feat(deploy): add the actions runner pool chart and enable CI

Added chart-runner/templates/_helpers.tpl +66 −0 View chart-runner/templates/_helpers.tpl

@@ -0,0 +1,66 @@

1{{- define "runner.name" -}}

2{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}

3{{- end -}}

4

5{{- define "runner.fullname" -}}

6{{- if .Values.fullnameOverride -}}

7{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}}

8{{- else -}}

9{{- $name := default .Chart.Name .Values.nameOverride -}}

10{{- if contains $name .Release.Name -}}

11{{- .Release.Name | trunc 63 | trimSuffix "-" -}}

12{{- else -}}

13{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}

14{{- end -}}

15{{- end -}}

16{{- end -}}

17

18{{- define "runner.chart" -}}

19{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}}

20{{- end -}}

21

22{{- define "runner.labels" -}}

23helm.sh/chart: {{ include "runner.chart" . }}

24app.kubernetes.io/name: {{ include "runner.name" . }}

25app.kubernetes.io/instance: {{ .Release.Name }}

26app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}

27app.kubernetes.io/managed-by: {{ .Release.Service }}

28app.kubernetes.io/component: runner

29{{- end -}}

30

31{{- define "runner.selectorLabels" -}}

32app.kubernetes.io/name: {{ include "runner.name" . }}

33app.kubernetes.io/instance: {{ .Release.Name }}

34app.kubernetes.io/component: runner

35{{- end -}}

36

37{{- define "runner.serviceAccountName" -}}

38{{- if .Values.serviceAccount.create -}}

39{{- default (include "runner.fullname" .) .Values.serviceAccount.name -}}

40{{- else -}}

41{{- default "default" .Values.serviceAccount.name -}}

42{{- end -}}

43{{- end -}}

44

45{{- define "runner.image" -}}

46{{- printf "%s:%s" .Values.image.repository (default .Chart.AppVersion .Values.image.tag) -}}

47{{- end -}}

48

49{{- define "runner.actionsImage" -}}

50{{- printf "%s:%s" .Values.actionsImage.repository (.Values.actionsImage.tag | default .Values.image.tag | default .Chart.AppVersion) -}}

51{{- end -}}

52

53{{- define "runner.secretName" -}}

54{{- if .Values.secret.existingSecret -}}

55{{- .Values.secret.existingSecret -}}

56{{- else -}}

57{{- printf "%s-env" (include "runner.fullname" .) -}}

58{{- end -}}

59{{- end -}}

60

61{{- define "runner.imagePullSecrets" -}}

62{{- with .Values.imagePullSecrets }}

63imagePullSecrets:

64 {{- toYaml . | nindent 2 }}

65{{- end }}

66{{- end -}}

No newline at end of file

Added chart-runner/templates/deployment.yaml +147 −0 View chart-runner/templates/deployment.yaml

@@ -0,0 +1,147 @@

1apiVersion: apps/v1

2kind: Deployment

3metadata:

4 name: {{ include "runner.fullname" . }}

5 labels:

6 {{- include "runner.labels" . | nindent 4 }}

7spec:

8 {{- if .Values.autoscaling.enabled }}

9 # 开着 HPA 时不要声明 replicas：HPA 通过 /scale 子资源写这个字段，

10 # kube-controller-manager 于是成为它的 manager；helm 的 server-side apply

11 # 再写一次就会报 conflict with "kube-controller-manager" with subresource

12 # "scale": .spec.replicas —— 升级直接失败；而且就算写进去，也会把已经扩上

13 # 去的副本数硬拉回 minReplicas。省略即让出所有权。

14 {{- else }}

15 replicas: {{ .Values.replicaCount }}

16 {{- end }}

17 revisionHistoryLimit: 3

18 strategy:

19 type: RollingUpdate

20 rollingUpdate:

21 maxSurge: 1

22 maxUnavailable: 0

23 selector:

24 matchLabels:

25 {{- include "runner.selectorLabels" . | nindent 6 }}

26 template:

27 metadata:

28 labels:

29 {{- include "runner.selectorLabels" . | nindent 8 }}

30 spec:

