deploy gitea CI runner to GKE as k8s pod

Replaces the GCE VM runner with a k8s Deployment in the ci namespace on
neuron-platform GKE. Uses Docker-in-Docker for build isolation since
Autopilot doesn't expose the node socket. Runner token pulled from Secret
Manager via ESO + Workload Identity.

- servers/gcp/k8s/gitea-runner/: namespace, serviceaccount, external-secrets,
  deployment manifests (ci namespace, dind sidecar, idempotent registration)
- servers/gcp/k8s/argocd-apps/gitea-runner-gke.yaml: Argo CD Application
- servers/gcp/gitea-runner.tf: gitea-runner-gke GCP SA with secretAccessor
  on gitea-runner-token, Workload Identity binding for ci/gitea-runner,
  artifactregistry.reader for pulling ci-base image

This commit is contained in:

Will Anderson

2026-05-05 10:16:49 -05:00

parent 4dc687f2ae

commit c31edc8b83

6 changed files with 245 additions and 0 deletions

									
										servers/gcp/k8s/gitea-runner/namespace.yaml
									
		+8
		
												View File
												
				@@ -0,0 +1,8 @@

				apiVersion: v1

				kind: Namespace

				metadata:

				  name: ci

				  labels:

				    app.kubernetes.io/name: ci

				    # DinD (Docker-in-Docker) requires privileged pods.

				    pod-security.kubernetes.io/enforce: privileged