From 1312be1a03bc1597e2c234b20628179fd4568815 Mon Sep 17 00:00:00 2001 From: Will Anderson Date: Tue, 24 Mar 2026 14:39:57 -0500 Subject: [PATCH] =?UTF-8?q?runner:=20bind-mount=20host=20kubectl=20into=20?= =?UTF-8?q?job=20containers;=20registry=20domain=20=E2=86=92=20neuralplatf?= =?UTF-8?q?orm.ai?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit gitea-runner: add container.options to mount /usr/local/bin/kubectl:ro from the Legion host into every act_runner job container. Eliminates per-run curl download in CI workflows. ingress: change registry ingress hostname from registry.nook.family to registry.neuralplatform.ai. Matches the domain used in Neuron CI and neuron.yaml image reference. DNS CNAME + tunnel route already added. --- servers/legion/apps/gitea-runner.yaml | 1 + servers/legion/ingress.tf | 12 ++++++++---- 2 files changed, 9 insertions(+), 4 deletions(-) diff --git a/servers/legion/apps/gitea-runner.yaml b/servers/legion/apps/gitea-runner.yaml index 5e0227e..fcf8e57 100644 --- a/servers/legion/apps/gitea-runner.yaml +++ b/servers/legion/apps/gitea-runner.yaml @@ -38,6 +38,7 @@ spec: network: host docker_host: "unix:///var/run/docker.sock" force_pull: false + options: -v /usr/local/bin/kubectl:/usr/local/bin/kubectl:ro EOF envFrom: - secretRef: diff --git a/servers/legion/ingress.tf b/servers/legion/ingress.tf index 065131c..c491e84 100644 --- a/servers/legion/ingress.tf +++ b/servers/legion/ingress.tf @@ -42,18 +42,22 @@ resource "kubernetes_ingress_v1" "registry" { name = "registry" namespace = kubernetes_namespace.registry.metadata[0].name annotations = { - "traefik.ingress.kubernetes.io/router.entrypoints" = "websecure" - "cert-manager.io/cluster-issuer" = "letsencrypt-prod" + "traefik.ingress.kubernetes.io/router.entrypoints" = "websecure" + "cert-manager.io/cluster-issuer" = "letsencrypt-prod" + "traefik.ingress.kubernetes.io/router.middlewares" = "registry-chunked@kubernetescrd" + "nginx.ingress.kubernetes.io/proxy-body-size" = "0" + "nginx.ingress.kubernetes.io/proxy-read-timeout" = "600" + "nginx.ingress.kubernetes.io/proxy-send-timeout" = "600" } } spec { tls { - hosts = ["registry.${var.domain_suffix}"] + hosts = ["registry.${var.infra_domain}"] secret_name = "registry-tls" } rule { - host = "registry.${var.domain_suffix}" + host = "registry.${var.infra_domain}" http { path { path = "/"