Something went wrong. Try again.
A Forgejo Runner plugin that spawn jobs as Kubernetes pods
kubernetes ci forgejo runner
Something went wrong. Try again.
123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156apiVersion: v1kind: ServiceAccountmetadata: name: forgejo-actions-job namespace: forgejo-e2e---apiVersion: v1kind: Secretmetadata: name: forgejo-runner-config namespace: forgejo-e2e annotations: e2e.kuranto.dev/forgejo-pod-uid: "$E2E_FORGEJO_POD_UID"type: OpaquestringData: runner-uuid: "$E2E_FORGEJO_RUNNER_UUID" runner-token: "$E2E_FORGEJO_RUNNER_TOKEN" config.yml: | log: level: info job_level: info runner: capacity: $E2E_RUNNER_CAPACITY labels: - "kubernetes:kubernetes://data.forgejo.org/oci/node:lts" - "dummy:kubernetes://docker.io/alpine:latest" plugins: kubernetes: address: "127.0.0.1:50051" options: namespace: "forgejo-e2e" server: connections: primary: url: "http://forgejo.forgejo-e2e.svc.cluster.local" uuid: "$E2E_FORGEJO_RUNNER_UUID" token: "$E2E_FORGEJO_RUNNER_TOKEN"---apiVersion: v1kind: ConfigMapmetadata: name: forgejo-runner-ssh namespace: forgejo-e2edata: sshd_config: | Port 22 ListenAddress 0.0.0.0 HostKey /tmp/ssh_host_ed25519_key PidFile /tmp/sshd.pid AuthorizedKeysFile /root/.ssh/authorized_keys StrictModes yes AllowUsers root PermitRootLogin prohibit-password PubkeyAuthentication yes AuthenticationMethods publickey PasswordAuthentication no KbdInteractiveAuthentication no PermitEmptyPasswords no UsePAM no AllowTcpForwarding remote AllowStreamLocalForwarding no PermitListen 127.0.0.1:50051 GatewayPorts no PermitTTY no X11Forwarding no AllowAgentForwarding no PermitUserRC no ForceCommand /bin/false LogLevel VERBOSE---apiVersion: apps/v1kind: Deploymentmetadata: name: forgejo-runner namespace: forgejo-e2espec: replicas: 1 # Never run two daemons using the same registration or SSH listening port. strategy: type: Recreate selector: matchLabels: app: forgejo-runner template: metadata: labels: app: forgejo-runner annotations: e2e.kuranto.dev/manifest-hash: "$E2E_RUNNER_MANIFEST_HASH" e2e.kuranto.dev/ssh-key-hash: "$E2E_SSH_KEY_HASH" e2e.kuranto.dev/forgejo-pod-uid: "$E2E_FORGEJO_POD_UID" spec: automountServiceAccountToken: false containers: - name: runner image: code.forgejo.org/forgejo/runner:13.2.0 imagePullPolicy: IfNotPresent command: ["forgejo-runner"] args: ["daemon", "--config", "/etc/forgejo-runner/config.yml"] securityContext: allowPrivilegeEscalation: false volumeMounts: - name: runner-config mountPath: /etc/forgejo-runner readOnly: true - name: ssh-relay image: lscr.io/linuxserver/openssh-server:latest imagePullPolicy: IfNotPresent securityContext: runAsUser: 0 runAsGroup: 0 allowPrivilegeEscalation: false command: ["/bin/sh", "-ec"] args: - | mkdir -p /run/sshd /root/.ssh chmod 0700 /root/.ssh cp /etc/ssh-relay/keys/authorized_keys /root/.ssh/authorized_keys chmod 0600 /root/.ssh/authorized_keys # Unlock the image's root account, but never allow password login. passwd -d root rm -f /tmp/ssh_host_ed25519_key /tmp/ssh_host_ed25519_key.pub ssh-keygen -q -t ed25519 -N '' -f /tmp/ssh_host_ed25519_key /usr/sbin/sshd.pam -t -f /etc/ssh-relay/config/sshd_config exec /usr/sbin/sshd.pam -D -e -f /etc/ssh-relay/config/sshd_config ports: - name: ssh containerPort: 22 readinessProbe: tcpSocket: port: ssh periodSeconds: 2 livenessProbe: tcpSocket: port: ssh initialDelaySeconds: 10 periodSeconds: 10 volumeMounts: - name: ssh-keys mountPath: /etc/ssh-relay/keys readOnly: true - name: ssh-config mountPath: /etc/ssh-relay/config readOnly: true volumes: - name: runner-config secret: secretName: forgejo-runner-config - name: ssh-keys secret: secretName: forgejo-runner-ssh defaultMode: 0400 - name: ssh-config configMap: name: forgejo-runner-ssh