Will Anderson
4dc687f2ae
Build containers run with network: host, so k8s DNS doesn't resolve. Add extra_hosts entry pointing gitea-proxy.ci.svc.cluster.local to its ClusterIP (10.43.88.7) in both the will-org and neuron-technologies runner configs. Without this, actions/checkout fails because Gitea passes the proxy hostname as GITHUB_SERVER_URL and the build container can't reach it. Also update stale CF Access comments that no longer reflect the architecture.
183 lines
6.0 KiB
YAML
183 lines
6.0 KiB
YAML
---
|
|
# Gitea Actions runner — will org
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: gitea-runner
|
|
namespace: ci
|
|
labels:
|
|
app: gitea-runner
|
|
annotations:
|
|
config-version: "2026-05-05-extra-hosts"
|
|
spec:
|
|
replicas: 1
|
|
selector:
|
|
matchLabels:
|
|
app: gitea-runner
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: gitea-runner
|
|
annotations:
|
|
config-version: "2026-05-05-extra-hosts"
|
|
spec:
|
|
securityContext:
|
|
runAsNonRoot: false
|
|
initContainers:
|
|
- name: register
|
|
image: registry.neuralplatform.ai/ci-base:latest
|
|
command: ["/bin/sh", "-c"]
|
|
args:
|
|
- |
|
|
act_runner register \
|
|
--instance "$GITEA_INSTANCE_URL" \
|
|
--token "$GITEA_RUNNER_REGISTRATION_TOKEN" \
|
|
--name legion \
|
|
--labels "self-hosted:docker://registry.neuralplatform.ai/ci-base:latest,ubuntu-latest:docker://registry.neuralplatform.ai/ci-base:latest,ubuntu-24.04:docker://registry.neuralplatform.ai/ci-base:latest,linux,x64" \
|
|
--no-interactive
|
|
cat > /data/config.yaml << EOF
|
|
runner:
|
|
capacity: 2
|
|
timeout: 3h
|
|
container:
|
|
network: host
|
|
docker_host: "unix:///var/run/docker.sock"
|
|
force_pull: true
|
|
valid_volumes: []
|
|
default_image: "registry.neuralplatform.ai/ci-base:latest"
|
|
env:
|
|
GITEA_SSH_PRIVATE_KEY: "${GITEA_SSH_PRIVATE_KEY}"
|
|
BASH_ENV: "/usr/local/bin/git-ssh-init.sh"
|
|
# Build containers run with network: host, so k8s DNS names
|
|
# don't resolve. Inject the gitea-proxy ClusterIP so that
|
|
# actions/checkout can reach gitea-proxy.ci.svc.cluster.local
|
|
# (the URL Gitea passes as GITHUB_SERVER_URL to the runner).
|
|
extra_hosts:
|
|
- "gitea-proxy.ci.svc.cluster.local:10.43.88.7"
|
|
EOF
|
|
envFrom:
|
|
- secretRef:
|
|
name: gitea-runner-secret
|
|
volumeMounts:
|
|
- mountPath: /data
|
|
name: data
|
|
workingDir: /data
|
|
containers:
|
|
- name: runner
|
|
image: registry.neuralplatform.ai/ci-base:latest
|
|
command: ["act_runner", "daemon", "--config", "/data/config.yaml"]
|
|
envFrom:
|
|
- secretRef:
|
|
name: gitea-runner-secret
|
|
resources:
|
|
requests:
|
|
cpu: "250m"
|
|
memory: "512Mi"
|
|
limits:
|
|
cpu: "4"
|
|
memory: "4Gi"
|
|
volumeMounts:
|
|
- mountPath: /data
|
|
name: data
|
|
- mountPath: /var/run/docker.sock
|
|
name: docker-sock
|
|
workingDir: /data
|
|
volumes:
|
|
- name: data
|
|
emptyDir: {}
|
|
- name: docker-sock
|
|
hostPath:
|
|
path: /var/run/docker.sock
|
|
type: Socket
|
|
---
|
|
# Gitea Actions runner — neuron-technologies org
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: neuron-technologies-runner
|
|
namespace: ci
|
|
labels:
|
|
app: neuron-technologies-runner
|
|
annotations:
|
|
config-version: "2026-05-05-extra-hosts"
|
|
spec:
|
|
replicas: 2
|
|
selector:
|
|
matchLabels:
|
|
app: neuron-technologies-runner
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: neuron-technologies-runner
|
|
annotations:
|
|
config-version: "2026-05-05-extra-hosts"
|
|
spec:
|
|
securityContext:
|
|
runAsNonRoot: false
|
|
initContainers:
|
|
- name: register
|
|
image: registry.neuralplatform.ai/ci-base:latest
|
|
command: ["/bin/sh", "-c"]
|
|
args:
|
|
- |
|
|
act_runner register \
|
|
--instance "$GITEA_INSTANCE_URL" \
|
|
--token "$GITEA_RUNNER_REGISTRATION_TOKEN" \
|
|
--name "legion-nt-$(hostname)" \
|
|
--labels "self-hosted:docker://registry.neuralplatform.ai/ci-base:latest,ubuntu-latest:docker://registry.neuralplatform.ai/ci-base:latest,ubuntu-24.04:docker://registry.neuralplatform.ai/ci-base:latest,linux,x64" \
|
|
--no-interactive
|
|
cat > /data/config.yaml << EOF
|
|
runner:
|
|
capacity: 2
|
|
timeout: 3h
|
|
container:
|
|
network: host
|
|
docker_host: "unix:///var/run/docker.sock"
|
|
force_pull: true
|
|
valid_volumes: []
|
|
default_image: "registry.neuralplatform.ai/ci-base:latest"
|
|
# Build containers run with network: host, so k8s DNS names
|
|
# don't resolve. Inject the gitea-proxy ClusterIP so that
|
|
# actions/checkout can reach gitea-proxy.ci.svc.cluster.local
|
|
# (the URL Gitea passes as GITHUB_SERVER_URL to the runner).
|
|
env:
|
|
GITEA_SSH_PRIVATE_KEY: "${GITEA_SSH_PRIVATE_KEY}"
|
|
BASH_ENV: "/usr/local/bin/git-ssh-init.sh"
|
|
extra_hosts:
|
|
- "gitea-proxy.ci.svc.cluster.local:10.43.88.7"
|
|
EOF
|
|
envFrom:
|
|
- secretRef:
|
|
name: neuron-technologies-runner-secret
|
|
volumeMounts:
|
|
- mountPath: /data
|
|
name: data
|
|
workingDir: /data
|
|
containers:
|
|
- name: runner
|
|
image: registry.neuralplatform.ai/ci-base:latest
|
|
command: ["act_runner", "daemon", "--config", "/data/config.yaml"]
|
|
envFrom:
|
|
- secretRef:
|
|
name: neuron-technologies-runner-secret
|
|
resources:
|
|
requests:
|
|
cpu: "250m"
|
|
memory: "512Mi"
|
|
limits:
|
|
cpu: "4"
|
|
memory: "4Gi"
|
|
volumeMounts:
|
|
- mountPath: /data
|
|
name: data
|
|
- mountPath: /var/run/docker.sock
|
|
name: docker-sock
|
|
workingDir: /data
|
|
volumes:
|
|
- name: data
|
|
emptyDir: {}
|
|
- name: docker-sock
|
|
hostPath:
|
|
path: /var/run/docker.sock
|
|
type: Socket
|