From 5fbf28ccbc2bba51db8279807782ee681afb94a4 Mon Sep 17 00:00:00 2001 From: Daan Date: Thu, 9 Jul 2026 15:16:02 +0200 Subject: [PATCH] feat: add connectionCommandOverride and preConnectionCommandOverride parameters to values --- README.md | 18 ++++++----- docs/actions-dev.md | 31 ------------------ docs/connectionCommandOverride.md | 45 +++++++++++++++++++++++++++ docs/share-dind-with-job-container.md | 30 ------------------ templates/statefulset.yaml | 5 ++- values.yaml | 15 ++++++--- 6 files changed, 69 insertions(+), 75 deletions(-) delete mode 100644 docs/actions-dev.md create mode 100644 docs/connectionCommandOverride.md delete mode 100644 docs/share-dind-with-job-container.md diff --git a/README.md b/README.md index c632647..73a2339 100644 --- a/README.md +++ b/README.md @@ -107,14 +107,16 @@ If `.Values.statefulset.dind.rootless: true` is set, then the following will be ### Gitea Actions Init -| Name | Description | Value | -| ------------------------- | ---------------------------------------------------------------------------------------------------------- | -------------- | -| `init.image.registry` | image registry, e.g. gcr.io,docker.io | `""` | -| `init.image.repository` | The init image | `busybox` | -| `init.image.tag` | the init image tag | `1.38.0` | -| `init.image.digest` | Image digest. Allows to pin the given image tag. Useful for having control over mutable tags like `latest` | `""` | -| `init.image.pullPolicy` | The init image pullPolicy | `IfNotPresent` | -| `init.image.fullOverride` | Completely overrides the image registry, path/image, tag and digest. | `""` | +| Name | Description | Value | +| ----------------------------------- | ---------------------------------------------------------------------------------------------------------- | -------------- | +| `init.image.registry` | Image registry, e.g. gcr.io,docker.io | `""` | +| `init.image.repository` | The init image (default: busyboxy but can be changed to alpine e.g.) | `busybox` | +| `init.image.tag` | The init image tag | `1.38.0` | +| `init.image.digest` | Image digest. Allows to pin the given image tag. Useful for having control over mutable tags like `latest` | `""` | +| `init.image.pullPolicy` | The init image pullPolicy | `IfNotPresent` | +| `init.image.fullOverride` | Completely overrides the image registry, path/image, tag and digest | `""` | +| `init.connectionCommandOverride` | Possiblity to change the command with which the container tests its connection to the Gitea server | `""` | +| `init.preConnectionCommandOverride` | Possibility to add commands that happen before the connection test loop | `""` | ### Runner Token Secret Configuration diff --git a/docs/actions-dev.md b/docs/actions-dev.md deleted file mode 100644 index 7a6c83e..0000000 --- a/docs/actions-dev.md +++ /dev/null @@ -1,31 +0,0 @@ -# Gitea Actions - -In order to use the Gitea Actions act-runner you must either: - -- enable persistence (used for automatic deployment to be able to store the token in a place accessible for the Job) -- create a secret containing the act runner token and reference it as a `existingSecret` - -In order to use Gitea Actions, you must log on the server that's running Gitea and run the command: - `gitea actions generate-runner-token` - -This command will out a token that is needed by the act-runner to register with the Gitea backend. - -Because this is a manual operation, we automated this using a Kubernetes Job using the following containers: - -1) `actions-token-create`: it uses the current `gitea-rootless` image, mounts the persistent directory to `/data/` then it saves the output from `gitea actions generate-runner-token` to `/data/actions/token` -2) `actions-token-upload`: it uses a `bitnami/kubectl` image, mounts the scripts directory (`/scripts`) and -the persistent directory (`/data/`), and using the script from `/scripts/token.sh` stores the token in a Kubernetes secret - -After the token is stored in a Kubernetes secret we can create the statefulset that contains the following containers: - -1) `act-runner`: authenticates with Gitea using the token that was stored in the secret -2) `dind`: DockerInDocker image that is used to run the actions - -If you are not using persistent volumes, you cannot use the Job to automatically generate the token. -In this case, you can use either the Web UI to generate the token or run a shell into a Gitea pod and invoke -the command `gitea actions generate-runner-token`. After generating the token, you must create a secret and use