31 serviceAccountName: {{ include "runner.serviceAccountName" . }}

32 {{- include "runner.imagePullSecrets" . | nindent 6 }}

33 terminationGracePeriodSeconds: {{ .Values.terminationGracePeriodSeconds }}

34 securityContext:

35 {{- toYaml .Values.podSecurityContext | nindent 8 }}

36 {{- if .Values.scheduling.nodeSelector }}

37 nodeSelector:

38 {{- toYaml .Values.scheduling.nodeSelector | nindent 8 }}

39 {{- end }}

40 {{- if or .Values.scheduling.excludeControlPlane.enabled .Values.scheduling.affinity }}

41 affinity:

42 {{- if .Values.scheduling.excludeControlPlane.enabled }}

43 # 硬约束：不带 control-plane 标签的节点才允许调度（master-01..03 都带）

44 nodeAffinity:

45 requiredDuringSchedulingIgnoredDuringExecution:

46 nodeSelectorTerms:

47 - matchExpressions:

48 - key: {{ .Values.scheduling.excludeControlPlane.labelKey }}

49 operator: DoesNotExist

50 {{- end }}

51 {{- with .Values.scheduling.affinity }}

52 {{- toYaml . | nindent 8 }}

53 {{- end }}

54 {{- end }}

55 {{- if .Values.scheduling.tolerations }}

56 tolerations:

57 {{- toYaml . | nindent 8 }}

58 {{- end }}

59 {{- if .Values.scheduling.topologySpread.enabled }}

60 # 软性打散：允许单机多副本（ScheduleAnyway），只是倾向于摊开

61 topologySpreadConstraints:

62 - maxSkew: {{ .Values.scheduling.topologySpread.maxSkew }}

63 topologyKey: {{ .Values.scheduling.topologySpread.topologyKey }}

64 whenUnsatisfiable: {{ .Values.scheduling.topologySpread.whenUnsatisfiable }}

65 labelSelector:

66 matchLabels:

67 {{- include "runner.selectorLabels" . | nindent 14 }}

68 {{- end }}

69 initContainers:

70 # 把 act 引擎与 Node 运行时从 actions 镜像搬进共享 emptyDir，

71 # 主容器因此不必自带 act 工具链。

72 - name: actions-runtime

73 image: {{ include "runner.actionsImage" . }}

74 imagePullPolicy: {{ .Values.actionsImage.pullPolicy }}

75 command: ["sh", "-c"]

76 args:

77 - |

78 mkdir -p /bundle/bin /bundle/node

79 cp /usr/local/bin/gitdata-actions-engine /bundle/bin/

80 cp -a /opt/gitdata/node/. /bundle/node/

81 securityContext:

82 {{- toYaml .Values.securityContext | nindent 12 }}

83 volumeMounts:

84 - name: actions-runtime

85 mountPath: /bundle

86 containers:

87 - name: runner

88 image: {{ include "runner.image" . }}

89 imagePullPolicy: {{ .Values.image.pullPolicy }}

90 args: ["runner"]

91 env:

92 - name: APP_RUNNER__SERVER_URL

93 value: {{ .Values.serverUrl | quote }}

94 - name: APP_RUNNER__REGISTRATION_TOKEN

95 valueFrom:

96 secretKeyRef:

97 name: {{ include "runner.secretName" . }}

98 key: APP_RUNNER__REGISTRATION_TOKEN

99 optional: true

100 - name: APP_RUNNER__NAME

101 valueFrom:

102 fieldRef:

103 fieldPath: metadata.name

104 - name: APP_RUNNER__LABELS

105 value: {{ .Values.runner.labels | toJson | quote }}

106 - name: APP_RUNNER__CAPACITY

107 value: {{ .Values.runner.capacity | quote }}

108 - name: APP_RUNNER__WORKSPACE_ROOT

109 value: {{ .Values.runner.workspaceRoot | quote }}

110 - name: APP_RUNNER__CREDENTIAL_PATH

111 value: {{ .Values.runner.credentialPath | quote }}

112 - name: APP_RUNNER__DOCKER_ENABLED

113 value: {{ .Values.runner.dockerEnabled | quote }}

114 - name: APP_RUNNER__ACTIONS_ENGINE_BINARY

115 value: {{ .Values.runner.actionsEngineBinary | quote }}

116 - name: APP_RUNNER__ACTIONS_CACHE_DIR

117 value: {{ .Values.runner.actionsCacheDir | quote }}

118 {{- with .Values.runner.extraEnv }}

119 {{- toYaml . | nindent 12 }}

120 {{- end }}

121 securityContext:

122 {{- toYaml .Values.securityContext | nindent 12 }}

123 resources:

124 {{- toYaml .Values.runner.resources | nindent 12 }}

125 volumeMounts:

126 - name: workspace

127 mountPath: /var/lib/gitdata-runner

128 - name: actions-runtime

129 mountPath: /opt/gitdata/actions

130 readOnly: true

131 - name: actions-runtime

132 mountPath: /opt/gitdata/node

133 readOnly: true

134 {{- if .Values.runner.dockerEnabled }}

135 - name: docker-sock

136 mountPath: /var/run/docker.sock

137 {{- end }}

138 volumes:

139 - name: workspace

140 emptyDir: {}

141 - name: actions-runtime

142 emptyDir: {}

143 {{- if .Values.runner.dockerEnabled }}

144 - name: docker-sock

145 hostPath:

146 path: /var/run/docker.sock

147 {{- end }}

No newline at end of file

Added chart-runner/templates/hpa.yaml +34 −0 View chart-runner/templates/hpa.yaml

@@ -0,0 +1,34 @@

1{{- if .Values.autoscaling.enabled }}

2apiVersion: autoscaling/v2

3kind: HorizontalPodAutoscaler

4metadata:

5 name: {{ include "runner.fullname" . }}

6 labels:

7 {{- include "runner.labels" . | nindent 4 }}

8spec:

9 scaleTargetRef:

10 apiVersion: apps/v1

11 kind: Deployment

12 name: {{ include "runner.fullname" . }}

13 minReplicas: {{ .Values.autoscaling.minReplicas }}

14 maxReplicas: {{ .Values.autoscaling.maxReplicas }}

15 metrics:

16 - type: Resource

17 resource:

18 name: cpu

19 target:

20 type: Utilization

21 averageUtilization: {{ .Values.autoscaling.targetCPUUtilizationPercentage }}

22 {{- if gt (int (.Values.autoscaling.targetMemoryUtilizationPercentage | default 0)) 0 }}

23 - type: Resource

24 resource:

25 name: memory

26 target:

27 type: Utilization

28 averageUtilization: {{ .Values.autoscaling.targetMemoryUtilizationPercentage }}

29 {{- end }}

30 {{- with .Values.autoscaling.behavior }}

31 behavior:

32 {{- toYaml . | nindent 4 }}

33 {{- end }}

34{{- end }}

No newline at end of file

Added chart-runner/templates/networkpolicy.yaml +50 −0 View chart-runner/templates/networkpolicy.yaml

@@ -0,0 +1,50 @@

1{{- if .Values.networkPolicy.enabled }}

2# 1) 拒绝一切入站：runner 是纯客户端，没有被访问的需求

3apiVersion: networking.k8s.io/v1

4kind: NetworkPolicy

5metadata:

6 name: {{ include "runner.fullname" . }}-deny-ingress

7 labels:

8 {{- include "runner.labels" . | nindent 4 }}

9spec:

10 podSelector:

11 matchLabels:

12 {{- include "runner.selectorLabels" . | nindent 6 }}

13 policyTypes: ["Ingress"]

14 ingress: []

15---

16apiVersion: networking.k8s.io/v1

17kind: NetworkPolicy

18metadata:

19 name: {{ include "runner.fullname" . }}-egress

20 labels:

21 {{- include "runner.labels" . | nindent 4 }}

22spec:

23 podSelector:

24 matchLabels:

25 {{- include "runner.selectorLabels" . | nindent 6 }}

26 policyTypes: ["Egress"]

27 egress:

28 # DNS

29 - to:

30 - namespaceSelector:

31 matchLabels:

32 kubernetes.io/metadata.name: kube-system

33 ports:

34 - protocol: UDP

35 port: 53

36 - protocol: TCP

37 port: 53

38 # 调度中心（gitdata 命名空间的 webhook Service）

39 - to:

40 - namespaceSelector:

41 matchLabels:

