gitea_admin/deploy-app-kargo-private
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(test-env): add 1C test environment (#11)

Browse Source 
* feat(test-env): add 1C test environment manifests (#11)

- PostgreSQL 18.x-2.1C StatefulSet with ru_RU.UTF-8 locale init
- 1C server (ragent+crserver+ras) StatefulSet with stable hostname
- Gitea runner Deployment with edt label for apk-ci-ng
- NodePort services for external 1C access (31540-31545)
- Deploy/verify script: dev/deploy-test-env.sh
- config.yaml for ApplicationSet integration
- test-env only in dev cluster (not in prod AppSet)

* fix(test-env): use initContainer for PG data + remove custom entrypoint

PVC mount on /var/lib/postgresql wipes the image's pre-built cluster.
Solution: initContainer copies cluster data from image to PVC on first run.
Removed custom pg-entrypoint.sh ConfigMap — image has its own.

* feat(test-env): DinD sidecar for runner + auto-registration Job

- Add Docker-in-Docker sidecar to gitea-runner Deployment
- Add register-job.yaml: Job that obtains Gitea runner token via API,
  creates Secret, and scales runner to 1
- RBAC: ServiceAccount + Role/ClusterRole for cross-namespace secret access
- Runner labels: edt (for apk-ci-ng), ubuntu-latest

---------

Co-authored-by: XoR <xor@benadis.ru>
This commit is contained in:
Dear XoR
2026-03-12 12:33:50 +03:00
committed by GitHub
parent 01623cb260
commit efb2427586
16 changed files with 782 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

24
test-env/gitea-runner/configmap.yaml Normal file
View File

@@ -0,0 +1,24 @@
apiVersion: v1
kind: ConfigMap
metadata:
name: test-env-runner-config
namespace: test-env
data:
config.yaml: |
log:
level: info
runner:
file: .runner
capacity: 1
timeout: 3h
labels:
- "edt:docker://benadis/ar-edt-slim:latest"
- "ubuntu-latest:docker://node:20-bullseye"
cache:
enabled: true
dir: ""
container:
network: ""
privileged: false
options:
workdir_parent:

98
test-env/gitea-runner/deployment.yaml Normal file
View File

@@ -0,0 +1,98 @@
apiVersion: apps/v1
kind: Deployment
metadata:
name: test-env-runner
namespace: test-env
labels:
app: test-env-runner
spec:
replicas: 0 # Scaled by register-job after token is obtained.
# NOTE: requires Docker-in-Docker (DinD) sidecar to run workflows.
# See TODO below for DinD configuration.
selector:
matchLabels:
app: test-env-runner
template:
metadata:
labels:
app: test-env-runner
spec:
containers:
# Docker-in-Docker sidecar (required for act_runner to execute workflows)
- name: dind
image: docker:27-dind
securityContext:
privileged: true
env:
- name: DOCKER_TLS_CERTDIR
value: ""
volumeMounts:
- name: docker-socket
mountPath: /var/run
resources:
requests:
cpu: 100m
memory: 256Mi
limits:
cpu: "2"
memory: 2Gi
- name: runner
image: gitea/act_runner:0.2.11
env:
- name: DOCKER_HOST
value: "unix:///var/run/docker.sock"
- name: GITEA_INSTANCE_URL
value: "http://gitea-http.gitea.svc.cluster.local:3000"
- name: GITEA_RUNNER_REGISTRATION_TOKEN
valueFrom:
secretKeyRef:
name: test-env-runner-token
key: token
optional: true
# 1C server connection variables (for workflows)
- name: SRV1C_HOST
value: "onec-server.test-env.svc.cluster.local"
- name: SRV1C_PORT
value: "1540"
- name: RAC_HOST
value: "onec-server.test-env.svc.cluster.local"
- name: RAC_PORT
value: "1545"
- name: STORAGE_HOST
value: "onec-server.test-env.svc.cluster.local"
- name: STORAGE_PORT
value: "1542"
- name: PG_HOST
value: "postgres.test-env.svc.cluster.local"
- name: PG_PORT
value: "5432"
- name: PG_USER
value: "usr1cv8"
- name: PG_PASSWORD
valueFrom:
secretKeyRef:
name: test-env-secrets
key: pg-password
volumeMounts:
- name: docker-socket
mountPath: /var/run
- name: config
mountPath: /config
readOnly: true
- name: data
mountPath: /data
resources:
requests:
cpu: 100m
memory: 128Mi
limits:
cpu: "2"
memory: 2Gi
volumes:
- name: docker-socket
emptyDir: {}
- name: config
configMap:
name: test-env-runner-config
- name: data
emptyDir: {}

