1184 lines
38 KiB
YAML
1184 lines
38 KiB
YAML
# GitHub Actions self-hosted Linux runner fleet - RKE2 deployment
|
|
#
|
|
# ArgoCD owns this namespace. Update this manifest and let the
|
|
# bluejay-infra ApplicationSet reconcile it.
|
|
#
|
|
# astoltz is a GitHub user account, not an org, so runners are repo-scoped.
|
|
# Each Deployment registers one private FlowerCore repo with the shared
|
|
# ACCESS_TOKEN from the github-runner-token Secret.
|
|
#
|
|
# Runners registered here:
|
|
# FlowerCore.Common (single replica, 5Gi Longhorn RWO NuGet PVC)
|
|
# FlowerCore.Shared.Pos (two replicas, emptyDir cache)
|
|
# FlowerCore.Puppet, Signage, DMS, Telephony, Print.Web, Chat, MySQL,
|
|
# Kiosk.Linux (two replicas each, emptyDir cache)
|
|
#
|
|
# Non-root CI safety:
|
|
# Runner pods run as uid 1001. HOME, DOTNET_INSTALL_DIR, DOTNET_CLI_HOME,
|
|
# NUGET_PACKAGES, XDG_CACHE_HOME, and RUNNER_TOOL_CACHE are all pointed at
|
|
# writable mounted paths under /home/runner so actions/setup-dotnet does not
|
|
# attempt to install into /usr/share/dotnet.
|
|
#
|
|
# Credentials:
|
|
# OnePasswordItem "GitHub PAT (Runner Registration)" syncs Secret
|
|
# github-runner-token with field "credential". myoung34/github-runner uses
|
|
# ACCESS_TOKEN to mint short-lived registration tokens on pod start.
|
|
#
|
|
# Security model:
|
|
# - No ClusterRole / ClusterRoleBinding. The ServiceAccount has no K8s API
|
|
# privileges.
|
|
# - Self-hosted runners are for private repos and trusted branches only.
|
|
# - Fork pull-request approval must remain required in GitHub repo settings.
|
|
# - Do not hardcode PATs or registration tokens.
|
|
#
|
|
# Designs: docs/infrastructure/self-hosted-runner-fleet.md
|
|
# ADR-172, Q-CI-26..40
|
|
---
|
|
apiVersion: v1
|
|
kind: Namespace
|
|
metadata:
|
|
name: github-runner
|
|
labels:
|
|
app.kubernetes.io/part-of: flowercore
|
|
app.kubernetes.io/managed-by: argocd
|
|
---
|
|
# 1Password secret sync — creates github-runner-token K8s Secret.
|
|
# Fields expected in the 1Password item:
|
|
# credential — GitHub fine-grained PAT (Administration:read/write on
|
|
# target repos) used by the runner image to mint a fresh
|
|
# short-lived registration token at pod start.
|
|
# Item path: IAmWorkin vault > "GitHub PAT (Runner Registration)"
|
|
# Operator MUST create this item before the Deployment will start cleanly.
|
|
apiVersion: onepassword.com/v1
|
|
kind: OnePasswordItem
|
|
metadata:
|
|
name: github-runner-token
|
|
namespace: github-runner
|
|
labels:
|
|
app.kubernetes.io/component: credentials
|
|
app.kubernetes.io/part-of: flowercore
|
|
spec:
|
|
itemPath: vaults/IAmWorkin/items/GitHub PAT (Runner Registration)
|
|
---
|
|
apiVersion: v1
|
|
kind: PersistentVolumeClaim
|
|
metadata:
|
|
name: github-runner-nuget-cache
|
|
namespace: github-runner
|
|
labels:
|
|
app.kubernetes.io/component: cache
|
|
app.kubernetes.io/part-of: flowercore
|
|
spec:
|
|
accessModes:
|
|
- ReadWriteOnce
|
|
storageClassName: longhorn
|
|
resources:
|
|
requests:
|
|
storage: 5Gi
|
|
volumeMode: Filesystem
|
|
---
|
|
apiVersion: v1
|
|
kind: ServiceAccount
|
|
metadata:
|
|
name: github-runner
|
|
namespace: github-runner
|
|
labels:
|
|
app.kubernetes.io/component: runner
|
|
app.kubernetes.io/part-of: flowercore
|
|
# No ClusterRole or ClusterRoleBinding — runner has zero K8s API privileges.
|
|
# CI jobs that need kubectl must supply their own kubeconfig via a secret
|
|
# injected at the job level, not via this service account.
|
|
---
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: github-runner
|
|
namespace: github-runner
|
|
labels:
|
|
app.kubernetes.io/name: github-runner
|
|
app.kubernetes.io/component: runner
|
|
app.kubernetes.io/part-of: flowercore
|
|
app.kubernetes.io/managed-by: argocd
|
|
flowercore.io/created-by: argocd
|
|
flowercore.io/runner-repo: common
|
|
flowercore.io/github-repo: FlowerCore.Common
|
|
spec:
|
|
# Single replica enforced: the Longhorn RWO PVC can only be mounted by
|
|
# one pod at a time. Each pod re-registers as an ephemeral runner after
|
|
# completing a job (EPHEMERAL=true restarts the container, not the pod,
|
|
# so the PVC stays attached between jobs).
|
|
#
|
|
# 2026-05-16: bumped 0 -> 1 after operator provisioned the
|
|
# "GitHub PAT (Runner Registration)" 1P item with field=credential.
|
|
# Unblocks CI fleet-wide (was budget-exhausted on GH-hosted runners).
|
|
replicas: 1
|
|
selector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: github-runner
|
|
# Use Recreate to avoid the Multi-Attach RWO error during rollouts.
|
|
strategy:
|
|
type: Recreate
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app.kubernetes.io/name: github-runner
|
|
app.kubernetes.io/component: runner
|
|
app.kubernetes.io/part-of: flowercore
|
|
flowercore.io/created-by: argocd
|
|
flowercore.io/runner-repo: common
|
|
flowercore.io/github-repo: FlowerCore.Common
|
|
spec:
|
|
serviceAccountName: github-runner
|
|
# Pin to rke2-server so the Longhorn RWO volume is always on the same node.
|
|
nodeSelector:
|
|
kubernetes.io/hostname: rke2-server
|
|
securityContext:
|
|
runAsNonRoot: true
|
|
runAsUser: 1001
|
|
runAsGroup: 1001
|
|
fsGroup: 1001
|
|
containers:
|
|
- name: runner
|
|
image: myoung34/github-runner:latest
|
|
imagePullPolicy: Always
|
|
env:
|
|
# GitHub org/repo targeting.
|
|
# Set REPO_URL for a repo-scoped runner (cheaper, simpler).
|
|
# Switch to ORG_NAME + empty REPO_URL for an org-scoped runner.
|
|
- name: REPO_URL
|
|
value: "https://github.com/astoltz/FlowerCore.Common"
|
|
- name: RUNNER_NAME_PREFIX
|
|
value: "rke2-linux"
|
|
- name: RUNNER_WORKDIR
|
|
value: "/tmp/runner/work"
|
|
# EPHEMERAL=true: runner deregisters after one job; container
|
|
# exits with code 0; Deployment controller restarts it and a
|
|
# fresh registration occurs. Prevents stale runner accumulation.
|
|
- name: EPHEMERAL
|
|
value: "true"
|
|
# Labels used by workflow files: runs-on: [self-hosted, linux, fc-build-linux]
|
|
- name: LABELS
|
|
value: "self-hosted,linux,fc-build-linux"
|
|
- name: HOME
|
|
value: "/home/runner"
|
|
- name: DOTNET_INSTALL_DIR
|
|
value: "/home/runner/.dotnet"
|
|
- name: DOTNET_CLI_HOME
|
|
value: "/home/runner"
|
|
- name: NUGET_PACKAGES
|
|
value: "/home/runner/.nuget/packages"
|
|
- name: XDG_CACHE_HOME
|
|
value: "/home/runner/.cache"
|
|
- name: RUNNER_TOOL_CACHE
|
|
value: "/home/runner/_tool"
|
|
# PAT (not pre-minted registration token) — myoung34/github-runner
|
|
# mints registration tokens itself via GitHub API when ACCESS_TOKEN
|
|
# is set. The 1P "GitHub PAT (Runner Registration)" item stores a
|
|
# fine-grained PAT, not a short-lived registration token.
|
|
- name: ACCESS_TOKEN
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: github-runner-token
|
|
key: credential
|
|
# myoung34/github-runner default entrypoint expects root for some
|
|
# setup steps. With securityContext.runAsUser=1001 the entrypoint
|
|
# short-circuits with "RUN_AS_ROOT env var is set to true but the
|
|
# user has been overridden and is not running as root". Tell the
|
|
# entrypoint we're explicitly NOT root so it skips the root-only
|
|
# setup steps (cache prewarm + apt updates — both already baked).
|
|
- name: RUN_AS_ROOT
|
|
value: "false"
|
|
resources:
|
|
requests:
|
|
cpu: "500m"
|
|
memory: "1Gi"
|
|
limits:
|
|
cpu: "2000m"
|
|
memory: "4Gi"
|
|
volumeMounts:
|
|
- name: runner-home
|
|
mountPath: /home/runner
|
|
- name: nuget-cache
|
|
mountPath: /home/runner/.nuget/packages
|
|
- name: tmp
|
|
mountPath: /tmp
|
|
# Liveness: runner process is alive.
|
|
livenessProbe:
|
|
exec:
|
|
command:
|
|
- /bin/sh
|
|
- -c
|
|
- "pgrep -f Runner.Listener > /dev/null"
|
|
initialDelaySeconds: 30
|
|
periodSeconds: 30
|
|
failureThreshold: 3
|
|
volumes:
|
|
- name: runner-home
|
|
emptyDir: {}
|
|
- name: nuget-cache
|
|
persistentVolumeClaim:
