237 lines
8.4 KiB
YAML
237 lines
8.4 KiB
YAML
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: {{ include "gitlab-runner.fullname" . }}
|
|
namespace: {{ default .Release.Namespace .Values.runners.namespace | quote }}
|
|
labels:
|
|
app: {{ include "gitlab-runner.fullname" . }}
|
|
chart: {{ include "gitlab-runner.chart" . }}
|
|
release: "{{ .Release.Name }}"
|
|
heritage: "{{ .Release.Service }}"
|
|
data:
|
|
entrypoint: |
|
|
#!/bin/bash
|
|
set -e
|
|
|
|
mkdir -p /home/gitlab-runner/.gitlab-runner/
|
|
|
|
cp /configmaps/config.toml /home/gitlab-runner/.gitlab-runner/
|
|
|
|
{{- if and (eq (default 1.0 .Values.replicas) 1.0) .Values.sessionServer .Values.sessionServer.enabled }}
|
|
quit() {
|
|
kill -TERM "$child"
|
|
}
|
|
|
|
trap quit QUIT TERM
|
|
|
|
sh /configmaps/set-session-server-address &
|
|
child=$!
|
|
wait "$child"
|
|
{{- end }}
|
|
|
|
# Set up environment variables for cache
|
|
if [[ -f /secrets/accesskey && -f /secrets/secretkey ]]; then
|
|
export CACHE_S3_ACCESS_KEY=$(cat /secrets/accesskey)
|
|
export CACHE_S3_SECRET_KEY=$(cat /secrets/secretkey)
|
|
fi
|
|
|
|
if [[ -f /secrets/gcs-applicaton-credentials-file ]]; then
|
|
export GOOGLE_APPLICATION_CREDENTIALS="/secrets/gcs-applicaton-credentials-file"
|
|
elif [[ -f /secrets/gcs-application-credentials-file ]]; then
|
|
export GOOGLE_APPLICATION_CREDENTIALS="/secrets/gcs-application-credentials-file"
|
|
else
|
|
if [[ -f /secrets/gcs-access-id && -f /secrets/gcs-private-key ]]; then
|
|
export CACHE_GCS_ACCESS_ID=$(cat /secrets/gcs-access-id)
|
|
# echo -e used to make private key multiline (in google json auth key private key is oneline with \n)
|
|
export CACHE_GCS_PRIVATE_KEY=$(echo -e $(cat /secrets/gcs-private-key))
|
|
fi
|
|
fi
|
|
|
|
if [[ -f /secrets/azure-account-name && -f /secrets/azure-account-key ]]; then
|
|
export CACHE_AZURE_ACCOUNT_NAME=$(cat /secrets/azure-account-name)
|
|
export CACHE_AZURE_ACCOUNT_KEY=$(cat /secrets/azure-account-key)
|
|
fi
|
|
|
|
if [[ -f /secrets/runner-registration-token ]]; then
|
|
export REGISTRATION_TOKEN=$(cat /secrets/runner-registration-token)
|
|
fi
|
|
|
|
if [[ -f /secrets/runner-token ]]; then
|
|
export CI_SERVER_TOKEN=$(cat /secrets/runner-token)
|
|
fi
|
|
|
|
{{- if and (not (empty .Values.runnerToken)) (ne "1" ((default "1" .Values.replicas) | toString)) }}
|
|
{{- fail "Using a runner token with more than 1 replica is not supported." }}
|
|
{{- end }}
|
|
|
|
# Validate this also at runtime in case the user has set a custom secret
|
|
if [[ ! -z "$CI_SERVER_TOKEN" && "{{ default 1 .Values.replicas }}" -ne "1" ]]; then
|
|
echo "Using a runner token with more than 1 replica is not supported."
