will.anderson/infrastructure
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix runner extra_hosts: inject gitea-proxy ClusterIP for build containers

Browse Source 
Build containers run with network: host, so k8s DNS doesn't resolve.
Add extra_hosts entry pointing gitea-proxy.ci.svc.cluster.local to its
ClusterIP (10.43.88.7) in both the will-org and neuron-technologies runner
configs. Without this, actions/checkout fails because Gitea passes the
proxy hostname as GITHUB_SERVER_URL and the build container can't reach it.

Also update stale CF Access comments that no longer reflect the architecture.
This commit is contained in:
Will Anderson
2026-05-05 05:41:59 -05:00
parent c94721b70b
commit 4dc687f2ae
1 changed files with 16 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files
servers/legion/k8s/gitea-runner/deployment.yaml
+16 -18
View File
@@ -8,7 +8,7 @@ metadata:
labels:
app: gitea-runner
annotations:
config-version: "2026-05-05-proxy-roll"
config-version: "2026-05-05-extra-hosts"
spec:
replicas: 1
selector:
@@ -19,7 +19,7 @@ spec:
labels:
app: gitea-runner
annotations:
config-version: "2026-05-05-proxy-roll"
config-version: "2026-05-05-extra-hosts"
spec:
securityContext:
runAsNonRoot: false
@@ -45,16 +45,15 @@ spec:
force_pull: true
valid_volumes: []
default_image: "registry.neuralplatform.ai/ci-base:latest"
# Build containers run with network: host. The in-cluster
# gitea name does not resolve there, so we redirect git
# operations to https://git.neuralplatform.ai using CF
# Access service-token headers. BASH_ENV makes bash source
# /usr/local/bin/git-cf-access-init.sh before every step,
# which sets up the redirect + headers.
env:
GITEA_SSH_PRIVATE_KEY: "${GITEA_SSH_PRIVATE_KEY}"
BASH_ENV: "/usr/local/bin/git-ssh-init.sh"
extra_hosts: []
# Build containers run with network: host, so k8s DNS names
# don't resolve. Inject the gitea-proxy ClusterIP so that
# actions/checkout can reach gitea-proxy.ci.svc.cluster.local
# (the URL Gitea passes as GITHUB_SERVER_URL to the runner).
extra_hosts:
- "gitea-proxy.ci.svc.cluster.local:10.43.88.7"
EOF
envFrom:
- secretRef:
@@ -100,7 +99,7 @@ metadata:
labels:
app: neuron-technologies-runner
annotations:
config-version: "2026-05-05-proxy-roll"
config-version: "2026-05-05-extra-hosts"
spec:
replicas: 2
selector:
@@ -111,7 +110,7 @@ spec:
labels:
app: neuron-technologies-runner
annotations:
config-version: "2026-05-05-proxy-roll"
config-version: "2026-05-05-extra-hosts"
spec:
securityContext:
runAsNonRoot: false
@@ -137,16 +136,15 @@ spec:
force_pull: true
valid_volumes: []
default_image: "registry.neuralplatform.ai/ci-base:latest"
# Build containers run with network: host. The in-cluster
# gitea name does not resolve there, so we redirect git
# operations to https://git.neuralplatform.ai using CF
# Access service-token headers. BASH_ENV makes bash source
# /usr/local/bin/git-cf-access-init.sh before every step,
# which sets up the redirect + headers.
# Build containers run with network: host, so k8s DNS names
# don't resolve. Inject the gitea-proxy ClusterIP so that
# actions/checkout can reach gitea-proxy.ci.svc.cluster.local
# (the URL Gitea passes as GITHUB_SERVER_URL to the runner).
env:
GITEA_SSH_PRIVATE_KEY: "${GITEA_SSH_PRIVATE_KEY}"
BASH_ENV: "/usr/local/bin/git-ssh-init.sh"
extra_hosts: []
extra_hosts:
- "gitea-proxy.ci.svc.cluster.local:10.43.88.7"
EOF
envFrom:
- secretRef: