-runner token=-
|
|
unset runner_token
|
|
```
|
|
|
|
4. From the updated `main`, create the namespace and ExternalSecret, then wait
|
|
for `SecretSynced=True`:
|
|
|
|
```bash
|
|
KUBECONFIG="$HOME/.kube/config" k3s kubectl apply \
|
|
-f platform/gitea-runner/namespace.yaml
|
|
KUBECONFIG="$HOME/.kube/config" k3s kubectl apply \
|
|
-f platform/gitea-runner/external-secret.yaml
|
|
KUBECONFIG="$HOME/.kube/config" k3s kubectl wait \
|
|
--namespace gitea-actions \
|
|
--for=condition=Ready externalsecret/gitea-runner-token \
|
|
--timeout=60s
|
|
```
|
|
|
|
5. Install chart `actions` version `0.1.1` from
|
|
`https://dl.gitea.com/charts/` with this `values.yaml`:
|
|
|
|
```bash
|
|
helm repo add gitea-charts https://dl.gitea.com/charts/
|
|
helm repo update gitea-charts
|
|
helm upgrade --install gitea-actions gitea-charts/actions \
|
|
--namespace gitea-actions \
|
|
--version 0.1.1 \
|
|
--values platform/gitea-runner/values.yaml \
|
|
--wait --timeout 10m
|
|
```
|
|
|
|
6. Confirm the runner is online, then re-run the queued lint workflow.
|
|
|
|
Do not deploy from an unmerged feature branch. Do not use `--set` for the token.
|
|
|
|
The 1 GiB PVC preserves `.runner` identity. Docker image layers are ephemeral;
|
|
the Pod has a 20 GiB ephemeral-storage limit. Terraform apply jobs must use a
|
|
workflow concurrency group because runner capacity does not serialize access to
|
|
a shared state.
|