|
|
exit 1
|
|
fi
|
|
|
|
# Register the runner
|
|
if ! sh /configmaps/register-the-runner; then
|
|
exit 1
|
|
fi
|
|
|
|
# Run pre-entrypoint-script
|
|
if ! bash /configmaps/pre-entrypoint-script; then
|
|
exit 1
|
|
fi
|
|
|
|
# Start the runner
|
|
exec /entrypoint run --user=gitlab-runner \
|
|
--working-directory=/home/gitlab-runner
|
|
|
|
config.toml: |
|
|
concurrent = {{ .Values.concurrent }}
|
|
check_interval = {{ .Values.checkInterval }}
|
|
log_level = {{ default "info" .Values.logLevel | quote }}
|
|
{{- if .Values.logFormat }}
|
|
log_format = {{ .Values.logFormat | quote }}
|
|
{{- end }}
|
|
{{- if .Values.metrics.enabled }}
|
|
listen_address = ':9252'
|
|
{{- end }}
|
|
{{- if .Values.sentryDsn }}
|
|
sentry_dsn = "{{ .Values.sentryDsn }}"
|
|
{{- end }}
|
|
{{- if and (eq (default 1.0 .Values.replicas) 1.0) .Values.sessionServer .Values.sessionServer.enabled }}
|
|
[session_server]
|
|
session_timeout = {{ include "gitlab-runner.server-session-timeout" . }}
|
|
listen_address = "0.0.0.0:{{ include "gitlab-runner.server-session-internal-port" . }}"
|
|
advertise_address = "SESSION_SERVER_IP:{{ include "gitlab-runner.server-session-external-port" . }}"
|
|
{{- end }}
|
|
|
|
{{ if .Values.runners.config }}
|
|
config.template.toml: {{ tpl (toYaml .Values.runners.config) $ | indent 2 }}
|
|
{{ end }}
|
|
|
|
register-the-runner: |
|
|
#!/bin/bash
|
|
MAX_REGISTER_ATTEMPTS=30
|
|
|
|
for i in $(seq 1 "${MAX_REGISTER_ATTEMPTS}"); do
|
|
echo "Registration attempt ${i} of ${MAX_REGISTER_ATTEMPTS}"
|
|
/entrypoint register \
|
|
{{- range .Values.runners.imagePullSecrets }}
|
|
--kubernetes-image-pull-secrets {{ . | quote }} \
|
|
{{- end }}
|
|
{{- range $key, $val := .Values.runners.nodeSelector }}
|
|
--kubernetes-node-selector {{ $key | quote }}:{{ $val | quote }} \
|
|
{{- end }}
|
|
{{- range .Values.runners.nodeTolerations }}
|
|
{{- $keyValue := .key }}
|
|
{{- if eq (.operator | default "Equal") "Equal" }}
|
|
{{- $keyValue = print $keyValue "=" (.value | default "" ) }}
|
|
{{- end }}
|
|
--kubernetes-node-tolerations {{ $keyValue }}:{{ .effect | quote }} \
|
|
{{- end }}
|
|
{{- range $key, $value := .Values.runners.podLabels }}
|
|
--kubernetes-pod-labels {{ $key | quote }}:{{ $value | quote }} \
|
|
{{- end }}
|
|
{{- range $key, $val := .Values.runners.podAnnotations }}
|
|
--kubernetes-pod-annotations {{ $key | quote }}:{{ $val | quote }} \
|
|
{{- end }}
|
|
{{- if and (hasKey .Values.runners "name") .Values.runners.name }}
|
|
--name={{ .Values.runners.name | quote -}} \
|
|
{{- end }}
|
|
{{- if and (hasKey .Values.runners "maximumTimeout") .Values.runners.maximumTimeout }}
|
|
--maximum-timeout={{ .Values.runners.maximumTimeout | quote -}} \
|
|
{{- end }}
|
|
{{- range $key, $value := .Values.runners.env }}
|
|
--env {{ $key | quote -}} = {{- $value | quote }} \
|
|
{{- end }}
|
|
{{- if and (hasKey .Values.runners "runUntagged") .Values.runners.runUntagged }}
|
|
--run-untagged=true \
|
|
{{- end }}
|
|
{{- if and (hasKey .Values.runners "protected") .Values.runners.protected }}
|
|
--access-level="ref_protected" \
|
|
{{- end }}
|
|
{{- if .Values.runners.pod_security_context }}
|
|
{{- if .Values.runners.pod_security_context.supplemental_groups }}
|
|
{{- range $gid := .Values.runners.pod_security_context.supplemental_groups }}
|
|
--kubernetes-pod-security-context-supplemental-groups {{ $gid | quote }} \
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- if .Values.runners.config }}
|
|
--template-config /configmaps/config.template.toml \
|
|
{{- end }}
|
|
--non-interactive
|
|
|
|
retval=$?
