nxtgauge-gitops/apps/forgejo/runner-deployment.yaml

apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: forgejo-runner
  namespace: forgejo
  labels:
    app: forgejo-runner
spec:
  selector:
    matchLabels:
      app: forgejo-runner
  template:
    metadata:
      labels:
        app: forgejo-runner
    spec:
      affinity:
        nodeAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
            nodeSelectorTerms:
              - matchExpressions:
                  - key: node-role.kubernetes.io/control-plane
                    operator: DoesNotExist
                  - key: node-role.kubernetes.io/master
                    operator: DoesNotExist
      initContainers:
      - name: init-runner-permissions
        image: ci.nxtgauge.com/admin/busybox:1.36
        command: ["/bin/sh", "-ec"]
        args:
        - |
          mkdir -p /data /cache
          chown -R 1000:0 /data /cache
          chmod -R g=u /data /cache
        securityContext:
          runAsUser: 0
        volumeMounts:
        - name: runner-config
          mountPath: /data
        - name: runner-cache
          mountPath: /cache
      containers:
      - name: dind
        image: ci.nxtgauge.com/admin/docker:27-dind
        args:
        - --host=tcp://0.0.0.0:2375
        - --tls=false
        securityContext:
          privileged: true
        env:
        - name: DOCKER_TLS_CERTDIR
          value: ""
        volumeMounts:
        - name: dind-storage
          mountPath: /var/lib/docker
        - name: docker-config
          mountPath: /etc/docker/daemon.json
          subPath: daemon.json
        - name: registry-cert
          mountPath: /etc/docker/certs.d/ci.nxtgauge.com/ca.crt
          subPath: registry.crt
          readOnly: true
        resources:
          requests:
            cpu: 250m
            memory: 512Mi
          limits:
            cpu: 2
            memory: 4Gi
      - name: runner
        image: ci.nxtgauge.com/admin/forgejo-runner:6
        env:
        - name: DOCKER_HOST
          value: tcp://127.0.0.1:2375
        - name: FORGEJO_INSTANCE_URL
          value: http://forgejo-http.forgejo.svc.cluster.local:3000
        - name: FORGEJO_RUNNER_REGISTRATION_TOKEN
          valueFrom:
            secretKeyRef:
              name: forgejo-runner-secret
              key: FORGEJO_RUNNER_REGISTRATION_TOKEN
        - name: K8S_NODE_NAME
          valueFrom:
            fieldRef:
              fieldPath: spec.nodeName
        - name: FORGEJO_RUNNER_LABELS
          value: "self-hosted:docker://ci.nxtgauge.com/admin/forgejo-runner-job:bookworm,linux:docker://ci.nxtgauge.com/admin/forgejo-runner-job:bookworm,ubuntu-latest:docker://ci.nxtgauge.com/admin/forgejo-runner-job:bookworm,ubuntu-22.04:docker://ci.nxtgauge.com/admin/forgejo-runner-job:bookworm,ubuntu-24.04:docker://ci.nxtgauge.com/admin/forgejo-runner-job:bookworm,debian-12:docker://ci.nxtgauge.com/admin/forgejo-runner-job:bookworm,docker-ready:docker://ci.nxtgauge.com/admin/forgejo-runner-job:bookworm"
        resources:
          requests:
            cpu: 200m
            memory: 512Mi
          limits:
            cpu: 4
            memory: 8Gi
        volumeMounts:
        - name: runner-config
          mountPath: /data
        - name: runner-cache
          mountPath: /cache
        command: ["/bin/sh"]
        args:
        - -ec
        - |
          cd /data
          RUNNER_NAME="${K8S_NODE_NAME}"
          echo "Waiting for Docker sidecar on ${K8S_NODE_NAME}..."
          sleep 8
          rm -f .runner
          echo "Registering runner ${RUNNER_NAME}..."
          forgejo-runner register \
            --no-interactive \
            --instance "$FORGEJO_INSTANCE_URL" \
            --token "$FORGEJO_RUNNER_REGISTRATION_TOKEN" \
            --name "$RUNNER_NAME" \
            --labels "$FORGEJO_RUNNER_LABELS"
          echo "Starting daemon..."
          # Create config.yaml for daemon
          if [ ! -f /data/config.yaml ]; then
            cat > /data/config.yaml << CONFIGEOF
log:
  level: info
runner:
  file: .runner
  daemon:
    container:
      network: host
      privileged: true
CONFIGEOF
          fi
          exec forgejo-runner daemon
      volumes:
      - name: docker-config
        configMap:
          name: docker-daemon-config
      - name: registry-cert
        configMap:
          name: registry-cert
          items:
            - key: registry.crt
              path: registry.crt
      - name: runner-config
        hostPath:
          path: /var/lib/forgejo-runner
          type: DirectoryOrCreate
      - name: runner-cache
        hostPath:
          path: /var/cache/forgejo-runner
          type: DirectoryOrCreate
      - name: dind-storage
        emptyDir: {}
  updateStrategy:
    type: RollingUpdate
    rollingUpdate:
      maxUnavailable: 1
      maxSurge: 0