302 lines
10 KiB
YAML
302 lines
10 KiB
YAML
---
|
|
apiVersion: sandbox.opensandbox.io/v1alpha1
|
|
kind: Pool
|
|
metadata:
|
|
name: ci-vm
|
|
namespace: opensandbox
|
|
labels:
|
|
app.kubernetes.io/name: gitea-ci-vm
|
|
app.kubernetes.io/component: runner-pool
|
|
spec:
|
|
capacitySpec:
|
|
bufferMax: 0
|
|
bufferMin: 0
|
|
poolMax: 2
|
|
poolMin: 0
|
|
recycleStrategy:
|
|
type: Delete
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app.kubernetes.io/name: gitea-ci-vm
|
|
ci.ddupan.top/backend: vm
|
|
spec:
|
|
runtimeClassName: kata-clh-runtime-rs
|
|
serviceAccountName: gitea-ci
|
|
restartPolicy: Never
|
|
terminationGracePeriodSeconds: 30
|
|
shareProcessNamespace: true
|
|
securityContext:
|
|
fsGroup: 2000
|
|
fsGroupChangePolicy: OnRootMismatch
|
|
initContainers:
|
|
- name: task-executor-installer
|
|
image: sandbox-registry.cn-zhangjiakou.cr.aliyuncs.com/opensandbox/task-executor:v0.1.0
|
|
command: [/bin/sh, -c]
|
|
args:
|
|
- cp /workspace/server /opt/opensandbox/task-executor && chmod 0755 /opt/opensandbox/task-executor
|
|
volumeMounts:
|
|
- name: opensandbox-bin
|
|
mountPath: /opt/opensandbox
|
|
- name: execd-installer
|
|
image: sandbox-registry.cn-zhangjiakou.cr.aliyuncs.com/opensandbox/execd:v1.0.22
|
|
command: [/bin/sh, -c]
|
|
args:
|
|
- cp ./execd /opt/opensandbox/execd && cp ./bootstrap.sh /opt/opensandbox/bootstrap.sh && chmod 0755 /opt/opensandbox/execd /opt/opensandbox/bootstrap.sh
|
|
volumeMounts:
|
|
- name: opensandbox-bin
|
|
mountPath: /opt/opensandbox
|
|
containers:
|
|
- name: sandbox
|
|
image: zot.ad.ddupan.top/panxiao81/gitea-dynamic-runner-runner@sha256:08f83c9993645dce376140fdde7e29e809795166b2bb32e50cebdbefaf3cf303
|
|
imagePullPolicy: IfNotPresent
|
|
command: [/opt/opensandbox/task-executor]
|
|
args:
|
|
- -listen-addr=0.0.0.0:5758
|
|
- -log-dir=/tmp
|
|
- -data-dir=/tmp/tasks
|
|
env:
|
|
- name: SANDBOX_MAIN_CONTAINER
|
|
value: sandbox
|
|
- name: EXECD_ENVS
|
|
value: /opt/opensandbox/.env
|
|
- name: EXECD
|
|
value: /opt/opensandbox/execd
|
|
- name: GITEA_INSTANCE_URL
|
|
value: https://git.ddupan.top
|
|
- name: HOME
|
|
value: /data
|
|
- name: DOCKER_HOST
|
|
value: unix:///run/docker/docker.sock
|
|
ports:
|
|
- name: task-executor
|
|
containerPort: 5758
|
|
securityContext:
|
|
allowPrivilegeEscalation: false
|
|
capabilities:
|
|
drop: [ALL]
|
|
runAsNonRoot: true
|
|
runAsUser: 2000
|
|
runAsGroup: 2000
|
|
volumeMounts:
|
|
- name: opensandbox-bin
|
|
mountPath: /opt/opensandbox
|
|
- name: runner-data
|
|
mountPath: /data
|
|
- name: docker-socket
|
|
mountPath: /run/docker
|
|
- name: spire-socket
|
|
mountPath: /run/spire/agent-sockets
|
|
- name: spire-agent
|
|
image: ghcr.io/spiffe/spire-agent:1.15.3@sha256:41b0dcd8b258a69db9e2768292a060766fb76fd866e4bc925849981ea1b825ff
|
|
args: [-config, /run/spire/config/agent.conf]
|
|