|
|
|
|
if [ ${retval} = 0 ]; then
|
|
break
|
|
elif [ ${i} = ${MAX_REGISTER_ATTEMPTS} ]; then
|
|
exit 1
|
|
fi
|
|
|
|
sleep 5
|
|
done
|
|
|
|
exit 0
|
|
|
|
check-live: |
|
|
#!/bin/bash
|
|
if /usr/bin/pgrep -f .*register-the-runner; then
|
|
exit 0
|
|
elif /usr/bin/pgrep gitlab.*runner; then
|
|
exit 0
|
|
else
|
|
exit 1
|
|
fi
|
|
|
|
{{- if and (eq (default 1.0 .Values.replicas) 1.0) .Values.sessionServer .Values.sessionServer.enabled }}
|
|
set-session-server-address: |
|
|
#!/bin/bash
|
|
|
|
{{- if (not .Values.sessionServer.publicIP) }}
|
|
APISERVER=https://kubernetes.default.svc \
|
|
&& SERVICEACCOUNT=/var/run/secrets/kubernetes.io/serviceaccount \
|
|
&& NAMESPACE=$(cat ${SERVICEACCOUNT}/namespace) \
|
|
&& TOKEN=$(cat ${SERVICEACCOUNT}/token) \
|
|
&& CACERT=${SERVICEACCOUNT}/ca.crt \
|
|
&& header="Authorization: Bearer ${TOKEN}"
|
|
|
|
SERVICEURL=${APISERVER}/api/v1/namespaces/${NAMESPACE}/services/{{ include "gitlab-runner.fullname" . }}-session-server
|
|
|
|
has_address=false
|
|
while [ "${has_address}" = false ]; do
|
|
SERVICEIP=$(curl —-silent \
|
|
--cacert ${CACERT} \
|
|
--header "${header}" \
|
|
-X GET ${SERVICEURL} 2>/dev/null \
|
|
| grep '"ip":' | cut -d ":" -f2 | xargs)
|
|
|
|
# for aws, the hostname is available but not the external IP
|
|
SERVICEHOSTNAME=$(curl —-silent \
|
|
--cacert ${CACERT} \
|
|
--header "${header}" \
|
|
-X GET ${SERVICEURL} 2>/dev/null \
|
|
| grep '"hostname":' | cut -d ":" -f2 | xargs)
|
|
|
|
ADDRESS="${SERVICEHOSTNAME:-$SERVICEIP}"
|
|
|
|
if [ -z "${ADDRESS}" ]
|
|
then
|
|
echo "Service LoadBalancer External Address not yet available"
|
|
has_address=false
|
|
sleep 5
|
|
else
|
|
has_address=true
|
|
sed -i -e "s/SESSION_SERVER_IP/${ADDRESS}/g" /home/gitlab-runner/.gitlab-runner/config.toml
|
|
fi
|
|
done
|
|
{{- else }}
|
|
sed -i -e "s/SESSION_SERVER_IP/{{ .Values.sessionServer.publicIP }}/g" /home/gitlab-runner/.gitlab-runner/config.toml
|
|
{{- end}}
|
|
{{ end }}
|
|
|
|
pre-entrypoint-script: |
|
|
{{ .Values.preEntrypointScript | default "" | indent 4 }}
|
|
|
|
{{ if not (empty .Values.configMaps) }}{{ toYaml .Values.configMaps | indent 2 }}{{ end }}
|