it via: - -```yaml -existingSecret: "secret-name" -existingSecretKey: "secret-key" -``` diff --git a/docs/connectionCommandOverride.md b/docs/connectionCommandOverride.md new file mode 100644 index 0000000..4b15062 --- /dev/null +++ b/docs/connectionCommandOverride.md @@ -0,0 +1,45 @@ +# Using a custom connectionCommand + +By default, before the container starts it tries to reach the given giteaRootURL. +Normally this is done by the busybox image using the wget binary. + +However, due to [Issue #162](https://gitea.com/gitea/helm-actions/issues/162) there has been a change made where we can customize that command. + +Using the `values.yaml` file by default it calls `wget --spider --no-check-certificate ` with a timeout of 10 seconds. +But with a custom init section like detailed below we can make our check compliant with whatever certificate you have. + +Assuming: +```yaml +enabled: true +giteaRootURL: https://gitea.com +existingSecret: foo +existingSecretKey: bar + +init: + image: + registry: "" + repository: alpine + # Overrides the image tag whose default is the chart appVersion. + tag: "3.24" + digest: "" + pullPolicy: IfNotPresent + fullOverride: "" + connectionCommandOverride: "apk add curl && curl -I" +``` + +This now creates the following template section: + +```yaml + - name: init-gitea + image: "alpine:latest" + command: + - sh + - -c + - | + echo 'Trying to reach Gitea on https://gitea.com' + until timeout 10 apk add curl && curl -I https://gitea.com; do + sleep 3 + echo "Trying again in 3 seconds..." + done + echo "Gitea has been reached!" +``` diff --git a/docs/share-dind-with-job-container.md b/docs/share-dind-with-job-container.md deleted file mode 100644 index f94fb1c..0000000 --- a/docs/share-dind-with-job-container.md +++ /dev/null @@ -1,30 +0,0 @@ -# Share dind with job container - -You can weaken isolation and allow jobs to call docker commands. - -## Limitations - -- - -## Example Values - -```yaml - config: | - log: - level: debug - cache: - enabled: false - container: - require_docker: true - docker_timeout: 300s - -## Specify an existing token secret -## -existingSecret: "runner-token2" -existingSecretKey: "token" - -## Specify the root URL of the Gitea instance -giteaRootURL: "http://192.168.1.2:3000" -``` - -Now you can run docker commands inside your jobs. diff --git a/templates/statefulset.yaml b/templates/statefulset.yaml index b6f61df..6d1a98b 100644 --- a/templates/statefulset.yaml +++ b/templates/statefulset.yaml @@ -66,12 +66,15 @@ spec: - mountPath: /data name: data-runner {{- end }} - - name: init-gitea + - name: reach-gitea image: "{{ include "gitea.actions.init.image" . }}" command: - sh - -c - | + {{- if .Values.init.preConnectionCommandOverride }} + {{ .Values.init.preConnectionCommandOverride }} + {{- end }} echo 'Trying to reach Gitea on {{ include "gitea.actions.local_root_url" . }}' {{- if .Values.init.connectionCommandOverride }} until timeout 10 {{ .Values.init.connectionCommandOverride }} {{ include "gitea.actions.local_root_url" . }}; do diff --git a/values.yaml b/values.yaml index 4424029..1355178 100644 --- a/values.yaml +++ b/values.yaml @@ -121,13 +121,15 @@ statefulset: ## @section Gitea Actions Init # -## @param init.image.registry image registry, e.g. gcr.io,docker.io -## @param init.image.repository The init image -## @param init.image.tag the init image tag +## @param init.image.registry Image registry, e.g. gcr.io,docker.io +## @param init.image.repository The init image (default: busyboxy but can be changed to alpine e.g.) +## @param init.image.tag The init image tag ## @param init.image.digest Image digest. Allows to pin the given image tag. Useful for having control over mutable tags like `latest` ## @param init.image.pullPolicy The init image pullPolicy ## @param init.image.fullOverride Completely overrides the image registry, path/image, tag and digest -## @param init.image.connectionCommandOverride Possiblity to change the command with which the container tests its connection to Gitea +# +## @param init.connectionCommandOverride Possiblity to change the command with which the container tests its connection to the Gitea server +## @param init.preConnectionCommandOverride Possibility to add commands that happen before the connection test loop init: image: registry: "" @@ -137,7 +139,10 @@ init: digest: "" pullPolicy: IfNotPresent fullOverride: "" - connectionCommandOverride: "" + + connectionCommandOverride: "" + preConnectionCommandOverride: "" + ## @section Runner Token Secret Configuration #