42 kubernetes.io/metadata.name: {{ .Values.networkPolicy.webhookNamespace }}

43 ports:

44 - protocol: TCP

45 port: {{ .Values.networkPolicy.webhookPort }}

46 {{- if .Values.networkPolicy.allowAllEgress }}

47 # workflow 步骤要能出网（git clone / 依赖下载 / 拉取 action）

48 - {}

49 {{- end }}

50{{- end }}

No newline at end of file

Added chart-runner/templates/NOTES.txt +19 −0 View chart-runner/templates/NOTES.txt

@@ -0,0 +1,19 @@

1GitData runner 池已部署。

2

3 命名空间: {{ .Release.Namespace }}

4 Deployment: {{ include "runner.fullname" . }}

5 调度中心: {{ .Values.serverUrl }}

6 标签: {{ .Values.runner.labels | toJson }}

7 副本: {{ if .Values.autoscaling.enabled }}HPA min {{ .Values.autoscaling.minReplicas }} / max {{ .Values.autoscaling.maxReplicas }} (cpu {{ .Values.autoscaling.targetCPUUtilizationPercentage }}%){{ else }}{{ .Values.replicaCount }}{{ end }}

8

9前置条件（helm 不管这两件事）：

10 1. 注册令牌必须是可复用的：

11 UPDATE ci_runner_token SET single_use = false WHERE id = '<token-id>';

12 single_use=true 时只有第一个 pod 能注册，其余副本 401 崩溃。

13 2. Secret 必须已存在于本命名空间：

14 kubectl -n {{ .Release.Namespace }} create secret generic {{ include "runner.secretName" . }} \

15 --from-literal=APP_RUNNER__REGISTRATION_TOKEN='<id>.<secret>'

16

17查看状态：

18 kubectl -n {{ .Release.Namespace }} get deploy,hpa,pdb,pods -o wide

19 kubectl -n {{ .Release.Namespace }} logs -l app.kubernetes.io/component=runner -f

No newline at end of file

Added chart-runner/templates/pdb.yaml +13 −0 View chart-runner/templates/pdb.yaml

@@ -0,0 +1,13 @@

1{{- if .Values.podDisruptionBudget.enabled }}

2apiVersion: policy/v1

3kind: PodDisruptionBudget

4metadata:

5 name: {{ include "runner.fullname" . }}

6 labels:

7 {{- include "runner.labels" . | nindent 4 }}

8spec:

9 minAvailable: {{ .Values.podDisruptionBudget.minAvailable }}

10 selector:

11 matchLabels:

12 {{- include "runner.selectorLabels" . | nindent 6 }}

13{{- end }}

No newline at end of file

Added chart-runner/templates/secret.yaml +13 −0 View chart-runner/templates/secret.yaml

@@ -0,0 +1,13 @@

1{{- if and .Values.secret.create (not .Values.secret.existingSecret) }}

2apiVersion: v1

3kind: Secret

4metadata:

5 name: {{ include "runner.secretName" . }}

6 labels:

7 {{- include "runner.labels" . | nindent 4 }}

8type: Opaque

9stringData:

10 {{- range $k, $v := .Values.secret.env }}

11 {{ $k }}: {{ $v | quote }}

12 {{- end }}

13{{- end }}

No newline at end of file

Added chart-runner/templates/serviceaccount.yaml +14 −0 View chart-runner/templates/serviceaccount.yaml

@@ -0,0 +1,14 @@

1{{- if .Values.serviceAccount.create }}

2apiVersion: v1

3kind: ServiceAccount

4metadata:

5 name: {{ include "runner.serviceAccountName" . }}

6 labels:

7 {{- include "runner.labels" . | nindent 4 }}

8 {{- with .Values.serviceAccount.annotations }}

9 annotations:

10 {{- toYaml . | nindent 4 }}

11 {{- end }}

12# 不绑定任何 Role/ClusterRole：runner 只通过 HTTP 访问调度中心，

13# 从不调用 kube-apiserver，因此不需要（也不应该拥有）任何 RBAC 权限。

14{{- end }}

No newline at end of file

Added chart-runner/Chart.yaml +6 −0 View chart-runner/Chart.yaml

@@ -0,0 +1,6 @@

1apiVersion: v2

2name: chart-runner

3description: GitData actions runner 池（部署到独立命名空间，调度中心在 gitdata 命名空间）

4type: application

5version: 0.1.0

6appVersion: "1.0.0"

