mirror of
https://gitea.com/gitea/helm-actions.git
synced 2026-07-16 11:14:44 +00:00
Compare commits
8 Commits
feed57504f
...
feat/custo
| Author | SHA1 | Date | |
|---|---|---|---|
| 40128e86af | |||
| 12d63282a3 | |||
| 2a43b44c2b | |||
| 5fbf28ccbc | |||
| 29df27268d | |||
| 764f89ee97 | |||
| 26781c900b | |||
| 0dbbe94f0a |
@ -13,7 +13,7 @@ jobs:
|
||||
- name: install tools
|
||||
run: |
|
||||
apk add -q --update --no-cache nodejs curl jq sed
|
||||
- uses: actions/checkout@v6
|
||||
- uses: actions/checkout@v7
|
||||
with:
|
||||
fetch-depth: 0
|
||||
- name: Generate upcoming changelog
|
||||
|
||||
@ -11,9 +11,9 @@ on:
|
||||
jobs:
|
||||
check-and-test:
|
||||
runs-on: ubuntu-latest
|
||||
container: commitlint/commitlint:21.0.2
|
||||
container: commitlint/commitlint:21.1.0
|
||||
steps:
|
||||
- uses: actions/checkout@v6
|
||||
- uses: actions/checkout@v7
|
||||
- name: check PR title
|
||||
run: |
|
||||
echo "${{ gitea.event.pull_request.title }}" | commitlint --config .commitlintrc.json
|
||||
|
||||
@ -13,7 +13,7 @@ jobs:
|
||||
generate-chart-publish:
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- uses: actions/checkout@v6
|
||||
- uses: actions/checkout@v7
|
||||
|
||||
- name: install Docker CLI
|
||||
uses: https://github.com/docker/setup-buildx-action@v4 # Gitea
|
||||
|
||||
@ -9,6 +9,6 @@ jobs:
|
||||
shellcheck:
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- uses: actions/checkout@v6
|
||||
- uses: actions/checkout@v7
|
||||
- run: apt update --yes && apt install --yes shellcheck
|
||||
- run: find . -type f -name "*.sh" -exec shellcheck -a {} \;
|
||||
|
||||
@ -26,7 +26,7 @@ jobs:
|
||||
uses: pnpm/action-setup@v6
|
||||
with:
|
||||
version: 11
|
||||
- uses: actions/checkout@v6
|
||||
- uses: actions/checkout@v7
|
||||
- name: install chart dependencies
|
||||
run: helm dependency build
|
||||
- name: lint
|
||||
|
||||
22
README.md
22
README.md
@ -29,6 +29,16 @@ Deploy with your values, make sure the path is correct:
|
||||
helm upgrade --install gitea-actions gitea-charts/actions -f values.yaml
|
||||
```
|
||||
|
||||
Alternatively:
|
||||
|
||||
```sh
|
||||
helm upgrade --install gitea-actions gitea-charts/actions \
|
||||
--set enabled=true \
|
||||
--set giteaRootURL=https://gitea.com \
|
||||
--set existingSecret=foo \
|
||||
--set existingSecretKey=bar
|
||||
```
|
||||
|
||||
You should be good to go!
|
||||
|
||||
### Runner Token Secret Template
|
||||
@ -98,13 +108,15 @@ If `.Values.statefulset.dind.rootless: true` is set, then the following will be
|
||||
### Gitea Actions Init
|
||||
|
||||
| Name | Description | Value |
|
||||
| ------------------------- | ---------------------------------------------------------------------------------------------------------- | -------------- |
|
||||
| `init.image.registry` | image registry, e.g. gcr.io,docker.io | `""` |
|
||||
| `init.image.repository` | The init image | `busybox` |
|
||||
| `init.image.tag` | the init image tag | `1.38.0` |
|
||||
| ----------------------------------- | ---------------------------------------------------------------------------------------------------------- | -------------- |
|
||||
| `init.image.registry` | Image registry, e.g. gcr.io,docker.io | `""` |
|
||||
| `init.image.repository` | The init image (default: busyboxy but can be changed to alpine e.g.) | `busybox` |
|
||||
| `init.image.tag` | The init image tag | `1.38.0` |
|
||||
| `init.image.digest` | Image digest. Allows to pin the given image tag. Useful for having control over mutable tags like `latest` | `""` |
|
||||
| `init.image.pullPolicy` | The init image pullPolicy | `IfNotPresent` |
|
||||
| `init.image.fullOverride` | Completely overrides the image registry, path/image, tag and digest. | `""` |
|
||||
| `init.image.fullOverride` | Completely overrides the image registry, path/image, tag and digest | `""` |
|
||||
| `init.connectionCommandOverride` | Possiblity to change the command with which the container tests its connection to the Gitea server | `""` |
|
||||
| `init.preConnectionCommandOverride` | Possibility to add commands that happen before the connection test loop | `""` |
|
||||
|
||||
### Runner Token Secret Configuration
|
||||
|
||||
|
||||
@ -1,3 +1,3 @@
|
||||
# Gitea Actions Helm Chart Docs
|
||||
|
||||
- [Share dind with job container](share-dind-with-job-container.md)
|
||||
- [connectionCommandOverride explanation](./connectionCommandOverride.md)
|
||||
|
||||
@ -1,31 +0,0 @@
|
||||
# Gitea Actions
|
||||
|
||||
In order to use the Gitea Actions act-runner you must either:
|
||||
|
||||
- enable persistence (used for automatic deployment to be able to store the token in a place accessible for the Job)
|
||||
- create a secret containing the act runner token and reference it as a `existingSecret`
|
||||
|
||||
In order to use Gitea Actions, you must log on the server that's running Gitea and run the command:
|
||||
`gitea actions generate-runner-token`
|
||||
|
||||
This command will out a token that is needed by the act-runner to register with the Gitea backend.
|
||||
|
||||
Because this is a manual operation, we automated this using a Kubernetes Job using the following containers:
|
||||
|
||||
1) `actions-token-create`: it uses the current `gitea-rootless` image, mounts the persistent directory to `/data/` then it saves the output from `gitea actions generate-runner-token` to `/data/actions/token`
|
||||
2) `actions-token-upload`: it uses a `bitnami/kubectl` image, mounts the scripts directory (`/scripts`) and
|
||||
the persistent directory (`/data/`), and using the script from `/scripts/token.sh` stores the token in a Kubernetes secret
|
||||
|
||||
After the token is stored in a Kubernetes secret we can create the statefulset that contains the following containers:
|
||||
|
||||
1) `act-runner`: authenticates with Gitea using the token that was stored in the secret
|
||||
2) `dind`: DockerInDocker image that is used to run the actions
|
||||
|
||||
If you are not using persistent volumes, you cannot use the Job to automatically generate the token.
|
||||
In this case, you can use either the Web UI to generate the token or run a shell into a Gitea pod and invoke
|
||||
the command `gitea actions generate-runner-token`. After generating the token, you must create a secret and use it via:
|
||||
|
||||
```yaml
|
||||
existingSecret: "secret-name"
|
||||
existingSecretKey: "secret-key"
|
||||
```
|
||||
48
docs/connectionCommandOverride.md
Normal file
48
docs/connectionCommandOverride.md
Normal file
@ -0,0 +1,48 @@
|
||||
# Using a custom connectionCommand
|
||||
|
||||
By default, before the container starts it tries to reach the given giteaRootURL.
|
||||
Normally this is done by the busybox image using the wget binary.
|
||||
|
||||
However, due to [Issue #162](https://gitea.com/gitea/helm-actions/issues/162) there has been a change made where we can customize that command.
|
||||
|
||||
Using the `values.yaml` file by default it calls `wget --spider --no-check-certificate <your giteaRootURL>` with a timeout of 10 seconds.
|
||||
But with a custom init section like detailed below we can make our check compliant with whatever certificate you have.
|
||||
|
||||
Assuming:
|
||||
```yaml
|
||||
enabled: true
|
||||
giteaRootURL: https://gitea.com
|
||||
existingSecret: foo
|
||||
existingSecretKey: bar
|
||||
|
||||
init:
|
||||
image:
|
||||
registry: ""
|
||||
repository: alpine
|
||||
# Overrides the image tag whose default is the chart appVersion.
|
||||
tag: "3.24"
|
||||
digest: ""
|
||||
pullPolicy: IfNotPresent
|
||||
fullOverride: ""
|
||||
|
||||
connectionCommandOverride: "curl -I"
|
||||
preConnectionCommandOverride: "apk add curl"
|
||||
```
|
||||
|
||||
This now creates the following template section:
|
||||
|
||||
```yaml
|
||||
- name: init-gitea
|
||||
image: "alpine:latest"
|
||||
command:
|
||||
- sh
|
||||
- -c
|
||||
- |
|
||||
apk add curl
|
||||
echo 'Trying to reach Gitea on https://gitea.com'
|
||||
until timeout 10 curl -I https://gitea.com; do
|
||||
sleep 3
|
||||
echo "Trying again in 3 seconds..."
|
||||
done
|
||||
echo "Gitea has been reached!"
|
||||
```
|
||||
@ -1,30 +0,0 @@
|
||||
# Share dind with job container
|
||||
|
||||
You can weaken isolation and allow jobs to call docker commands.
|
||||
|
||||
## Limitations
|
||||
|
||||
-
|
||||
|
||||
## Example Values
|
||||
|
||||
```yaml
|
||||
config: |
|
||||
log:
|
||||
level: debug
|
||||
cache:
|
||||
enabled: false
|
||||
container:
|
||||
require_docker: true
|
||||
docker_timeout: 300s
|
||||
|
||||
## Specify an existing token secret
|
||||
##
|
||||
existingSecret: "runner-token2"
|
||||
existingSecretKey: "token"
|
||||
|
||||
## Specify the root URL of the Gitea instance
|
||||
giteaRootURL: "http://192.168.1.2:3000"
|
||||
```
|
||||
|
||||
Now you can run docker commands inside your jobs.
