Will Anderson
bec948bcca
The Gitea Actions runners on Legion need build containers to be able to clone repos. They run with network: host so they can't resolve gitea.git.svc.cluster.local — they have to use the public URL. The public URL sits behind Cloudflare Access, which is why the previous naive switch (#3) had to be reverted. This change keeps the runner daemon registered against the in-cluster URL (no CF Access on the polling loop) but rewrites http://gitea.git.svc.cluster.local:3000/ to https://git.neuralplatform.ai/ inside the build container, with the CF Access service-token headers injected via git extraHeader. The redirect script is sourced before every job step via BASH_ENV; the CF Access credentials reach the build container through act_runner's container.env, which we now populate from the new gitea-runner-cf-access Vault path that PR #5's Terraform writes. Known limitation documented in the init script: actions/checkout's per-job auth header is keyed to the in-cluster URL and gets dropped after the insteadOf rewrite. Public repos work; private repos that need that token will need a follow-up.
81 lines
2.6 KiB
YAML
81 lines
2.6 KiB
YAML
---
|
|
# gitea-runner-secret — neural-platform org runner token
|
|
#
|
|
# GITEA_INSTANCE_URL stays as the in-cluster URL — the act_runner daemon
|
|
# polls it constantly and we don't want every poll to hit Cloudflare Access.
|
|
# Build containers, however, need the public URL because they run with
|
|
# network: host and can't resolve gitea.git.svc.cluster.local. The
|
|
# git-cf-access-init.sh entrypoint in the ci-base image rewrites the
|
|
# in-cluster URL to https://git.neuralplatform.ai with the CF Access
|
|
# headers from CF_ACCESS_CLIENT_ID / CF_ACCESS_CLIENT_SECRET below.
|
|
apiVersion: external-secrets.io/v1beta1
|
|
kind: ExternalSecret
|
|
metadata:
|
|
name: gitea-runner-secret
|
|
namespace: ci
|
|
annotations:
|
|
force-sync: "2026-05-04-cf-access"
|
|
spec:
|
|
refreshInterval: 1h
|
|
secretStoreRef:
|
|
name: vault
|
|
kind: ClusterSecretStore
|
|
target:
|
|
name: gitea-runner-secret
|
|
creationPolicy: Owner
|
|
template:
|
|
data:
|
|
GITEA_INSTANCE_URL: "http://gitea.git.svc.cluster.local:3000"
|
|
GITEA_RUNNER_REGISTRATION_TOKEN: "{{ .runner_token }}"
|
|
CF_ACCESS_CLIENT_ID: "{{ .cf_access_client_id }}"
|
|
CF_ACCESS_CLIENT_SECRET: "{{ .cf_access_client_secret }}"
|
|
data:
|
|
- secretKey: runner_token
|
|
remoteRef:
|
|
key: secret/data/gitea
|
|
property: runner_token
|
|
- secretKey: cf_access_client_id
|
|
remoteRef:
|
|
key: secret/data/gitea-runner-cf-access
|
|
property: client_id
|
|
- secretKey: cf_access_client_secret
|
|
remoteRef:
|
|
key: secret/data/gitea-runner-cf-access
|
|
property: client_secret
|
|
---
|
|
# neuron-technologies-runner-secret — neuron-technologies org runner token
|
|
apiVersion: external-secrets.io/v1beta1
|
|
kind: ExternalSecret
|
|
metadata:
|
|
name: neuron-technologies-runner-secret
|
|
namespace: ci
|
|
annotations:
|
|
force-sync: "2026-05-04-cf-access"
|
|
spec:
|
|
refreshInterval: 1h
|
|
secretStoreRef:
|
|
name: vault
|
|
kind: ClusterSecretStore
|
|
target:
|
|
name: neuron-technologies-runner-secret
|
|
creationPolicy: Owner
|
|
template:
|
|
data:
|
|
GITEA_INSTANCE_URL: "http://gitea.git.svc.cluster.local:3000"
|
|
GITEA_RUNNER_REGISTRATION_TOKEN: "{{ .runner_token }}"
|
|
CF_ACCESS_CLIENT_ID: "{{ .cf_access_client_id }}"
|
|
CF_ACCESS_CLIENT_SECRET: "{{ .cf_access_client_secret }}"
|
|
data:
|
|
- secretKey: runner_token
|
|
remoteRef:
|
|
key: secret/data/gitea
|
|
property: neuron_technologies_runner_token
|
|
- secretKey: cf_access_client_id
|
|
remoteRef:
|
|
key: secret/data/gitea-runner-cf-access
|
|
property: client_id
|
|
- secretKey: cf_access_client_secret
|
|
remoteRef:
|
|
key: secret/data/gitea-runner-cf-access
|
|
property: client_secret
|