Will Anderson
939e66bfbb
act_runner cannot inject custom HTTP headers, so CF Access blocks its unauthenticated calls to git.neuralplatform.ai. Add a gitea-proxy deployment (nginx:alpine) in the ci namespace that injects the CF Access service-token headers and proxies to https://git.neuralplatform.ai. Both runner secrets now point GITEA_INSTANCE_URL at the in-cluster proxy (http://gitea-proxy.ci.svc.cluster.local:3000). Build containers still clone via SSH through git-ssh-init.sh — unaffected.
70 lines
2.1 KiB
YAML
70 lines
2.1 KiB
YAML
---
|
|
# gitea-runner-secret — neural-platform org runner token
|
|
#
|
|
# GITEA_INSTANCE_URL: act_runner daemon polls git.neuralplatform.ai via HTTPS.
|
|
# GITEA_SSH_PRIVATE_KEY: ED25519 deploy key for SSH-based git clones inside
|
|
# build containers. git-ssh-init.sh (sourced via BASH_ENV) writes this key
|
|
# to ~/.ssh/gitea_key and rewrites HTTPS Gitea URLs to SSH so that
|
|
# actions/checkout and plain `git clone` both use SSH auth without any
|
|
# HTTPS credential or CF Access token.
|
|
apiVersion: external-secrets.io/v1beta1
|
|
kind: ExternalSecret
|
|
metadata:
|
|
name: gitea-runner-secret
|
|
namespace: ci
|
|
annotations:
|
|
force-sync: "2026-05-05-gitea-proxy"
|
|
spec:
|
|
refreshInterval: 1h
|
|
secretStoreRef:
|
|
name: vault
|
|
kind: ClusterSecretStore
|
|
target:
|
|
name: gitea-runner-secret
|
|
creationPolicy: Owner
|
|
template:
|
|
data:
|
|
GITEA_INSTANCE_URL: "http://gitea-proxy.ci.svc.cluster.local:3000"
|
|
GITEA_RUNNER_REGISTRATION_TOKEN: "{{ .runner_token }}"
|
|
GITEA_SSH_PRIVATE_KEY: "{{ .ci_ssh_private_key }}"
|
|
data:
|
|
- secretKey: runner_token
|
|
remoteRef:
|
|
key: secret/data/gitea
|
|
property: runner_token
|
|
- secretKey: ci_ssh_private_key
|
|
remoteRef:
|
|
key: secret/data/gitea
|
|
property: ci_ssh_private_key
|
|
---
|
|
# neuron-technologies-runner-secret — neuron-technologies org runner token
|
|
apiVersion: external-secrets.io/v1beta1
|
|
kind: ExternalSecret
|
|
metadata:
|
|
name: neuron-technologies-runner-secret
|
|
namespace: ci
|
|
annotations:
|
|
force-sync: "2026-05-05-gitea-proxy"
|
|
spec:
|
|
refreshInterval: 1h
|
|
secretStoreRef:
|
|
name: vault
|
|
kind: ClusterSecretStore
|
|
target:
|
|
name: neuron-technologies-runner-secret
|
|
creationPolicy: Owner
|
|
template:
|
|
data:
|
|
GITEA_INSTANCE_URL: "http://gitea-proxy.ci.svc.cluster.local:3000"
|
|
GITEA_RUNNER_REGISTRATION_TOKEN: "{{ .runner_token }}"
|
|
GITEA_SSH_PRIVATE_KEY: "{{ .ci_ssh_private_key }}"
|
|
data:
|
|
- secretKey: runner_token
|
|
remoteRef:
|
|
key: secret/data/gitea
|
|
property: neuron_technologies_runner_token
|
|
- secretKey: ci_ssh_private_key
|
|
remoteRef:
|
|
key: secret/data/gitea
|
|
property: ci_ssh_private_key
|