|
||||
8
pnpm-lock.yaml
generated
8
pnpm-lock.yaml
generated
@ -50,8 +50,8 @@ packages:
|
||||
brace-expansion@1.1.15:
|
||||
resolution: {integrity: sha512-EwOCDEex4quD37XhqM3omwtMoJjr//isUZz1JopUNWms+4Z2ViyM/k1YIRePpoVNnQhENnxtFjLaxNHrT7xIUg==}
|
||||
|
||||
brace-expansion@5.0.6:
|
||||
resolution: {integrity: sha512-kLpxurY4Z4r9sgMsyG0Z9uzsBlgiU/EFKhj/h91/8yHu0edo7XuixOIH3VcJ8kkxs6/jPzoI6U9Vj3WqbMQ94g==}
|
||||
brace-expansion@5.0.7:
|
||||
resolution: {integrity: sha512-7oFy703dxfY3/NLxC1fh2SUCQ0H9rmAY+5EpDVfXjUTTs+HEwR2nYaqLv+GWcTsumwxPfiz6CzCNkwXwBUwqCA==}
|
||||
engines: {node: 18 || 20 || >=22}
|
||||
|
||||
character-entities-legacy@3.0.0:
|
||||
@ -378,7 +378,7 @@ snapshots:
|
||||
balanced-match: 1.0.2
|
||||
concat-map: 0.0.1
|
||||
|
||||
brace-expansion@5.0.6:
|
||||
brace-expansion@5.0.7:
|
||||
dependencies:
|
||||
balanced-match: 4.0.4
|
||||
|
||||
@ -698,7 +698,7 @@ snapshots:
|
||||
|
||||
minimatch@10.2.5:
|
||||
dependencies:
|
||||
brace-expansion: 5.0.6
|
||||
brace-expansion: 5.0.7
|
||||
|
||||
minimatch@3.1.5:
|
||||
dependencies:
|
||||
|
||||
@ -66,14 +66,21 @@ spec:
|
||||
- mountPath: /data
|
||||
name: data-runner
|
||||
{{- end }}
|
||||
- name: init-gitea
|
||||
- name: reach-gitea
|
||||
image: "{{ include "gitea.actions.init.image" . }}"
|
||||
command:
|
||||
- sh
|
||||
- -c
|
||||
- |
|
||||
{{- if .Values.init.preConnectionCommandOverride }}
|
||||
{{ .Values.init.preConnectionCommandOverride }}
|
||||
{{- end }}
|
||||
echo 'Trying to reach Gitea on {{ include "gitea.actions.local_root_url" . }}'
|
||||
{{- if .Values.init.connectionCommandOverride }}
|
||||
until timeout 10 {{ .Values.init.connectionCommandOverride }} {{ include "gitea.actions.local_root_url" . }}; do
|
||||
{{- else }}
|
||||
until timeout 10 wget --no-check-certificate --spider {{ include "gitea.actions.local_root_url" . }}; do
|
||||
{{- end }}
|
||||
sleep 3
|
||||
echo "Trying again in 3 seconds..."
|
||||
done
|
||||
|
||||
14
values.yaml
14
values.yaml
@ -121,12 +121,15 @@ statefulset:
|
||||
|
||||
## @section Gitea Actions Init
|
||||
#
|
||||
## @param init.image.registry image registry, e.g. gcr.io,docker.io
|
||||
## @param init.image.repository The init image
|
||||
## @param init.image.tag the init image tag
|
||||
## @param init.image.registry Image registry, e.g. gcr.io,docker.io
|
||||
## @param init.image.repository The init image (default: busyboxy but can be changed to alpine e.g.)
|
||||
## @param init.image.tag The init image tag
|
||||
## @param init.image.digest Image digest. Allows to pin the given image tag. Useful for having control over mutable tags like `latest`
|
||||
## @param init.image.pullPolicy The init image pullPolicy
|
||||
## @param init.image.fullOverride Completely overrides the image registry, path/image, tag and digest.
|
||||
## @param init.image.fullOverride Completely overrides the image registry, path/image, tag and digest
|
||||
#
|
||||
## @param init.connectionCommandOverride Possiblity to change the command with which the container tests its connection to the Gitea server
|
||||
## @param init.preConnectionCommandOverride Possibility to add commands that happen before the connection test loop
|
||||
init:
|
||||
image:
|
||||
registry: ""
|
||||
@ -137,6 +140,9 @@ init:
|
||||
pullPolicy: IfNotPresent
|
||||
fullOverride: ""
|
||||
|
||||
connectionCommandOverride: ""
|
||||
preConnectionCommandOverride: ""
|
||||
|
||||
## @section Runner Token Secret Configuration
|
||||
#
|
||||
## @param existingSecret Secret that contains the token
|
||||
|
||||
Reference in New Issue
Block a user