No newline at end of file

Added chart-runner/values.yaml +105 −0 View chart-runner/values.yaml

@@ -0,0 +1,105 @@

1# GitData actions runner 池的默认值。

2# 生产覆盖见 deploy/values/runner-prod.yaml。

3nameOverride: ""

4fullnameOverride: "gitdata-runner"

5

6# 调度中心（gitdata 命名空间的 webhook Service）地址。

7# 跨命名空间必须写全限定域名：

8# <service>.<namespace>.svc.cluster.local:<port>

9serverUrl: "http://gitdata-webhook.gitdata.svc.cluster.local:3005"

10

11image:

12 repository: harbor.gitdata.me/app/gitdata

13 tag: ""

14 pullPolicy: IfNotPresent

15

16# act 引擎镜像：提供 gitdata-actions-engine 二进制 + 4 套 Node 运行时

17actionsImage:

18 repository: harbor.gitdata.me/app/gitdata-act

19 tag: ""

20 pullPolicy: IfNotPresent

21

22imagePullSecrets: []

23

24serviceAccount:

25 create: true

26 name: ""

27 annotations: {}

28

29# 注册令牌（APP_RUNNER__REGISTRATION_TOKEN）。

30# 生产用 existingSecret：Secret 由 kubectl 直接建在集群里，任何一次 helm upgrade

31# 都不会把它覆盖或清空（写进 values 的令牌一旦漏传 -f 就会被空值刷掉）。

32secret:

33 create: false

34 existingSecret: "gitdata-runner-env"

35 env: {}

36

37runner:

38 # 不含 docker：只注册 self-hosted 标签。带 ubuntu-latest 等标签的 workflow

39 # 不会被接单（要接单需要 dockerEnabled + 拉 ghcr.io/catthehacker/ubuntu）。

40 labels: ["self-hosted"]

41 # 每个副本同时只跑 1 个作业；并发度靠副本数

42 capacity: 1

43 dockerEnabled: false

44 workspaceRoot: /var/lib/gitdata-runner

45 credentialPath: /var/lib/gitdata-runner/credential

46 actionsEngineBinary: /opt/gitdata/actions/bin/gitdata-actions-engine

47 actionsCacheDir: /var/lib/gitdata-runner/actions

48 extraEnv: []

49 resources:

50 requests: { cpu: 500m, memory: 512Mi }

51 limits: { memory: 4Gi }

52

53# 仅在 autoscaling.enabled=false 时生效

54replicaCount: 3

55

56autoscaling:

57 enabled: true

58 minReplicas: 3

59 maxReplicas: 6

60 targetCPUUtilizationPercentage: 70

61 # 0 = 不启用内存指标

62 targetMemoryUtilizationPercentage: 0

63 behavior: {}

64

65scheduling:

66 # 排除 master / 控制面节点

67 excludeControlPlane:

68 enabled: true

69 labelKey: node-role.kubernetes.io/control-plane

70 nodeSelector: {}

71 tolerations: []

72 affinity: {}

73 # 软性打散：maxSkew=1 + ScheduleAnyway，既不堆在一台，也不禁止单机多副本。

74 # 扩容时新副本由 kube-scheduler 默认的 LeastAllocated 打分挑当前请求量最小

75 # 的节点，即"负载由小到大"。

76 topologySpread:

77 enabled: true

78 maxSkew: 1

79 topologyKey: kubernetes.io/hostname

80 whenUnsatisfiable: ScheduleAnyway

81

82podDisruptionBudget:

83 enabled: true

84 minAvailable: 2

85

86networkPolicy:

87 enabled: true

88 # 调度中心所在的命名空间与端口（允许 egress）

89 webhookNamespace: gitdata

90 webhookPort: 3005

91 # workflow 步骤需要上网（git clone / 包下载 / 拉 action），默认放行全部出站

92 allowAllEgress: true

93

94podSecurityContext:

95 fsGroup: 10001

96securityContext:

97 runAsNonRoot: true

98 runAsUser: 10001

99 allowPrivilegeEscalation: false

100 seccompProfile:

101 type: RuntimeDefault

102 capabilities:

103 drop: ["ALL"]

104

105terminationGracePeriodSeconds: 300

No newline at end of file

Modified deploy/values/prod.yaml +5 −1 View deploy/values/prod.yaml

@@ -1,6 +1,6 @@

11image:

22 repository: harbor.gitdata.me/app/gitdata

3 tag: "sha-d46785a"

3 tag: "sha-159a1eb"

44 pullPolicy: IfNotPresent

55

66serviceAccount:

@@ -37,6 +37,10 @@

3737 APP_EMAIL__FROM_ADDRESS: "bot@mail.gitdata.ai"

3838 APP_EMAIL__FROM_NAME: "GitData"

3939 APP_EMAIL_QUEUE__ENABLED: "true"

40 # CI 开关：runner 注册走 /api/v1/runner/register，该处理函数第一件事就是

41 # ensure_enabled()（lib/ci/src/service.rs:46），关闭时直接返回 403 Forbidden。

42 # 开启后必须同时提供 APP_CI__SECRET_ENCRYPTION_KEY（已在 gitdata-env Secret 中）。

43 APP_CI__ENABLED: "true"

4044 RUST_LOG: "info,session::session_store=error"

4145 OTEL_TRACES_SAMPLER: "parentbased_traceidratio"

4246 OTEL_TRACES_SAMPLER_ARG: "0.2"

Added deploy/values/runner-prod.yaml +84 −0 View deploy/values/runner-prod.yaml

@@ -0,0 +1,84 @@

1# GitData runner 池的生产覆盖值（不含任何密钥）。

2#

3# 部署 / 升级：

4# helm upgrade --install gitdata-runners ./chart-runner \

5# -n gitdata-runners --create-namespace \

6# -f deploy/values/runner-prod.yaml \

7# --wait --timeout 10m --atomic

8#

9# 注册令牌由 Secret 提供（existingSecret），不经过 helm：

10# kubectl -n gitdata-runners create secret generic gitdata-runner-env \

11# --from-literal=APP_RUNNER__REGISTRATION_TOKEN='<token-id>.<token-secret>'

12

13image:

14 repository: harbor.gitdata.me/app/gitdata

15 tag: "sha-159a1eb"

16 pullPolicy: IfNotPresent

17

18actionsImage:

19 repository: harbor.gitdata.me/app/gitdata-act

20 # 留空 = 跟随 image.tag

21 tag: ""

22 pullPolicy: IfNotPresent

23

24serviceAccount:

25 create: true

26

27secret:

28 create: false

29 existingSecret: gitdata-runner-env

30

31# 跨命名空间访问调度中心

32serverUrl: "http://gitdata-webhook.gitdata.svc.cluster.local:3005"

33

34runner:

35 labels: ["self-hosted"]

36 capacity: 1

37 dockerEnabled: false

38 resources:

39 requests: { cpu: 500m, memory: 512Mi }

40 limits: { memory: 4Gi }

41

42autoscaling:

43 enabled: true

44 minReplicas: 3

45 maxReplicas: 6

46 targetCPUUtilizationPercentage: 70

47 targetMemoryUtilizationPercentage: 0

48 behavior:

49 scaleUp:

50 stabilizationWindowSeconds: 30

51 policies:

52 - type: Percent

53 value: 100

54 periodSeconds: 60

55 - type: Pods

56 value: 2

57 periodSeconds: 60

58 selectPolicy: Max

59 scaleDown:

60 stabilizationWindowSeconds: 600

61 policies:

62 - type: Pods

63 value: 1

64 periodSeconds: 120

65

66scheduling:

67 excludeControlPlane:

68 enabled: true

69 labelKey: node-role.kubernetes.io/control-plane

70 topologySpread:

71 enabled: true

72 maxSkew: 1

73 topologyKey: kubernetes.io/hostname

74 whenUnsatisfiable: ScheduleAnyway

75

76podDisruptionBudget:

77 enabled: true

78 minAvailable: 2

79

80networkPolicy:

81 enabled: true

82 webhookNamespace: gitdata

83 webhookPort: 3005

84 allowAllEgress: true

No newline at end of file