yyvf22 pushed to branch main at Root / Kubernetes / FluxCD

Commits:

8 changed files:

Changes:

  • apps/stage/kustomization.yaml
    ... ... @@ -5,7 +5,6 @@ resources:
    5 5 
       # Apps
    6 6 
       - ../base/ademir
    7 7 
       - ../base/codimd
    8 
    -  - ../base/gitlab-runner
    9 8 
       - ../base/harbor
    10 9 
       - ../base/keycloak
    11 10 
       - ../base/matrix

  • infrastructure/base/gitlab-runner/es.yaml
    1 
    +apiVersion: external-secrets.io/v1
    2 
    +kind: ExternalSecret
    3 
    +metadata:
    4 
    +  name: gitlab-runner
    5 
    +  namespace: gitlab-runner
    6 
    +spec:
    7 
    +  refreshInterval: "15s"
    8 
    +  secretStoreRef:
    9 
    +    name: openbao
    10 
    +    kind: ClusterSecretStore
    11 
    +  target:
    12 
    +    name: gitlab-runner
    13 
    +  data:
    14 
    +    - secretKey: tokenUnprivileged
    15 
    +      remoteRef:
    16 
    +        key: gitlab-runner
    17 
    +        property: tokenUnprivileged
    18 
    +    - secretKey: tokenPrivilegedRoot
    19 
    +      remoteRef:
    20 
    +        key: gitlab-runner
    21 
    +        property: tokenPrivilegedRoot
    22 
    +    - secretKey: tokenPrivilegedC3SL
    23 
    +      remoteRef:
    24 
    +        key: gitlab-runner
    25 
    +        property: tokenPrivilegedC3SL

  • infrastructure/base/gitlab-runner/helmrelease.yaml
    1 
    +apiVersion: helm.toolkit.fluxcd.io/v2beta1
    2 
    +kind: HelmRelease
    3 
    +metadata:
    4 
    +  name: unprivileged
    5 
    +  namespace: gitlab-runner
    6 
    +spec:
    7 
    +  interval: 1m
    8 
    +  chart:
    9 
    +    spec:
    10 
    +      chart: gitlab-runner
    11 
    +      sourceRef:
    12 
    +        kind: HelmRepository
    13 
    +        name: gitlab-runner
    14 
    +  values:
    15 
    +    replicas: 1
    16 
    +    gitlabUrl: https://gitlab.c3sl.ufpr.br
    17 
    +    rbac:
    18 
    +      create: true
    19 
    +    serviceAccount:
    20 
    +      create: true
    21 
    +    runners:
    22 
    +      executor: kubernetes
    23 
    +      config: |
    24 
    +        [[runners]]
    25 
    +          shell = "bash"
    26 
    +          environment = ["FF_USE_ADVANCED_POD_SPEC_CONFIGURATION=true"]
    27 
    +          [runners.kubernetes]
    28 
    +            image = "harbor.c3sl.ufpr.br/root/gitlab-runner-base:latest"
    29 
    +            ephemeral_storage_limit = "5Gi"
    30 
    +            helper_ephemeral_storage_limit = "5Gi"
    31 
    +            service_ephemeral_storage_limit = "5Gi"
    32 
    +          [[runners.kubernetes.volumes.pvc]]
    33 
    +            name = "unprivileged-gitlab-runner-cache"
    34 
    +            mount_path = "/cache"
    35 
    +          [[runners.kubernetes.pod_spec]]
    36 
    +            name = "ephemeral-pvc"
    37 
    +            patch = '''
    38 
    +              containers:
    39 
    +              - name: build
    40 
    +                volumeMounts:
    41 
    +                - name: builds
    42 
    +                  mountPath: /builds
    43 
    +              - name: helper
    44 
    +                volumeMounts:
    45 
    +                - name: builds
    46 
    +                  mountPath: /builds
    47 
    +              volumes:
    48 
    +              - name: builds
    49 
    +                ephemeral:
    50 
    +                  volumeClaimTemplate:
    51 
    +                    spec:
    52 
    +                      storageClassName: csi-rbd-sc
    53 
    +                      accessModes: [ ReadWriteOnce ]
    54 
    +                      resources:
    55 
    +                        requests:
    56 
    +                          storage: 5Gi
    57 
    +            '''
    58 
    +    securityContext:
    59 
    +      allowPrivilegeEscalation: false
    60 
    +      readOnlyRootFilesystem: false
    61 
    +      runAsNonRoot: true
    62 
    +      privileged: false
    63 
    +  valuesFrom:
    64 
    +    - kind: Secret
    65 
    +      name: gitlab-runner
    66 
    +      valuesKey: tokenUnprivileged
    67 
    +      targetPath: runnerToken
    68 
    +---
    69 
    +apiVersion: helm.toolkit.fluxcd.io/v2beta1
    70 
    +kind: HelmRelease
    71 
    +metadata:
    72 
    +  name: privileged-root
    73 
    +  namespace: gitlab-runner
    74 
    +spec:
    75 
    +  interval: 1m
    76 
    +  chart:
    77 
    +    spec:
    78 
    +      chart: gitlab-runner
    79 
    +      sourceRef:
    80 
    +        kind: HelmRepository
    81 
    +        name: gitlab-runner
    82 
    +  values:
    83 
    +    replicas: 1
    84 
    +    gitlabUrl: https://gitlab.c3sl.ufpr.br
    85 
    +    rbac:
    86 
    +      create: true
    87 
    +    serviceAccount:
    88 
    +      create: true
    89 
    +    runners:
    90 
    +      executor: kubernetes
    91 
    +      config: |
    92 
    +        [[runners]]
    93 
    +          shell = "bash"
    94 
    +          environment = ["FF_USE_ADVANCED_POD_SPEC_CONFIGURATION=true"]
    95 
    +          [runners.kubernetes]
    96 
    +            privileged = true
    97 
    +            image = "harbor.c3sl.ufpr.br/root/gitlab-runner-base:latest"
    98 
    +            ephemeral_storage_limit = "5Gi"
    99 
    +            helper_ephemeral_storage_limit = "5Gi"
    100 
    +            service_ephemeral_storage_limit = "5Gi"
    101 
    +          [[runners.kubernetes.volumes.pvc]]
    102 
    +            name = "privileged-root-gitlab-runner-cache"
    103 
    +            mount_path = "/cache"
    104 
    +          [[runners.kubernetes.pod_spec]]
    105 
    +            name = "ephemeral-pvc"
    106 
    +            patch = '''
    107 
    +              containers:
    108 
    +              - name: build
    109 
    +                volumeMounts:
    110 
    +                - name: builds
    111 
    +                  mountPath: /builds
    112 
    +              - name: helper
    113 
    +                volumeMounts:
    114 
    +                - name: builds
    115 
    +                  mountPath: /builds
    116 
    +              volumes:
    117 
    +              - name: builds
    118 
    +                ephemeral:
    119 
    +                  volumeClaimTemplate:
    120 
    +                    spec:
    121 
    +                      storageClassName: csi-rbd-sc
    122 
    +                      accessModes: [ ReadWriteOnce ]
    123 
    +                      resources:
    124 
    +                        requests:
    125 
    +                          storage: 5Gi
    126 
    +            '''
    127 
    +  valuesFrom:
    128 
    +    - kind: Secret
    129 
    +      name: gitlab-runner
    130 
    +      valuesKey: tokenPrivilegedRoot
    131 
    +      targetPath: runnerToken
    132 
    +---
    133 
    +apiVersion: helm.toolkit.fluxcd.io/v2beta1
    134 
    +kind: HelmRelease
    135 
    +metadata:
    136 
    +  name: privileged-c3sl
    137 
    +  namespace: gitlab-runner
    138 
    +spec:
    139 
    +  interval: 1m
    140 
    +  chart:
    141 
    +    spec:
    142 
    +      chart: gitlab-runner
    143 
    +      sourceRef:
    144 
    +        kind: HelmRepository
    145 
    +        name: gitlab-runner
    146 
    +  values:
    147 
    +    replicas: 1
    148 
    +    gitlabUrl: https://gitlab.c3sl.ufpr.br
    149 
    +    rbac:
    150 
    +      create: true
    151 
    +    serviceAccount:
    152 
    +      create: true
    153 
    +    runners:
    154 
    +      executor: kubernetes
    155 
    +      config: |
    156 
    +        [[runners]]
    157 
    +          shell = "bash"
    158 
    +          environment = ["FF_USE_ADVANCED_POD_SPEC_CONFIGURATION=true"]
    159 
    +          [runners.kubernetes]
    160 
    +            privileged = true
    161 
    +            image = "harbor.c3sl.ufpr.br/root/gitlab-runner-base:latest"
    162 
    +            ephemeral_storage_limit = "5Gi"
    163 
    +            helper_ephemeral_storage_limit = "5Gi"
    164 
    +            service_ephemeral_storage_limit = "5Gi"
    165 
    +          [[runners.kubernetes.volumes.pvc]]
    166 
    +            name = "privileged-c3sl-gitlab-runner-cache"
    167 
    +            mount_path = "/cache"
    168 
    +          [[runners.kubernetes.pod_spec]]
    169 
    +            name = "ephemeral-pvc"
    170 
    +            patch = '''
    171 
    +              containers:
    172 
    +              - name: build
    173 
    +                volumeMounts:
    174 
    +                - name: builds
    175 
    +                  mountPath: /builds
    176 
    +              - name: helper
    177 
    +                volumeMounts:
    178 
    +                - name: builds
    179 
    +                  mountPath: /builds
    180 
    +              volumes:
    181 
    +              - name: builds
    182 
    +                ephemeral:
    183 
    +                  volumeClaimTemplate:
    184 
    +                    spec:
    185 
    +                      storageClassName: csi-rbd-sc
    186 
    +                      accessModes: [ ReadWriteOnce ]
    187 
    +                      resources:
    188 
    +                        requests:
    189 
    +                          storage: 5Gi
    190 
    +            '''
    191 
    +  valuesFrom:
    192 
    +    - kind: Secret
    193 
    +      name: gitlab-runner
    194 
    +      valuesKey: tokenPrivilegedC3SL
    195 
    +      targetPath: runnerToken

  • infrastructure/base/gitlab-runner/helmrepo.yaml
    1 
    +apiVersion: source.toolkit.fluxcd.io/v1
    2 
    +kind: HelmRepository
    3 
    +metadata:
    4 
    +  name: gitlab-runner
    5 
    +  namespace: gitlab-runner
    6 
    +spec:
    7 
    +  interval: 1m0s
    8 
    +  url: https://charts.gitlab.io

  • infrastructure/base/gitlab-runner/kustomization.yaml
    1 
    +apiVersion: kustomize.config.k8s.io/v1beta1
    2 
    +kind: Kustomization
    3 
    +resources:
    4 
    +  - ns.yaml
    5 
    +  - helmrepo.yaml
    6 
    +  - helmrelease.yaml
    7 
    +  - es.yaml
    8 
    +  - pvc.yaml

  • infrastructure/base/gitlab-runner/ns.yaml
    1 
    +apiVersion: v1
    2 
    +kind: Namespace
    3 
    +metadata:
    4 
    +  labels:
    5 
    +    pod-security.kubernetes.io/enforce: privileged
    6 
    +  name: gitlab-runner

  • infrastructure/base/gitlab-runner/pvc.yaml
    1 
    +apiVersion: v1
    2 
    +kind: PersistentVolumeClaim
    3 
    +metadata:
    4 
    +  name: privileged-root-gitlab-runner-cache
    5 
    +  namespace: gitlab-runner
    6 
    +  labels:
    7 
    +    app: gitlab-runner
    8 
    +spec:
    9 
    +  accessModes:
    10 
    +    - ReadWriteOnce
    11 
    +  resources:
    12 
    +    requests:
    13 
    +      storage: 20Gi
    14 
    +---
    15 
    +apiVersion: v1
    16 
    +kind: PersistentVolumeClaim
    17 
    +metadata:
    18 
    +  name: privileged-c3sl-gitlab-runner-cache
    19 
    +  namespace: gitlab-runner
    20 
    +  labels:
    21 
    +    app: gitlab-runner
    22 
    +spec:
    23 
    +  accessModes:
    24 
    +    - ReadWriteOnce
    25 
    +  resources:
    26 
    +    requests:
    27 
    +      storage: 20Gi
    28 
    +---
    29 
    +apiVersion: v1
    30 
    +kind: PersistentVolumeClaim
    31 
    +metadata:
    32 
    +  name: unprivileged-gitlab-runner-cache
    33 
    +  namespace: gitlab-runner
    34 
    +  labels:
    35 
    +    app: gitlab-runner
    36 
    +spec:
    37 
    +  accessModes:
    38 
    +    - ReadWriteOnce
    39 
    +  resources:
    40 
    +    requests:
    41 
    +      storage: 20Gi

  • infrastructure/stage/kustomization.yaml
    ... ... @@ -2,8 +2,9 @@ apiVersion: kustomize.config.k8s.io/v1beta1
    2 2 
     kind: Kustomization
    3 3 
     resources:
    4 4 
       - ../base/cilium
    5 
    +  - ./ippool.yaml
    5 6 
       - ../base/ceph-csi
    6 7 
       - ../base/cert-manager
    7 8 
       - ../base/external-secrets
    9 
    +  - ../base/gitlab-runner
    8 10 
       - ../base/etcd-backup
    9 
    -  - ./ippool.yaml

    • —
    View it on GitLab.
    You're receiving this email because of your account on gitlab.c3sl.ufpr.br. Manage all notifications · Help Notification message regarding https://gitlab.c3sl.ufpr.br/root/k8s/fluxcd/-/commit/dd9a7fd214ab3377eb2688fb21d7452c61196c70 at 1754331643