securityContext:
|
|
allowPrivilegeEscalation: false
|
|
capabilities:
|
|
drop: [ALL]
|
|
volumeMounts:
|
|
- name: spire-config
|
|
mountPath: /run/spire/config
|
|
readOnly: true
|
|
- name: spire-bundle
|
|
mountPath: /run/spire/bundle
|
|
readOnly: true
|
|
- name: spire-token
|
|
mountPath: /run/spire/tokens
|
|
readOnly: true
|
|
- name: spire-data
|
|
mountPath: /run/spire/data
|
|
- name: spire-socket
|
|
mountPath: /run/spire/agent-sockets
|
|
- name: docker
|
|
image: docker.io/library/docker:29.1.5-dind
|
|
command: [/bin/sh, -c]
|
|
args:
|
|
- test -e /dev/kmsg || mknod /dev/kmsg c 1 11; exec dockerd --host=unix:///run/docker/docker.sock --group=2000 --storage-driver=overlay2
|
|
securityContext:
|
|
privileged: true
|
|
volumeMounts:
|
|
- name: docker-socket
|
|
mountPath: /run/docker
|
|
- name: docker-data
|
|
mountPath: /var/lib/docker
|
|
volumes:
|
|
- name: opensandbox-bin
|
|
emptyDir: {}
|
|
- name: runner-data
|
|
emptyDir: {}
|
|
- name: docker-data
|
|
emptyDir: {}
|
|
- name: docker-socket
|
|
emptyDir:
|
|
medium: Memory
|
|
- name: spire-data
|
|
emptyDir:
|
|
medium: Memory
|
|
- name: spire-socket
|
|
emptyDir:
|
|
medium: Memory
|
|
- name: spire-config
|
|
configMap:
|
|
name: gitea-ci-spire-agent
|
|
- name: spire-bundle
|
|
configMap:
|
|
name: spire-bundle-pem
|
|
- name: spire-token
|
|
projected:
|
|
sources:
|
|
- serviceAccountToken:
|
|
audience: spire-server
|
|
expirationSeconds: 3600
|
|
path: token
|
|
---
|
|
apiVersion: sandbox.opensandbox.io/v1alpha1
|
|
kind: Pool
|
|
metadata:
|
|
name: ci-pod
|
|
namespace: opensandbox
|
|
labels:
|
|
app.kubernetes.io/name: gitea-ci-pod
|
|
app.kubernetes.io/component: runner-pool
|
|
spec:
|
|
capacitySpec:
|
|
bufferMax: 0
|
|
bufferMin: 0
|
|
poolMax: 4
|
|
poolMin: 0
|
|
recycleStrategy:
|
|
type: Delete
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app.kubernetes.io/name: gitea-ci-pod
|
|
ci.ddupan.top/backend: pod
|
|
spec:
|
|
serviceAccountName: gitea-ci
|
|
restartPolicy: Never
|
|
terminationGracePeriodSeconds: 30
|
|
shareProcessNamespace: true
|
|
securityContext:
|
|
fsGroup: 2000
|
|
fsGroupChangePolicy: OnRootMismatch
|
|
initContainers:
|
|
- name: task-executor-installer
|
|
image: sandbox-registry.cn-zhangjiakou.cr.aliyuncs.com/opensandbox/task-executor:v0.1.0
|
|
command: [/bin/sh, -c]
|
|
args:
|
|
- cp /workspace/server /opt/opensandbox/task-executor && chmod 0755 /opt/opensandbox/task-executor
|
|
volumeMounts:
|
|
- name: opensandbox-bin
|
|
mountPath: /opt/opensandbox
|
|
- name: execd-installer
|
|
image: sandbox-registry.cn-zhangjiakou.cr.aliyuncs.com/opensandbox/execd:v1.0.22
|
|
command: [/bin/sh, -c]
|
|
args:
|
|
- cp ./execd /opt/opensandbox/execd && cp ./bootstrap.sh /opt/opensandbox/bootstrap.sh && chmod 0755 /opt/opensandbox/execd /opt/opensandbox/bootstrap.sh
|
|
volumeMounts:
|
|
- name: opensandbox-bin
|
|
mountPath: /opt/opensandbox
|
|
containers:
|
|
- name: sandbox
|
|
image: zot.ad.ddupan.top/panxiao81/gitea-dynamic-runner-runner@sha256:a45875fd2d0e67429b0b7bc3914735581669c705bb4e1a05d712134d2bceb86f
|
|
imagePullPolicy: IfNotPresent
|
|
command: [/opt/opensandbox/task-executor]
|
|
args:
|
|
- -listen-addr=0.0.0.0:5758
|
|
- -log-dir=/tmp
|
|
- -data-dir=/tmp/tasks
|
|
env:
|
|
- name: SANDBOX_MAIN_CONTAINER
|
|
value: sandbox
|
|
- name: EXECD_ENVS
|
|
value: /opt/opensandbox/.env
|
|
- name: EXECD
|
|
value: /opt/opensandbox/execd
|
|
- name: GITEA_INSTANCE_URL
|
|
value: https://git.ddupan.top
|
|
- name: HOME
|
|
value: /data
|
|
- name: DOCKER_HOST
|
|
value: unix:///run/docker/docker.sock
|
|
ports:
|
|
- name: task-executor
|
|
containerPort: 5758
|
|
securityContext:
|
|
allowPrivilegeEscalation: false
|
|
capabilities:
|
|
drop: [ALL]
|
|
runAsNonRoot: true
|
|
runAsUser: 2000
|
|
runAsGroup: 2000
|
|
volumeMounts:
|
|
- name: opensandbox-bin
|
|
mountPath: /opt/opensandbox
|
|
- name: runner-data
|
|
mountPath: /data
|
|
- name: docker-socket
|
|
mountPath: /run/docker
|
|
- name: spire-socket
|
|
mountPath: /run/spire/agent-sockets
|
|
- name: spire-agent
|
|
image: ghcr.io/spiffe/spire-agent:1.15.3@sha256:41b0dcd8b258a69db9e2768292a060766fb76fd866e4bc925849981ea1b825ff
|
|
args: [-config, /run/spire/config/agent.conf]
|
|
securityContext:
|
|
allowPrivilegeEscalation: false
|
|
capabilities:
|
|
drop: [ALL]
|
|
volumeMounts:
|
|
- name: spire-config
|
|
mountPath: /run/spire/config
|
|
readOnly: true
|
|
- name: spire-bundle
|
|
mountPath: /run/spire/bundle
|
|
readOnly: true
|
|
- name: spire-token
|
|
mountPath: /run/spire/tokens
|
|
readOnly: true
|
|
- name: spire-data
|
|
mountPath: /run/spire/data
|
|
- name: spire-socket
|
|
mountPath: /run/spire/agent-sockets
|
|
- name: docker
|
|
image: docker.io/library/docker:29.1.5-dind
|
|
command: [/bin/sh, -c]
|
|
args:
|
|
- test -e /dev/kmsg || mknod /dev/kmsg c 1 11; exec dockerd --host=unix:///run/docker/docker.sock --group=2000 --storage-driver=overlay2
|
|
securityContext:
|
|
privileged: true
|
|
volumeMounts:
|
|
- name: docker-socket
|
|
mountPath: /run/docker
|
|
- name: docker-data
|
|
mountPath: /var/lib/docker
|
|
volumes:
|
|
- name: opensandbox-bin
|
|
emptyDir: {}
|
|
- name: runner-data
|
|
emptyDir: {}
|
|
- name: docker-data
|
|
emptyDir: {}
|
|
- name: docker-socket
|
|
emptyDir:
|
|
medium: Memory
|
|
- name: spire-data
|
|
emptyDir:
|
|
medium: Memory
|
|
- name: spire-socket
|
|
emptyDir:
|
|
medium: Memory
|
|
- name: spire-config
|
|
configMap:
|
|
name: gitea-ci-spire-agent
|
|
- name: spire-bundle
|
|
configMap:
|
|
name: spire-bundle-pem
|
|
- name: spire-token
|
|
projected:
|
|
sources:
|
|
- serviceAccountToken:
|
|
audience: spire-server
|
|
expirationSeconds: 3600
|
|
path: token
|