|
|
claimName: github-runner-nuget-cache
|
|
- name: tmp
|
|
emptyDir: {}
|
|
# Restart policy: Always — the Deployment controller handles
|
|
# re-registration after each ephemeral job completes.
|
|
restartPolicy: Always
|
|
---
|
|
# Shared.Pos repo-scoped Linux runner. Added 2026-05-20 to unstick the
|
|
# FlowerCore.Shared.Pos "Build, Test & Publish" workflow, which had been
|
|
# queued indefinitely after the Sprint 26 Mac POS Phase 1/2 PRs merged
|
|
# (no fc-build-linux runner was registered to Shared.Pos — GitHub user
|
|
# accounts have only repo-scoped runners). First concrete instance of the
|
|
# Sprint 29 Cx-1 Linux-runner-fleet pattern; the full per-repo fleet is
|
|
# codified by that lane. It uses emptyDir cache and two replicas so backlog
|
|
# drains without a shared RWO PVC multi-attach risk.
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: github-runner-sharedpos
|
|
namespace: github-runner
|
|
labels:
|
|
app.kubernetes.io/name: github-runner-sharedpos
|
|
app.kubernetes.io/component: runner
|
|
app.kubernetes.io/part-of: flowercore
|
|
app.kubernetes.io/managed-by: argocd
|
|
flowercore.io/created-by: argocd
|
|
flowercore.io/runner-repo: sharedpos
|
|
flowercore.io/github-repo: FlowerCore.Shared.Pos
|
|
spec:
|
|
replicas: 2
|
|
selector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: github-runner-sharedpos
|
|
strategy:
|
|
type: Recreate
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app.kubernetes.io/name: github-runner-sharedpos
|
|
app.kubernetes.io/component: runner
|
|
app.kubernetes.io/part-of: flowercore
|
|
flowercore.io/created-by: argocd
|
|
flowercore.io/runner-repo: sharedpos
|
|
flowercore.io/github-repo: FlowerCore.Shared.Pos
|
|
spec:
|
|
serviceAccountName: github-runner
|
|
securityContext:
|
|
runAsNonRoot: true
|
|
runAsUser: 1001
|
|
runAsGroup: 1001
|
|
fsGroup: 1001
|
|
containers:
|
|
- name: runner
|
|
image: myoung34/github-runner:latest
|
|
imagePullPolicy: Always
|
|
env:
|
|
- name: REPO_URL
|
|
value: "https://github.com/astoltz/FlowerCore.Shared.Pos"
|
|
- name: RUNNER_NAME_PREFIX
|
|
value: "rke2-linux-sharedpos"
|
|
- name: RUNNER_WORKDIR
|
|
value: "/tmp/runner/work"
|
|
- name: EPHEMERAL
|
|
value: "true"
|
|
- name: LABELS
|
|
value: "self-hosted,linux,fc-build-linux"
|
|
- name: HOME
|
|
value: "/home/runner"
|
|
- name: DOTNET_INSTALL_DIR
|
|
value: "/home/runner/.dotnet"
|
|
- name: DOTNET_CLI_HOME
|
|
value: "/home/runner"
|
|
- name: NUGET_PACKAGES
|
|
value: "/home/runner/.nuget/packages"
|
|
- name: XDG_CACHE_HOME
|
|
value: "/home/runner/.cache"
|
|
- name: RUNNER_TOOL_CACHE
|
|
value: "/home/runner/_tool"
|
|
- name: ACCESS_TOKEN
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: github-runner-token
|
|
key: credential
|
|
- name: RUN_AS_ROOT
|
|
value: "false"
|
|
resources:
|
|
requests:
|
|
cpu: "500m"
|
|
memory: "1Gi"
|
|
limits:
|
|
cpu: "2000m"
|
|
memory: "4Gi"
|
|
volumeMounts:
|
|
- name: runner-home
|
|
mountPath: /home/runner
|
|
- name: nuget-cache
|
|
mountPath: /home/runner/.nuget/packages
|
|
- name: tmp
|
|
mountPath: /tmp
|
|
livenessProbe:
|
|
exec:
|
|
command:
|
|
- /bin/sh
|
|
- -c
|
|
- "pgrep -f Runner.Listener > /dev/null"
|
|
initialDelaySeconds: 30
|
|
periodSeconds: 30
|
|
failureThreshold: 3
|
|
volumes:
|
|
- name: runner-home
|
|
emptyDir: {}
|
|
- name: nuget-cache
|
|
emptyDir:
|
|
sizeLimit: 2Gi
|
|
- name: tmp
|
|
emptyDir: {}
|
|
restartPolicy: Always
|
|
---
|
|
# Runner for FlowerCore.Puppet. Two replicas use per-pod emptyDir caches, so
|
|
# backlog can drain without sharing a ReadWriteOnce PVC.
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: github-runner-puppet
|
|
namespace: github-runner
|
|
labels:
|
|
app.kubernetes.io/name: github-runner-puppet
|
|
app.kubernetes.io/component: runner
|
|
app.kubernetes.io/part-of: flowercore
|
|
app.kubernetes.io/managed-by: argocd
|
|
flowercore.io/created-by: argocd
|
|
flowercore.io/runner-repo: puppet
|
|
flowercore.io/github-repo: FlowerCore.Puppet
|
|
spec:
|
|
replicas: 2
|
|
selector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: github-runner-puppet
|
|
strategy:
|
|
type: Recreate
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app.kubernetes.io/name: github-runner-puppet
|
|
app.kubernetes.io/component: runner
|
|
app.kubernetes.io/part-of: flowercore
|
|
flowercore.io/created-by: argocd
|
|
flowercore.io/runner-repo: puppet
|
|
flowercore.io/github-repo: FlowerCore.Puppet
|
|
spec:
|
|
serviceAccountName: github-runner
|
|
securityContext:
|
|
runAsNonRoot: true
|
|
runAsUser: 1001
|
|
runAsGroup: 1001
|
|
fsGroup: 1001
|
|
containers:
|
|
- name: runner
|
|
image: myoung34/github-runner:latest
|
|
imagePullPolicy: Always
|
|
env:
|
|
- name: REPO_URL
|
|
value: "https://github.com/astoltz/FlowerCore.Puppet"
|
|
- name: RUNNER_NAME_PREFIX
|
|
value: "rke2-linux-puppet"
|
|
- name: RUNNER_WORKDIR
|
|
value: "/tmp/runner/work"
|
|
- name: EPHEMERAL
|
|
value: "true"
|
|
- name: LABELS
|
|
value: "self-hosted,linux,fc-build-linux"
|
|
- name: HOME
|
|
value: "/home/runner"
|
|
- name: DOTNET_INSTALL_DIR
|
|
value: "/home/runner/.dotnet"
|
|
- name: DOTNET_CLI_HOME
|
|
value: "/home/runner"
|
|
- name: NUGET_PACKAGES
|
|
value: "/home/runner/.nuget/packages"
|
|
- name: XDG_CACHE_HOME
|
|
value: "/home/runner/.cache"
|
|
- name: RUNNER_TOOL_CACHE
|
|
value: "/home/runner/_tool"
|
|
- name: ACCESS_TOKEN
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: github-runner-token
|
|
key: credential
|
|
- name: RUN_AS_ROOT
|
|
value: "false"
|
|
resources:
|
|
requests:
|
|
cpu: "500m"
|
|
memory: "1Gi"
|
|
limits:
|
|
cpu: "2000m"
|
|
memory: "4Gi"
|
|
volumeMounts:
|
|
- name: runner-home
|
|
mountPath: /home/runner
|
|
- name: nuget-cache
|
|
mountPath: /home/runner/.nuget/packages
|
|
- name: tmp
|
|
mountPath: /tmp
|
|
livenessProbe:
|
|
exec:
|
|
command:
|
|
- /bin/sh
|
|
- -c
|
|
- "pgrep -f Runner.Listener > /dev/null"
|
|
initialDelaySeconds: 30
|
|
periodSeconds: 30
|
|
failureThreshold: 3
|
|
volumes:
|
|
- name: runner-home
|
|
emptyDir: {}
|
|
- name: nuget-cache
|
|
emptyDir:
|
|
sizeLimit: 2Gi
|
|
- name: tmp
|
|
emptyDir: {}
|
|
restartPolicy: Always
|
|
---
|
|
# Runner for FlowerCore.Signage. Two replicas use per-pod emptyDir caches, so
|
|
# backlog can drain without sharing a ReadWriteOnce PVC.
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: github-runner-signage
|
|
namespace: github-runner
|
|
labels:
|
|
app.kubernetes.io/name: github-runner-signage
|
|
app.kubernetes.io/component: runner
|
|
app.kubernetes.io/part-of: flowercore
|
|
app.kubernetes.io/managed-by: argocd
|
|
flowercore.io/created-by: argocd
|
|
flowercore.io/runner-repo: signage
|
|
flowercore.io/github-repo: FlowerCore.Signage
|
|
spec:
|
|
replicas: 2
|
|
selector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: github-runner-signage
|
|
strategy:
|
|
type: Recreate
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app.kubernetes.io/name: github-runner-signage
|
|
app.kubernetes.io/component: runner
|
|
app.kubernetes.io/part-of: flowercore
|
|
flowercore.io/created-by: argocd
|
|
flowercore.io/runner-repo: signage
|
|
flowercore.io/github-repo: FlowerCore.Signage
|
|
spec:
|
|
serviceAccountName: github-runner
|
|
securityContext:
|
|
runAsNonRoot: true
|
|
runAsUser: 1001
|
|
runAsGroup: 1001
|
|
fsGroup: 1001
|
|
containers:
|
|
- name: runner
|
|
image: myoung34/github-runner:latest
|
|
imagePullPolicy: Always
|
|
env:
|
|
- name: REPO_URL
|
|
value: "https://github.com/astoltz/FlowerCore.Signage"
|
|
- name: RUNNER_NAME_PREFIX
|
|
value: "rke2-linux-signage"
|
|
- name: RUNNER_WORKDIR
|
|
value: "/tmp/runner/work"
|
|
- name: EPHEMERAL
|
|
value: "true"
|
|
- name: LABELS
|
|
value: "self-hosted,linux,fc-build-linux"
|
|
- name: HOME
|
|
value: "/home/runner"
|
|
- name: DOTNET_INSTALL_DIR
|
|
value: "/home/runner/.dotnet"
|
|
- name: DOTNET_CLI_HOME
|
|
value: "/home/runner"
|
|
- name: NUGET_PACKAGES
|
|
value: "/home/runner/.nuget/packages"
|
|
- name: XDG_CACHE_HOME
|
|
value: "/home/runner/.cache"
|
|
- name: RUNNER_TOOL_CACHE
|
|
value: "/home/runner/_tool"
|
|
- name: ACCESS_TOKEN
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: github-runner-token
|
|
key: credential
|
|
- name: RUN_AS_ROOT
|
|
value: "false"
|
|
resources:
|
|
requests:
|
|
cpu: "500m"
|
|
memory: "1Gi"
|
|
limits:
|
|
cpu: "2000m"
|
|
memory: "4Gi"
|
|
volumeMounts:
|
|
- name: runner-home
|
|
mountPath: /home/runner
|
|
- name: nuget-cache
|
|
mountPath: /home/runner/.nuget/packages
|
|
- name: tmp
|
|
mountPath: /tmp
|
|
livenessProbe:
|
|
exec:
|
|
command:
|
|
- /bin/sh
|
|
- -c
|
|
- "pgrep -f Runner.Listener > /dev/null"
|
|
initialDelaySeconds: 30
|
|
periodSeconds: 30
|
|
failureThreshold: 3
|
|
volumes:
|
|
- name: runner-home
|
|
emptyDir: {}
|
|
- name: nuget-cache
|
|
emptyDir:
|
|
sizeLimit: 2Gi
|
|
- name: tmp
|
|
emptyDir: {}
|
|
restartPolicy: Always
|
|
---
|
|
# Runner for FlowerCore.DMS. Two replicas use per-pod emptyDir caches, so
|
|
# backlog can drain without sharing a ReadWriteOnce PVC.
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: github-runner-dms
|
|
namespace: github-runner
|
|
labels:
|
|
app.kubernetes.io/name: github-runner-dms
|
|
app.kubernetes.io/component: runner
|
|
app.kubernetes.io/part-of: flowercore
|
|
app.kubernetes.io/managed-by: argocd
|
|
flowercore.io/created-by: argocd
|
|
flowercore.io/runner-repo: dms
|
|
flowercore.io/github-repo: FlowerCore.DMS
|
|
spec:
|
|
replicas: 2
|
|
selector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: github-runner-dms
|
|
strategy:
|
|
type: Recreate
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app.kubernetes.io/name: github-runner-dms
|
|
app.kubernetes.io/component: runner
|
|
app.kubernetes.io/part-of: flowercore
|
|
flowercore.io/created-by: argocd
|
|
flowercore.io/runner-repo: dms
|
|
flowercore.io/github-repo: FlowerCore.DMS
|
|
spec:
|
|
serviceAccountName: github-runner
|
|
securityContext:
|
|
runAsNonRoot: true
|
|
runAsUser: 1001
|
|
runAsGroup: 1001
|
|
fsGroup: 1001
|
|
containers:
|
|
- name: runner
|
|
image: myoung34/github-runner:latest
|
|
imagePullPolicy: Always
|
|
env:
|
|
- name: REPO_URL
|
|
value: "https://github.com/astoltz/FlowerCore.DMS"
|
|
- name: RUNNER_NAME_PREFIX
|
|
value: "rke2-linux-dms"
|
|
- name: RUNNER_WORKDIR
|
|
value: "/tmp/runner/work"
|
|
- name: EPHEMERAL
|
|
value: "true"
|
|
- name: LABELS
|
|
value: "self-hosted,linux,fc-build-linux"
|
|
- name: HOME
|
|
value: "/home/runner"
|
|
- name: DOTNET_INSTALL_DIR
|
|
value: "/home/runner/.dotnet"
|
|
- name: DOTNET_CLI_HOME
|
|
value: "/home/runner"
|
|
- name: NUGET_PACKAGES
|
|
value: "/home/runner/.nuget/packages"
|
|
- name: XDG_CACHE_HOME
|
|
value: "/home/runner/.cache"
|
|
- name: RUNNER_TOOL_CACHE
|
|
value: "/home/runner/_tool"
|
|
- name: ACCESS_TOKEN
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: github-runner-token
|
|
key: credential
|
|
- name: RUN_AS_ROOT
|
|
value: "false"
|
|
resources:
|
|
requests:
|
|
cpu: "500m"
|
|
memory: "1Gi"
|
|
limits:
|
|
cpu: "2000m"
|
|
memory: "4Gi"
|
|
volumeMounts:
|
|
- name: runner-home
|
|
mountPath: /home/runner
|
|
- name: nuget-cache
|
|
mountPath: /home/runner/.nuget/packages
|
|
- name: tmp
|
|
mountPath: /tmp
|
|
livenessProbe:
|
|
exec:
|
|
command:
|
|
- /bin/sh
|
|
- -c
|
|
- "pgrep -f Runner.Listener > /dev/null"
|
|
initialDelaySeconds: 30
|
|
periodSeconds: 30
|
|
failureThreshold: 3
|
|
volumes:
|
|
- name: runner-home
|
|
emptyDir: {}
|
|
- name: nuget-cache
|
|
emptyDir:
|
|
sizeLimit: 2Gi
|
|
- name: tmp
|
|
emptyDir: {}
|
|
restartPolicy: Always
|
|
---
|
|
# Runner for FlowerCore.Telephony. Two replicas use per-pod emptyDir caches,
|
|
# so backlog can drain without sharing a ReadWriteOnce PVC.
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: github-runner-telephony
|
|
namespace: github-runner
|
|
labels:
|
|
app.kubernetes.io/name: github-runner-telephony
|
|
app.kubernetes.io/component: runner
|
|
app.kubernetes.io/part-of: flowercore
|
|
app.kubernetes.io/managed-by: argocd
|
|
flowercore.io/created-by: argocd
|
|
flowercore.io/runner-repo: telephony
|
|
flowercore.io/github-repo: FlowerCore.Telephony
|
|
spec:
|
|
replicas: 2
|
|
selector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: github-runner-telephony
|
|
strategy:
|
|
type: Recreate
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app.kubernetes.io/name: github-runner-telephony
|
|
app.kubernetes.io/component: runner
|
|
app.kubernetes.io/part-of: flowercore
|
|
flowercore.io/created-by: argocd
|
|
flowercore.io/runner-repo: telephony
|
|
flowercore.io/github-repo: FlowerCore.Telephony
|
|
spec:
|
|
serviceAccountName: github-runner
|
|
securityContext:
|
|
runAsNonRoot: true
|
|
runAsUser: 1001
|
|
runAsGroup: 1001
|
|
fsGroup: 1001
|
|
containers:
|
|
- name: runner
|
|
image: myoung34/github-runner:latest
|
|
imagePullPolicy: Always
|
|
env:
|
|
- name: REPO_URL
|
|
value: "https://github.com/astoltz/FlowerCore.Telephony"
|
|
- name: RUNNER_NAME_PREFIX
|
|
value: "rke2-linux-telephony"
|
|
- name: RUNNER_WORKDIR
|
|
value: "/tmp/runner/work"
|
|
- name: EPHEMERAL
|
|
value: "true"
|
|
- name: LABELS
|
|
value: "self-hosted,linux,fc-build-linux"
|
|
- name: HOME
|
|
value: "/home/runner"
|
|
- name: DOTNET_INSTALL_DIR
|
|
value: "/home/runner/.dotnet"
|
|
- name: DOTNET_CLI_HOME
|
|
value: "/home/runner"
|
|
- name: NUGET_PACKAGES
|
|
value: "/home/runner/.nuget/packages"
|
|
- name: XDG_CACHE_HOME
|
|
value: "/home/runner/.cache"
|
|
- name: RUNNER_TOOL_CACHE
|
|
value: "/home/runner/_tool"
|
|
- name: ACCESS_TOKEN
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: github-runner-token
|
|
key: credential
|
|
- name: RUN_AS_ROOT
|
|
value: "false"
|
|
resources:
|
|
requests:
|
|
cpu: "500m"
|
|
memory: "1Gi"
|
|
limits:
|
|
cpu: "2000m"
|
|
memory: "4Gi"
|
|
volumeMounts:
|
|
- name: runner-home
|
|
mountPath: /home/runner
|
|
- name: nuget-cache
|
|
mountPath: /home/runner/.nuget/packages
|
|
- name: tmp
|
|
mountPath: /tmp
|
|
livenessProbe:
|
|
exec:
|
|
command:
|
|
- /bin/sh
|
|
- -c
|
|
- "pgrep -f Runner.Listener > /dev/null"
|
|
initialDelaySeconds: 30
|
|
periodSeconds: 30
|
|
failureThreshold: 3
|
|
volumes:
|
|
- name: runner-home
|
|
emptyDir: {}
|
|
- name: nuget-cache
|
|
emptyDir:
|
|
sizeLimit: 2Gi
|
|
- name: tmp
|
|
emptyDir: {}
|
|
restartPolicy: Always
|
|
---
|
|
# Runner for FlowerCore.Print.Web. Two replicas use per-pod emptyDir caches,
|
|
# so backlog can drain without sharing a ReadWriteOnce PVC.
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: github-runner-print-web
|
|
namespace: github-runner
|
|
labels:
|
|
app.kubernetes.io/name: github-runner-print-web
|
|
app.kubernetes.io/component: runner
|
|
app.kubernetes.io/part-of: flowercore
|
|
app.kubernetes.io/managed-by: argocd
|
|
flowercore.io/created-by: argocd
|
|
flowercore.io/runner-repo: print-web
|
|
flowercore.io/github-repo: FlowerCore.Print.Web
|
|
spec:
|
|
replicas: 2
|
|
selector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: github-runner-print-web
|
|
strategy:
|
|
type: Recreate
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app.kubernetes.io/name: github-runner-print-web
|
|
app.kubernetes.io/component: runner
|
|
app.kubernetes.io/part-of: flowercore
|
|
flowercore.io/created-by: argocd
|
|
flowercore.io/runner-repo: print-web
|
|
flowercore.io/github-repo: FlowerCore.Print.Web
|
|
spec:
|
|
serviceAccountName: github-runner
|
|
securityContext:
|
|
runAsNonRoot: true
|
|
runAsUser: 1001
|
|
runAsGroup: 1001
|
|
fsGroup: 1001
|
|
containers:
|
|
- name: runner
|
|
image: myoung34/github-runner:latest
|
|
imagePullPolicy: Always
|
|
env:
|
|
- name: REPO_URL
|
|
value: "https://github.com/astoltz/FlowerCore.Print.Web"
|
|
- name: RUNNER_NAME_PREFIX
|
|
value: "rke2-linux-print-web"
|
|
- name: RUNNER_WORKDIR
|
|
value: "/tmp/runner/work"
|
|
- name: EPHEMERAL
|
|
value: "true"
|
|
- name: LABELS
|
|
value: "self-hosted,linux,fc-build-linux"
|
|
- name: HOME
|
|
value: "/home/runner"
|
|
- name: DOTNET_INSTALL_DIR
|
|
value: "/home/runner/.dotnet"
|
|
- name: DOTNET_CLI_HOME
|
|
value: "/home/runner"
|
|
- name: NUGET_PACKAGES
|
|
value: "/home/runner/.nuget/packages"
|
|
- name: XDG_CACHE_HOME
|
|
value: "/home/runner/.cache"
|
|
- name: RUNNER_TOOL_CACHE
|
|
value: "/home/runner/_tool"
|
|
- name: ACCESS_TOKEN
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: github-runner-token
|
|
key: credential
|
|
- name: RUN_AS_ROOT
|
|
value: "false"
|
|
resources:
|
|
requests:
|
|
cpu: "500m"
|
|
memory: "1Gi"
|
|
limits:
|
|
cpu: "2000m"
|
|
memory: "4Gi"
|
|
volumeMounts:
|
|
- name: runner-home
|
|
mountPath: /home/runner
|
|
- name: nuget-cache
|
|
mountPath: /home/runner/.nuget/packages
|
|
- name: tmp
|
|
mountPath: /tmp
|
|
livenessProbe:
|
|
exec:
|
|
command:
|
|
- /bin/sh
|
|
- -c
|
|
- "pgrep -f Runner.Listener > /dev/null"
|
|
initialDelaySeconds: 30
|
|
periodSeconds: 30
|
|
failureThreshold: 3
|
|
volumes:
|
|
- name: runner-home
|
|
emptyDir: {}
|
|
- name: nuget-cache
|
|
emptyDir:
