Will Anderson
c31edc8b83
Replaces the GCE VM runner with a k8s Deployment in the ci namespace on neuron-platform GKE. Uses Docker-in-Docker for build isolation since Autopilot doesn't expose the node socket. Runner token pulled from Secret Manager via ESO + Workload Identity. - servers/gcp/k8s/gitea-runner/: namespace, serviceaccount, external-secrets, deployment manifests (ci namespace, dind sidecar, idempotent registration) - servers/gcp/k8s/argocd-apps/gitea-runner-gke.yaml: Argo CD Application - servers/gcp/gitea-runner.tf: gitea-runner-gke GCP SA with secretAccessor on gitea-runner-token, Workload Identity binding for ci/gitea-runner, artifactregistry.reader for pulling ci-base image
40 lines
1.0 KiB
YAML
40 lines
1.0 KiB
YAML
---
|
|
# SecretStore for the CI namespace — uses GCP Secret Manager via Workload Identity.
|
|
# The gitea-runner-gke GCP SA has secretmanager.secretAccessor on gitea-runner-token
|
|
# (see servers/gcp/gitea-runner.tf).
|
|
apiVersion: external-secrets.io/v1
|
|
kind: SecretStore
|
|
metadata:
|
|
name: gcp-secretmanager
|
|
namespace: ci
|
|
spec:
|
|
provider:
|
|
gcpsm:
|
|
projectID: neuron-785695
|
|
auth:
|
|
workloadIdentity:
|
|
clusterLocation: us-central1
|
|
clusterName: neuron-platform
|
|
serviceAccountRef:
|
|
name: gitea-runner
|
|
namespace: ci
|
|
---
|
|
# Pull the Gitea runner registration token from Secret Manager into a k8s Secret.
|
|
apiVersion: external-secrets.io/v1
|
|
kind: ExternalSecret
|
|
metadata:
|
|
name: gitea-runner-token
|
|
namespace: ci
|
|
spec:
|
|
refreshInterval: 1h
|
|
secretStoreRef:
|
|
name: gcp-secretmanager
|
|
kind: SecretStore
|
|
target:
|
|
name: gitea-runner-token
|
|
creationPolicy: Owner
|
|
data:
|
|
- secretKey: GITEA_RUNNER_REGISTRATION_TOKEN
|
|
remoteRef:
|
|
key: gitea-runner-token
|