fix(deploy): mount runner node runtimes on their own volume and fix runtime base url

Modified chart/templates/_helpers.tpl +7 −0 View chart/templates/_helpers.tpl

@@ -153,6 +153,11 @@

153153 value: {{ default $base .Values.config.env.APP_GIT__BASE_URL | quote }}

154154- name: APP_GIT__HTTP_CLONE_BASE_URL

155155 value: {{ default $base .Values.config.env.APP_GIT__HTTP_CLONE_BASE_URL | quote }}

156# CI Actions runtime 回调 origin：必须是纯 origin（lib/ci/src/actions_runtime.rs:158 用

157# reqwest::Url::parse 校验，带路径前缀就直接报错），且必须能被 runner 解析——runner 池

158# 走独立 chart 部署在别的命名空间，所以默认值用跨命名空间 FQDN，而不是裸 Service 名。

159- name: APP_CI__RUNTIME_BASE_URL

160 value: {{ default (printf "http://%s-webhook.%s.svc.cluster.local:%v" (include "gitdata.fullname" .) .Release.Namespace .Values.webhook.port) .Values.config.env.APP_CI__RUNTIME_BASE_URL | quote }}

156161{{- if .Values.metrics.otlpEndpoint }}

157162- name: OTEL_EXPORTER_OTLP_ENDPOINT

158163 value: {{ .Values.metrics.otlpEndpoint | quote }}

@@ -166,6 +171,7 @@

166171{{- range $k, $v := .Values.config.env }}

167172{{- if not (hasPrefix "APP_WEB__WEB_BASE_URL" $k) }}

168173{{- if not (hasPrefix "APP_GIT__BASE_URL" $k) }}

174{{- if not (hasPrefix "APP_CI__RUNTIME_BASE_URL" $k) }}

169175{{/* config.env 走容器 env:，secret.env 走 envFrom:；同名时 env: 优先级更高，

170176 会静默覆盖 Secret 里的真实值（例如把连接串换成 chart 默认的 redis://redis-master）。

171177 因此这里跳过任何已在 secret.env 中声明的键，让 Secret 成为唯一来源。 */}}

@@ -176,6 +182,7 @@

176182{{- end }}

177183{{- end }}

178184{{- end }}

185{{- end }}

179186{{- end -}}

180187

181188{{- define "gitdata.envFrom" -}}

Modified chart/templates/runner.yaml +12 −8 View chart/templates/runner.yaml

@@ -33,12 +33,14 @@

3333 - |

3434 mkdir -p /bundle/bin /bundle/node

3535 cp /usr/local/bin/gitdata-actions-engine /bundle/bin/

36 cp -a /opt/gitdata/node/. /bundle/node/

36 for version in /opt/gitdata/node/*/; do cp -a "$version" /bundle/node/; done

3737 securityContext:

3838 {{- toYaml .Values.securityContext | nindent 12 }}

3939 volumeMounts:

40 - name: actions-runtime

41 mountPath: /bundle

40 - name: actions-bin

41 mountPath: /bundle/bin

42 - name: actions-node

43 mountPath: /bundle/node

4244 containers:

4345 - name: runner

4446 image: {{ include "gitdata.image" . }}

@@ -46,7 +48,7 @@

4648 args: ["runner"]

4749 env:

4850 - name: APP_RUNNER__SERVER_URL

49 value: {{ default (printf "http://%s-webhook:%d" (include "gitdata.fullname" .) .Values.webhook.port) .Values.runner.serverUrl | quote }}

51 value: {{ default (printf "http://%s-webhook:%v" (include "gitdata.fullname" .) .Values.webhook.port) .Values.runner.serverUrl | quote }}

5052 - name: APP_RUNNER__REGISTRATION_TOKEN

5153 valueFrom:

5254 secretKeyRef:

@@ -81,10 +83,10 @@

8183 volumeMounts:

8284 - name: workspace

8385 mountPath: /var/lib/gitdata-runner

84 - name: actions-runtime

85 mountPath: /opt/gitdata/actions

86 - name: actions-bin

87 mountPath: /opt/gitdata/actions/bin

8688 readOnly: true

87 - name: actions-runtime

89 - name: actions-node

8890 mountPath: /opt/gitdata/node

8991 readOnly: true

9092 {{- if .Values.runner.dockerEnabled }}

@@ -94,7 +96,9 @@

9496 volumes:

9597 - name: workspace

9698 emptyDir: {}

97 - name: actions-runtime

99 - name: actions-bin

100 emptyDir: {}

101 - name: actions-node

98102 emptyDir: {}

99103 {{- if .Values.runner.dockerEnabled }}

100104 - name: docker-sock

Modified chart/templates/webhook.yaml +0 −2 View chart/templates/webhook.yaml

@@ -44,8 +44,6 @@

4444 value: {{ .Values.webhook.port | quote }}

4545 - name: APP_WEBHOOK__PUBLIC_BASE_URL

4646 value: {{ default (printf "https://%s" .Values.webhook.ingress.host) .Values.config.env.APP_WEBHOOK__PUBLIC_BASE_URL | quote }}

