From c633dd4ea2c123c611336b67d97fa38fb899c625 Mon Sep 17 00:00:00 2001 From: Ashwin Kumar Sivakumar Date: Thu, 2 Jul 2026 19:17:07 +0530 Subject: [PATCH] Sync forgejo runner-deployment.yaml with live cluster state, drop exposed password This file had drifted badly from the actual running DaemonSet - the live cluster already moved off the standalone registry.nxtgauge.com mirror (now decommissioned, confirmed dead: internal DNS routes it to Traefik with no matching ingress) onto ci.nxtgauge.com's built-in registry. That migration was done directly against the cluster and never reflected back to git, leaving a stale REGISTRY_PASSWORD literal ("Ashwin@2026") in this file that doesn't exist in the live DaemonSet at all. Replaces the file with the actual live spec and adds the two ConfigMaps (docker-daemon-config, registry-cert) it depends on, which were also missing from the repo. Not applying this to the cluster - the differences are purely cosmetic (mount ordering, stale annotations) and would trigger a pointless restart of healthy runners. --- apps/forgejo/runner-deployment.yaml | 89 +++++++++---------- apps/forgejo/runner-docker-daemon-config.yaml | 10 +++ apps/forgejo/runner-registry-cert.yaml | 28 ++++++ 3 files changed, 79 insertions(+), 48 deletions(-) create mode 100644 apps/forgejo/runner-docker-daemon-config.yaml create mode 100644 apps/forgejo/runner-registry-cert.yaml diff --git a/apps/forgejo/runner-deployment.yaml b/apps/forgejo/runner-deployment.yaml index 5e4ecd8..fb0a476 100644 --- a/apps/forgejo/runner-deployment.yaml +++ b/apps/forgejo/runner-deployment.yaml @@ -14,9 +14,18 @@ spec: labels: app: forgejo-runner spec: + affinity: + nodeAffinity: + requiredDuringSchedulingIgnoredDuringExecution: + nodeSelectorTerms: + - matchExpressions: + - key: node-role.kubernetes.io/control-plane + operator: DoesNotExist + - key: node-role.kubernetes.io/master + operator: DoesNotExist initContainers: - name: init-runner-permissions - image: registry.nxtgauge.com/busybox:1.36 + image: ci.nxtgauge.com/admin/busybox:1.36 command: ["/bin/sh", "-ec"] args: - | @@ -30,18 +39,9 @@ spec: mountPath: /data - name: runner-cache mountPath: /cache - affinity: - nodeAffinity: - requiredDuringSchedulingIgnoredDuringExecution: - nodeSelectorTerms: - - matchExpressions: - - key: node-role.kubernetes.io/control-plane - operator: DoesNotExist - - key: node-role.kubernetes.io/master - operator: DoesNotExist containers: - name: dind - image: registry.nxtgauge.com/docker:27-dind + image: ci.nxtgauge.com/admin/docker:27-dind args: - --host=tcp://0.0.0.0:2375 - --tls=false @@ -53,9 +53,12 @@ spec: volumeMounts: - name: dind-storage mountPath: /var/lib/docker - - name: registry-docker-config - mountPath: /root/.docker/config.json - subPath: config.json + - name: docker-config + mountPath: /etc/docker/daemon.json + subPath: daemon.json + - name: registry-cert + mountPath: /etc/docker/certs.d/registry.nxtgauge.com/ca.crt + subPath: registry.crt readOnly: true resources: requests: @@ -65,7 +68,7 @@ spec: cpu: 2 memory: 4Gi - name: runner - image: registry.nxtgauge.com/forgejo-runner:6 + image: ci.nxtgauge.com/admin/forgejo-runner:6 env: - name: DOCKER_HOST value: tcp://127.0.0.1:2375 @@ -82,12 +85,13 @@ spec: fieldPath: spec.nodeName - name: FORGEJO_RUNNER_LABELS value: "self-hosted:docker://registry.nxtgauge.com/catthehacker-ubuntu:act-latest,linux:docker://registry.nxtgauge.com/catthehacker-ubuntu:act-latest,ubuntu-latest:docker://registry.nxtgauge.com/catthehacker-ubuntu:act-latest,ubuntu-22.04:docker://registry.nxtgauge.com/catthehacker-ubuntu:act-latest,ubuntu-24.04:docker://registry.nxtgauge.com/catthehacker-ubuntu:act-latest,debian-12:docker://registry.nxtgauge.com/catthehacker-ubuntu:act-latest,docker-ready:docker://registry.nxtgauge.com/catthehacker-ubuntu:act-latest" - - name: REGISTRY_HOSTPORT - value: "registry.nxtgauge.com" - - name: REGISTRY_USERNAME - value: "admin" - - name: REGISTRY_PASSWORD - value: "Ashwin@2026" + resources: + requests: + cpu: 200m + memory: 512Mi + limits: + cpu: 4 + memory: 8Gi volumeMounts: - name: runner-config mountPath: /data @@ -99,32 +103,28 @@ spec: - | cd /data RUNNER_NAME="${K8S_NODE_NAME}" - echo "Waiting for Docker sidecar on ${K8S_NODE_NAME}..." sleep 8 - - - echo "Resetting runner registration state for ${RUNNER_NAME}..." rm -f .runner - - echo "Registering runner ${RUNNER_NAME} on node ${K8S_NODE_NAME}..." + echo "Registering runner ${RUNNER_NAME}..." forgejo-runner register \ --no-interactive \ --instance "$FORGEJO_INSTANCE_URL" \ --token "$FORGEJO_RUNNER_REGISTRATION_TOKEN" \ --name "$RUNNER_NAME" \ --labels "$FORGEJO_RUNNER_LABELS" - - echo "Starting daemon for ${RUNNER_NAME}..." + echo "Starting daemon..." exec forgejo-runner daemon - resources: - requests: - cpu: 200m - memory: 512Mi - limits: - cpu: 4 - memory: 8Gi volumes: + - name: docker-config + configMap: + name: docker-daemon-config + - name: registry-cert + configMap: + name: registry-cert + items: + - key: registry.crt + path: registry.crt - name: runner-config hostPath: path: /var/lib/forgejo-runner @@ -135,15 +135,8 @@ spec: type: DirectoryOrCreate - name: dind-storage emptyDir: {} - - name: registry-docker-config - secret: - secretName: registry-docker-config ---- -apiVersion: v1 -kind: Secret -metadata: - name: forgejo-runner-secret - namespace: forgejo -type: Opaque -stringData: - FORGEJO_RUNNER_REGISTRATION_TOKEN: "it63i9ZDM3NwSkSUMOYQSNTxpm3R8njC9SlIoRlq" + updateStrategy: + type: RollingUpdate + rollingUpdate: + maxUnavailable: 1 + maxSurge: 0 diff --git a/apps/forgejo/runner-docker-daemon-config.yaml b/apps/forgejo/runner-docker-daemon-config.yaml new file mode 100644 index 0000000..4c8cd24 --- /dev/null +++ b/apps/forgejo/runner-docker-daemon-config.yaml @@ -0,0 +1,10 @@ +apiVersion: v1 +kind: ConfigMap +metadata: + name: docker-daemon-config + namespace: forgejo +data: + daemon.json: | + { + "insecure-registries": ["registry.nxtgauge.com"] + } diff --git a/apps/forgejo/runner-registry-cert.yaml b/apps/forgejo/runner-registry-cert.yaml new file mode 100644 index 0000000..059348a --- /dev/null +++ b/apps/forgejo/runner-registry-cert.yaml @@ -0,0 +1,28 @@ +apiVersion: v1 +kind: ConfigMap +metadata: + name: registry-cert + namespace: forgejo +data: + registry.crt: | + -----BEGIN CERTIFICATE----- + MIIDXjCCAkagAwIBAgIRAKmaH9FY6+MJkPAoIP/iQkkwDQYJKoZIhvcNAQELBQAw + HzEdMBsGA1UEAxMUVFJBRUZJSyBERUZBVUxUIENFUlQwHhcNMjYwNjE3MTYxMTI2 + WhcNMjcwNjE3MTYxMTI2WjAfMR0wGwYDVQQDExRUUkFFRklLIERFRkFVTFQgQ0VS + VDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALOQ4CM5+Vxm/0S3ijLl + nCdrhLO5/YHW4cby7llpn2Sac2fJP4jVnLLrFWITAfvqa5o2oDeHJH9nhpGZI/fg + NQvQu9RZIeq4d8xKoJ4d8qSJ2IVt2JJ+J0cjfg6Wm69DnFGpZGy4Vz4DgEWQ1u20 + gnRfFBPBZmo45/pz9UafNtjoOx++C8VeHJRt8RCd0Zx26wePXQbN07+T1tj3MOc+ + t92IBn0tQ9g20hiGMgrhi50dPv7HEupbKKy7ZCkBVN/XNHFrvorsCudirFlJZTGw + k2chsTOm2jiIf7xob+Ma1kHncH/NWm9QVieeBUTgrH/Fa2xAHhJ+DuFR0iXW8APj + FnMCAwEAAaOBlDCBkTAOBgNVHQ8BAf8EBAMCA7gwEwYDVR0lBAwwCgYIKwYBBQUH + AwEwDAYDVR0TAQH/BAIwADBcBgNVHREEVTBTglFmZmE0MmE0ZGJhZGJiMTY3ZjUz + YTBiNjA3ZWIyOTQ5OS5iN2QyYWM4ZDlhODRmZDU1MjU5OTc1Y2I0NDM3MWZhZS50 + cmFlZmlrLmRlZmF1bHQwDQYJKoZIhvcNAQELBQADggEBAF1RgfSra5RE1zyRLAai + d8tBbzBMAYQVrLKjlYATsnv+d6RQ9ZocdwgLG2OI+roFx1BuLLl/C5aL09UFqCvr + Ab2exdlLMi4IGoVvgUkEtWYwwnbbsL0hR0keR7UE5snc2tT3SlAYLHenzY3kPFhf + Tx0IiS1hdLAQk0TpfRKDYJ7+IV5Mj+aeiG9uK+0je5VcvRSFnrGnackYT7f5yX96 + fQ9vwhi7HvWwUlj/8wU/Se//92N7KkddlasyBF77Gdhnoa9qzYyUD1DJHCyfmkaI + RV9jAOWn4RFwpXB7TqNAKnkGWzYBaF5OQc7K/pHgYb+RtC1uNKd1rK3Lyoh56vAy + Y1g= + -----END CERTIFICATE-----