|
|
sizeLimit: 2Gi
|
|
- name: tmp
|
|
emptyDir: {}
|
|
restartPolicy: Always
|
|
---
|
|
# Runner for FlowerCore.Chat. Two replicas use per-pod emptyDir caches, so
|
|
# backlog can drain without sharing a ReadWriteOnce PVC.
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: github-runner-chat
|
|
namespace: github-runner
|
|
labels:
|
|
app.kubernetes.io/name: github-runner-chat
|
|
app.kubernetes.io/component: runner
|
|
app.kubernetes.io/part-of: flowercore
|
|
app.kubernetes.io/managed-by: argocd
|
|
flowercore.io/created-by: argocd
|
|
flowercore.io/runner-repo: chat
|
|
flowercore.io/github-repo: FlowerCore.Chat
|
|
spec:
|
|
replicas: 2
|
|
selector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: github-runner-chat
|
|
strategy:
|
|
type: Recreate
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app.kubernetes.io/name: github-runner-chat
|
|
app.kubernetes.io/component: runner
|
|
app.kubernetes.io/part-of: flowercore
|
|
flowercore.io/created-by: argocd
|
|
flowercore.io/runner-repo: chat
|
|
flowercore.io/github-repo: FlowerCore.Chat
|
|
spec:
|
|
serviceAccountName: github-runner
|
|
securityContext:
|
|
runAsNonRoot: true
|
|
runAsUser: 1001
|
|
runAsGroup: 1001
|
|
fsGroup: 1001
|
|
containers:
|
|
- name: runner
|
|
image: myoung34/github-runner:latest
|
|
imagePullPolicy: Always
|
|
env:
|
|
- name: REPO_URL
|
|
value: "https://github.com/astoltz/FlowerCore.Chat"
|
|
- name: RUNNER_NAME_PREFIX
|
|
value: "rke2-linux-chat"
|
|
- name: RUNNER_WORKDIR
|
|
value: "/tmp/runner/work"
|
|
- name: EPHEMERAL
|
|
value: "true"
|
|
- name: LABELS
|
|
value: "self-hosted,linux,fc-build-linux"
|
|
- name: HOME
|
|
value: "/home/runner"
|
|
- name: DOTNET_INSTALL_DIR
|
|
value: "/home/runner/.dotnet"
|
|
- name: DOTNET_CLI_HOME
|
|
value: "/home/runner"
|
|
- name: NUGET_PACKAGES
|
|
value: "/home/runner/.nuget/packages"
|
|
- name: XDG_CACHE_HOME
|
|
value: "/home/runner/.cache"
|
|
- name: RUNNER_TOOL_CACHE
|
|
value: "/home/runner/_tool"
|
|
- name: ACCESS_TOKEN
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: github-runner-token
|
|
key: credential
|
|
- name: RUN_AS_ROOT
|
|
value: "false"
|
|
resources:
|
|
requests:
|
|
cpu: "500m"
|
|
memory: "1Gi"
|
|
limits:
|
|
cpu: "2000m"
|
|
memory: "4Gi"
|
|
volumeMounts:
|
|
- name: runner-home
|
|
mountPath: /home/runner
|
|
- name: nuget-cache
|
|
mountPath: /home/runner/.nuget/packages
|
|
- name: tmp
|
|
mountPath: /tmp
|
|
livenessProbe:
|
|
exec:
|
|
command:
|
|
- /bin/sh
|
|
- -c
|
|
- "pgrep -f Runner.Listener > /dev/null"
|
|
initialDelaySeconds: 30
|
|
periodSeconds: 30
|
|
failureThreshold: 3
|
|
volumes:
|
|
- name: runner-home
|
|
emptyDir: {}
|
|
- name: nuget-cache
|
|
emptyDir:
|
|
sizeLimit: 2Gi
|
|
- name: tmp
|
|
emptyDir: {}
|
|
restartPolicy: Always
|
|
---
|
|
# Runner for FlowerCore.MySQL. Two replicas use per-pod emptyDir caches, so
|
|
# backlog can drain without sharing a ReadWriteOnce PVC.
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: github-runner-mysql
|
|
namespace: github-runner
|
|
labels:
|
|
app.kubernetes.io/name: github-runner-mysql
|
|
app.kubernetes.io/component: runner
|
|
app.kubernetes.io/part-of: flowercore
|
|
app.kubernetes.io/managed-by: argocd
|
|
flowercore.io/created-by: argocd
|
|
flowercore.io/runner-repo: mysql
|
|
flowercore.io/github-repo: FlowerCore.MySQL
|
|
spec:
|
|
replicas: 2
|
|
selector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: github-runner-mysql
|
|
strategy:
|
|
type: Recreate
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app.kubernetes.io/name: github-runner-mysql
|
|
app.kubernetes.io/component: runner
|
|
app.kubernetes.io/part-of: flowercore
|
|
flowercore.io/created-by: argocd
|
|
flowercore.io/runner-repo: mysql
|
|
flowercore.io/github-repo: FlowerCore.MySQL
|
|
spec:
|
|
serviceAccountName: github-runner
|
|
securityContext:
|
|
runAsNonRoot: true
|
|
runAsUser: 1001
|
|
runAsGroup: 1001
|
|
fsGroup: 1001
|
|
containers:
|
|
- name: runner
|
|
image: myoung34/github-runner:latest
|
|
imagePullPolicy: Always
|
|
env:
|
|
- name: REPO_URL
|
|
value: "https://github.com/astoltz/FlowerCore.MySQL"
|
|
- name: RUNNER_NAME_PREFIX
|
|
value: "rke2-linux-mysql"
|
|
- name: RUNNER_WORKDIR
|
|
value: "/tmp/runner/work"
|
|
- name: EPHEMERAL
|
|
value: "true"
|
|
- name: LABELS
|
|
value: "self-hosted,linux,fc-build-linux"
|
|
- name: HOME
|
|
value: "/home/runner"
|
|
- name: DOTNET_INSTALL_DIR
|
|
value: "/home/runner/.dotnet"
|
|
- name: DOTNET_CLI_HOME
|
|
value: "/home/runner"
|
|
- name: NUGET_PACKAGES
|
|
value: "/home/runner/.nuget/packages"
|
|
- name: XDG_CACHE_HOME
|
|
value: "/home/runner/.cache"
|
|
- name: RUNNER_TOOL_CACHE
|
|
value: "/home/runner/_tool"
|
|
- name: ACCESS_TOKEN
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: github-runner-token
|
|
key: credential
|
|
- name: RUN_AS_ROOT
|
|
value: "false"
|
|
resources:
|
|
requests:
|
|
cpu: "500m"
|
|
memory: "1Gi"
|
|
limits:
|
|
cpu: "2000m"
|
|
memory: "4Gi"
|
|
volumeMounts:
|
|
- name: runner-home
|
|
mountPath: /home/runner
|
|
- name: nuget-cache
|
|
mountPath: /home/runner/.nuget/packages
|
|
- name: tmp
|
|
mountPath: /tmp
|
|
livenessProbe:
|
|
exec:
|
|
command:
|
|
- /bin/sh
|
|
- -c
|
|
- "pgrep -f Runner.Listener > /dev/null"
|
|
initialDelaySeconds: 30
|
|
periodSeconds: 30
|
|
failureThreshold: 3
|
|
volumes:
|
|
- name: runner-home
|
|
emptyDir: {}
|
|
- name: nuget-cache
|
|
emptyDir:
|
|
sizeLimit: 2Gi
|
|
- name: tmp
|
|
emptyDir: {}
|
|
restartPolicy: Always
|
|
---
|
|
# Runner for FlowerCore.Kiosk.Linux. Two replicas use per-pod emptyDir caches,
|
|
# so backlog can drain without sharing a ReadWriteOnce PVC.
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: github-runner-kiosk-linux
|
|
namespace: github-runner
|
|
labels:
|
|
app.kubernetes.io/name: github-runner-kiosk-linux
|
|
app.kubernetes.io/component: runner
|
|
app.kubernetes.io/part-of: flowercore
|
|
app.kubernetes.io/managed-by: argocd
|
|
flowercore.io/created-by: argocd
|
|
flowercore.io/runner-repo: kiosk-linux
|
|
flowercore.io/github-repo: FlowerCore.Kiosk.Linux
|
|
spec:
|
|
replicas: 2
|
|
selector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: github-runner-kiosk-linux
|
|
strategy:
|
|
type: Recreate
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app.kubernetes.io/name: github-runner-kiosk-linux
|
|
app.kubernetes.io/component: runner
|
|
app.kubernetes.io/part-of: flowercore
|
|
flowercore.io/created-by: argocd
|
|
flowercore.io/runner-repo: kiosk-linux
|
|
flowercore.io/github-repo: FlowerCore.Kiosk.Linux
|
|
spec:
|
|
serviceAccountName: github-runner
|
|
securityContext:
|
|
runAsNonRoot: true
|
|
runAsUser: 1001
|
|
runAsGroup: 1001
|
|
fsGroup: 1001
|
|
containers:
|
|
- name: runner
|
|
image: myoung34/github-runner:latest
|
|
imagePullPolicy: Always
|
|
env:
|
|
- name: REPO_URL
|
|
value: "https://github.com/astoltz/FlowerCore.Kiosk.Linux"
|
|
- name: RUNNER_NAME_PREFIX
|
|
value: "rke2-linux-kiosk-linux"
|
|
- name: RUNNER_WORKDIR
|
|
value: "/tmp/runner/work"
|
|
- name: EPHEMERAL
|
|
value: "true"
|
|
- name: LABELS
|
|
value: "self-hosted,linux,fc-build-linux"
|
|
- name: HOME
|
|
value: "/home/runner"
|
|
- name: DOTNET_INSTALL_DIR
|
|
value: "/home/runner/.dotnet"
|
|
- name: DOTNET_CLI_HOME
|
|
value: "/home/runner"
|
|
- name: NUGET_PACKAGES
|
|
value: "/home/runner/.nuget/packages"
|
|
- name: XDG_CACHE_HOME
|
|
value: "/home/runner/.cache"
|
|
- name: RUNNER_TOOL_CACHE
|
|
value: "/home/runner/_tool"
|
|
- name: ACCESS_TOKEN
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: github-runner-token
|
|
key: credential
|
|
- name: RUN_AS_ROOT
|
|
value: "false"
|
|
resources:
|
|
requests:
|
|
cpu: "500m"
|
|
memory: "1Gi"
|
|
limits:
|
|
cpu: "2000m"
|
|
memory: "4Gi"
|
|
volumeMounts:
|
|
- name: runner-home
|
|
mountPath: /home/runner
|
|
- name: nuget-cache
|
|
mountPath: /home/runner/.nuget/packages
|
|
- name: tmp
|
|
mountPath: /tmp
|
|
livenessProbe:
|
|
exec:
|
|
command:
|
|
- /bin/sh
|
|
- -c
|
|
- "pgrep -f Runner.Listener > /dev/null"
|
|
initialDelaySeconds: 30
|
|
periodSeconds: 30
|
|
failureThreshold: 3
|
|
volumes:
|
|
- name: runner-home
|
|
emptyDir: {}
|
|
- name: nuget-cache
|
|
emptyDir:
|
|
sizeLimit: 2Gi
|
|
- name: tmp
|
|
emptyDir: {}
|
|
restartPolicy: Always
|
|
|
|
# Long-tail runner pattern:
|
|
#
|
|
# Add lower-volume repos on demand with the same emptyDir runner shape above.
|
|
# Use replicas: 1 by default, replicas: 2 only when queue time proves it is
|
|
# useful. Do not create a multi-replica Deployment that shares one RWO PVC.
|
|
# Common remains the only PVC-backed runner here, and it stays replicas: 1.
|