47 - name: APP_CI__RUNTIME_BASE_URL

48 value: {{ default (printf "http://%s-webhook:%d" (include "gitdata.fullname" .) .Values.webhook.port) .Values.config.env.APP_CI__RUNTIME_BASE_URL | quote }}

4947 {{- with .Values.webhook.extraEnv }}

5048 {{- toYaml . | nindent 12 }}

5149 {{- end }}

Modified chart-runner/templates/deployment.yaml +14 −7 View chart-runner/templates/deployment.yaml

@@ -69,6 +69,9 @@

6969 initContainers:

7070 # 把 act 引擎与 Node 运行时从 actions 镜像搬进共享 emptyDir，

7171 # 主容器因此不必自带 act 工具链。

72 # 两个 emptyDir 分开挂载：bin 卷的根必须直接是 gitdata-actions-engine 所在目录，

73 # node 卷的根必须直接是 node12/16/20/24，才能对上 RunnerConfig 默认的

74 # /opt/gitdata/node/<version>/bin/node（合成一个卷会多出一层 node/）。

7275 - name: actions-runtime

7376 image: {{ include "runner.actionsImage" . }}

7477 imagePullPolicy: {{ .Values.actionsImage.pullPolicy }}

@@ -77,12 +80,14 @@

7780 - |

7881 mkdir -p /bundle/bin /bundle/node

7982 cp /usr/local/bin/gitdata-actions-engine /bundle/bin/

80 cp -a /opt/gitdata/node/. /bundle/node/

83 for version in /opt/gitdata/node/*/; do cp -a "$version" /bundle/node/; done

8184 securityContext:

8285 {{- toYaml .Values.securityContext | nindent 12 }}

8386 volumeMounts:

84 - name: actions-runtime

85 mountPath: /bundle

87 - name: actions-bin

88 mountPath: /bundle/bin

89 - name: actions-node

90 mountPath: /bundle/node

8691 containers:

8792 - name: runner

8893 image: {{ include "runner.image" . }}

@@ -125,10 +130,10 @@

125130 volumeMounts:

126131 - name: workspace

127132 mountPath: /var/lib/gitdata-runner

128 - name: actions-runtime

129 mountPath: /opt/gitdata/actions

133 - name: actions-bin

134 mountPath: /opt/gitdata/actions/bin

130135 readOnly: true

131 - name: actions-runtime

136 - name: actions-node

132137 mountPath: /opt/gitdata/node

133138 readOnly: true

134139 {{- if .Values.runner.dockerEnabled }}

@@ -138,7 +143,9 @@

138143 volumes:

139144 - name: workspace

140145 emptyDir: {}

141 - name: actions-runtime

146 - name: actions-bin

147 emptyDir: {}

148 - name: actions-node

142149 emptyDir: {}

143150 {{- if .Values.runner.dockerEnabled }}

144151 - name: docker-sock

Modified deploy/values/prod.yaml +6 −1 View deploy/values/prod.yaml

@@ -1,6 +1,6 @@

11image:

22 repository: harbor.gitdata.me/app/gitdata

3 tag: "sha-159a1eb"

3 tag: "9da24e1"

44 pullPolicy: IfNotPresent

55

66serviceAccount:

@@ -41,6 +41,11 @@

4141 # ensure_enabled()（lib/ci/src/service.rs:46），关闭时直接返回 403 Forbidden。

4242 # 开启后必须同时提供 APP_CI__SECRET_ENCRYPTION_KEY（已在 gitdata-env Secret 中）。

4343 APP_CI__ENABLED: "true"

44 # 必须是纯 origin（无路径前缀）：lib/ci/src/actions_runtime.rs:158 actions_runtime_url()

45 # 会用 reqwest::Url::parse 校验，带路径就报 "must be a URL origin without a path prefix"。

46 # 用跨命名空间 FQDN：runner 池在 gitdata-runners 命名空间，这个 URL 会随 claim

47 # 响应下发（lib/ci/src/actions_payload.rs:87 runtime_url），必须两边都能解析。

48 APP_CI__RUNTIME_BASE_URL: "http://gitdata-webhook.gitdata.svc.cluster.local:3005"

4449 RUST_LOG: "info,session::session_store=error"

4550 OTEL_TRACES_SAMPLER: "parentbased_traceidratio"

4651 OTEL_TRACES_SAMPLER_ARG: "0.2"

Modified deploy/values/runner-prod.yaml +1 −1 View deploy/values/runner-prod.yaml

@@ -12,7 +12,7 @@

1212

1313image:

1414 repository: harbor.gitdata.me/app/gitdata

15 tag: "sha-159a1eb"

15 tag: "9da24e1"

1616 pullPolicy: IfNotPresent

1717

1818actionsImage: