Will Anderson
5868607c27
The in-cluster service DNS (`gitea.git.svc.cluster.local`) is not resolvable from build containers running with `network: host`. The runner config has an `extra_hosts` mapping for this name, but `host` networking shares the host's network namespace and bypasses the container-level hosts file — which silently nullifies the mapping. Symptom: every Gitea Actions run on `dharma-el` (and any other neuron-technologies repo that has CI defined) failed at the first `actions/checkout` step with `Could not resolve host: gitea.git.svc.cluster.local`. CI had never actually validated for that org. Fix: register both the `will` and `neuron-technologies` runners with the public URL `https://git.neuralplatform.ai`. The runner polls Gitea over Cloudflare, and the build container's clone URL is derived from the runner's instance URL, so it inherits a name the build container can resolve. Also bumped `config-version` annotations on both runner deployments to force a rolling restart — the init container needs to re-register with the new URL. Trade-off: the runner now polls Gitea over Cloudflare instead of directly on the cluster network. Latency cost is small relative to build time, and the failure mode is gone.
58 lines
1.8 KiB
YAML
58 lines
1.8 KiB
YAML
---
|
|
# gitea-runner-secret — neural-platform org runner token
|
|
apiVersion: external-secrets.io/v1beta1
|
|
kind: ExternalSecret
|
|
metadata:
|
|
name: gitea-runner-secret
|
|
namespace: ci
|
|
annotations:
|
|
force-sync: "2026-04-23"
|
|
spec:
|
|
refreshInterval: 1h
|
|
secretStoreRef:
|
|
name: vault
|
|
kind: ClusterSecretStore
|
|
target:
|
|
name: gitea-runner-secret
|
|
creationPolicy: Owner
|
|
template:
|
|
data:
|
|
# Public URL — the in-cluster name (gitea.git.svc.cluster.local) is
|
|
# not resolvable from build containers running with `network: host`,
|
|
# which causes `git fetch` to fail at the very first checkout step.
|
|
# The runner polls Gitea over Cloudflare; the latency cost is small
|
|
# and the build container's clone URL is derived from this instance,
|
|
# so it has to be a name the build container can resolve.
|
|
GITEA_INSTANCE_URL: "https://git.neuralplatform.ai"
|
|
GITEA_RUNNER_REGISTRATION_TOKEN: "{{ .runner_token }}"
|
|
data:
|
|
- secretKey: runner_token
|
|
remoteRef:
|
|
key: secret/data/gitea
|
|
property: runner_token
|
|
---
|
|
# neuron-technologies-runner-secret — neuron-technologies org runner token
|
|
apiVersion: external-secrets.io/v1beta1
|
|
kind: ExternalSecret
|
|
metadata:
|
|
name: neuron-technologies-runner-secret
|
|
namespace: ci
|
|
spec:
|
|
refreshInterval: 1h
|
|
secretStoreRef:
|
|
name: vault
|
|
kind: ClusterSecretStore
|
|
target:
|
|
name: neuron-technologies-runner-secret
|
|
creationPolicy: Owner
|
|
template:
|
|
data:
|
|
# Public URL — see commentary on the gitea-runner-secret above.
|
|
GITEA_INSTANCE_URL: "https://git.neuralplatform.ai"
|
|
GITEA_RUNNER_REGISTRATION_TOKEN: "{{ .runner_token }}"
|
|
data:
|
|
- secretKey: runner_token
|
|
remoteRef:
|
|
key: secret/data/gitea
|
|
property: neuron_technologies_runner_token
|