c633dd4ea2
This file had drifted badly from the actual running DaemonSet - the
live cluster already moved off the standalone registry.nxtgauge.com
mirror (now decommissioned, confirmed dead: internal DNS routes it to
Traefik with no matching ingress) onto ci.nxtgauge.com's built-in
registry. That migration was done directly against the cluster and
never reflected back to git, leaving a stale REGISTRY_PASSWORD literal
("Ashwin@2026") in this file that doesn't exist in the live DaemonSet
at all. Replaces the file with the actual live spec and adds the two
ConfigMaps (docker-daemon-config, registry-cert) it depends on, which
were also missing from the repo. Not applying this to the cluster -
the differences are purely cosmetic (mount ordering, stale
annotations) and would trigger a pointless restart of healthy runners.
142 lines
4.5 KiB
YAML
142 lines
4.5 KiB
YAML
apiVersion: apps/v1
|
|
kind: DaemonSet
|
|
metadata:
|
|
name: forgejo-runner
|
|
namespace: forgejo
|
|
labels:
|
|
app: forgejo-runner
|
|
spec:
|
|
selector:
|
|
matchLabels:
|
|
app: forgejo-runner
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: forgejo-runner
|
|
spec:
|
|
affinity:
|
|
nodeAffinity:
|
|
requiredDuringSchedulingIgnoredDuringExecution:
|
|
nodeSelectorTerms:
|
|
- matchExpressions:
|
|
- key: node-role.kubernetes.io/control-plane
|
|
operator: DoesNotExist
|
|
- key: node-role.kubernetes.io/master
|
|
operator: DoesNotExist
|
|
initContainers:
|
|
- name: init-runner-permissions
|
|
image: ci.nxtgauge.com/admin/busybox:1.36
|
|
command: ["/bin/sh", "-ec"]
|
|
args:
|
|
- |
|
|
mkdir -p /data /cache
|
|
chown -R 1000:0 /data /cache
|
|
chmod -R g=u /data /cache
|
|
securityContext:
|
|
runAsUser: 0
|
|
volumeMounts:
|
|
- name: runner-config
|
|
mountPath: /data
|
|
- name: runner-cache
|
|
mountPath: /cache
|
|
containers:
|
|
- name: dind
|
|
image: ci.nxtgauge.com/admin/docker:27-dind
|
|
args:
|
|
- --host=tcp://0.0.0.0:2375
|
|
- --tls=false
|
|
securityContext:
|
|
privileged: true
|
|
env:
|
|
- name: DOCKER_TLS_CERTDIR
|
|
value: ""
|
|
volumeMounts:
|
|
- name: dind-storage
|
|
mountPath: /var/lib/docker
|
|
- name: docker-config
|
|
mountPath: /etc/docker/daemon.json
|
|
subPath: daemon.json
|
|
- name: registry-cert
|
|
mountPath: /etc/docker/certs.d/registry.nxtgauge.com/ca.crt
|
|
subPath: registry.crt
|
|
readOnly: true
|
|
resources:
|
|
requests:
|
|
cpu: 250m
|
|
memory: 512Mi
|
|
limits:
|
|
cpu: 2
|
|
memory: 4Gi
|
|
- name: runner
|
|
image: ci.nxtgauge.com/admin/forgejo-runner:6
|
|
env:
|
|
- name: DOCKER_HOST
|
|
value: tcp://127.0.0.1:2375
|
|
- name: FORGEJO_INSTANCE_URL
|
|
value: http://forgejo-http.forgejo.svc.cluster.local:3000
|
|
- name: FORGEJO_RUNNER_REGISTRATION_TOKEN
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: forgejo-runner-secret
|
|
key: FORGEJO_RUNNER_REGISTRATION_TOKEN
|
|
- name: K8S_NODE_NAME
|
|
valueFrom:
|
|
fieldRef:
|
|
fieldPath: spec.nodeName
|
|
- name: FORGEJO_RUNNER_LABELS
|
|
value: "self-hosted:docker://registry.nxtgauge.com/catthehacker-ubuntu:act-latest,linux:docker://registry.nxtgauge.com/catthehacker-ubuntu:act-latest,ubuntu-latest:docker://registry.nxtgauge.com/catthehacker-ubuntu:act-latest,ubuntu-22.04:docker://registry.nxtgauge.com/catthehacker-ubuntu:act-latest,ubuntu-24.04:docker://registry.nxtgauge.com/catthehacker-ubuntu:act-latest,debian-12:docker://registry.nxtgauge.com/catthehacker-ubuntu:act-latest,docker-ready:docker://registry.nxtgauge.com/catthehacker-ubuntu:act-latest"
|
|
resources:
|
|
requests:
|
|
cpu: 200m
|
|
memory: 512Mi
|
|
limits:
|
|
cpu: 4
|
|
memory: 8Gi
|
|
volumeMounts:
|
|
- name: runner-config
|
|
mountPath: /data
|
|
- name: runner-cache
|
|
mountPath: /cache
|
|
command: ["/bin/sh"]
|
|
args:
|
|
- -ec
|
|
- |
|
|
cd /data
|
|
RUNNER_NAME="${K8S_NODE_NAME}"
|
|
echo "Waiting for Docker sidecar on ${K8S_NODE_NAME}..."
|
|
sleep 8
|
|
rm -f .runner
|
|
echo "Registering runner ${RUNNER_NAME}..."
|
|
forgejo-runner register \
|
|
--no-interactive \
|
|
--instance "$FORGEJO_INSTANCE_URL" \
|
|
--token "$FORGEJO_RUNNER_REGISTRATION_TOKEN" \
|
|
--name "$RUNNER_NAME" \
|
|
--labels "$FORGEJO_RUNNER_LABELS"
|
|
echo "Starting daemon..."
|
|
exec forgejo-runner daemon
|
|
volumes:
|
|
- name: docker-config
|
|
configMap:
|
|
name: docker-daemon-config
|
|
- name: registry-cert
|
|
configMap:
|
|
name: registry-cert
|
|
items:
|
|
- key: registry.crt
|
|
path: registry.crt
|
|
- name: runner-config
|
|
hostPath:
|
|
path: /var/lib/forgejo-runner
|
|
type: DirectoryOrCreate
|
|
- name: runner-cache
|
|
hostPath:
|
|
path: /var/cache/forgejo-runner
|
|
type: DirectoryOrCreate
|
|
- name: dind-storage
|
|
emptyDir: {}
|
|
updateStrategy:
|
|
type: RollingUpdate
|
|
rollingUpdate:
|
|
maxUnavailable: 1
|
|
maxSurge: 0
|