134
test-env/gitea-runner/register-job.yaml Normal file
View File

@@ -0,0 +1,134 @@
# Job: obtains Gitea runner registration token via API and creates
# the test-env-runner-token Secret. Run once after Gitea is available.
#
# Prerequisites: gitea-admin Secret in gitea namespace (created by deploy-k3s)
# The job resolves Gitea pod IP (headless svc) and calls the registration API.
apiVersion: batch/v1
kind: Job
metadata:
name: register-test-env-runner
namespace: test-env
labels:
app: test-env-runner
spec:
backoffLimit: 3
ttlSecondsAfterFinished: 300
template:
spec:
serviceAccountName: runner-registrar
restartPolicy: OnFailure
containers:
- name: register
image: alpine/k8s:1.35.1
command:
- sh
- -c
- |
set -e
echo "=== Obtaining Gitea runner registration token ==="
# Get Gitea admin credentials from gitea namespace
USER=$(kubectl -n gitea get secret gitea-admin -o jsonpath='{.data.username}' | base64 -d)
PASS=$(kubectl -n gitea get secret gitea-admin -o jsonpath='{.data.password}' | base64 -d)
# Resolve Gitea pod IP (headless service)
GITEA_POD_IP=$(kubectl -n gitea get pod -l app.kubernetes.io/name=gitea \
-o jsonpath='{.items[0].status.podIP}')
GITEA_URL="http://${GITEA_POD_IP}:3000"
echo "Gitea URL: $GITEA_URL"
# Wait for Gitea API to be ready
for i in $(seq 1 30); do
if curl -sf "$GITEA_URL/api/v1/version" > /dev/null 2>&1; then
echo "Gitea API is ready"
break
fi
echo "Waiting for Gitea API... ($i/30)"
sleep 5
done
# Get registration token
TOKEN=$(curl -sf -X POST -u "$USER:$PASS" \
"$GITEA_URL/api/v1/user/actions/runners/registration-token" \
| sed 's/.*"token":"\([^"]*\)".*/\1/')
if [ -z "$TOKEN" ]; then
echo "ERROR: Failed to get registration token"
exit 1
fi
echo "Got registration token: ${TOKEN:0:8}..."
# Create/update Secret in test-env namespace
kubectl -n test-env create secret generic test-env-runner-token \
--from-literal=token="$TOKEN" \
--dry-run=client -o yaml | kubectl apply -f -
echo "=== Secret test-env-runner-token created ==="
# Scale runner deployment to 1
kubectl -n test-env scale deployment test-env-runner --replicas=1
echo "=== Runner deployment scaled to 1 ==="
---
# ServiceAccount + RBAC for the registration job
apiVersion: v1
kind: ServiceAccount
metadata:
name: runner-registrar
namespace: test-env
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
name: runner-registrar
namespace: test-env
rules:
- apiGroups: [""]
resources: ["secrets"]
verbs: ["create", "get", "update", "patch"]
- apiGroups: ["apps"]
resources: ["deployments/scale", "deployments"]
verbs: ["get", "update", "patch"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
name: runner-registrar
namespace: test-env
subjects:
- kind: ServiceAccount
name: runner-registrar
namespace: test-env
roleRef:
kind: Role
name: runner-registrar
apiGroup: rbac.authorization.k8s.io
---
# ClusterRole to read gitea-admin secret from gitea namespace
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: test-env-gitea-reader
rules:
- apiGroups: [""]
resources: ["secrets"]
resourceNames: ["gitea-admin"]
verbs: ["get"]
- apiGroups: [""]
resources: ["pods"]
verbs: ["get", "list"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: test-env-gitea-reader
subjects:
- kind: ServiceAccount
name: runner-registrar
namespace: test-env
roleRef:
kind: ClusterRole
name: test-env-gitea-reader
apiGroup: rbac.authorization.k8s.io