8d70bbe78b
Interestingly, the existence of this chart somewhat contradicts the [docs](https://docs.drone.io/runner/extensions/kube/), which suggest you should "_\[d\]eploy the secret extension in the same Pod as your Kubernetes runner_". Though the interaction appears to be via an HTTP call, so that doesn't seem like would be an issue.
74 lines
1.9 KiB
YAML
74 lines
1.9 KiB
YAML
drone-server:
|
|
env:
|
|
DRONE_SERVER_HOST: drone.scubbo.org
|
|
DRONE_SERVER_PROTO: https
|
|
DRONE_RPC_SECRET: rpc-secret
|
|
DRONE_GITEA_SERVER: https://gitea.scubbo.org
|
|
DRONE_USER_CREATE: username:scubbo,admin:true
|
|
extraSecretNamesForEnvFrom:
|
|
- gitea-oauth-creds
|
|
service:
|
|
port: 3500
|
|
persistentVolume:
|
|
storageClass: longhorn
|
|
# Keep the Runner untolerant for now, until I progress to intentionally building dual-architecture images.
|
|
tolerations:
|
|
- key: architecture
|
|
operator: Equal
|
|
value: x86
|
|
|
|
drone-runner:
|
|
env:
|
|
DRONE_RPC_SECRET: rpc-secret
|
|
DRONE_RPC_HOST: drone-drone-server:3500 # This is the name of the service for the runner
|
|
DRONE_RUNNER_NETWORK_OPTS: "com.docker.network.driver.mtu:1450"
|
|
DRONE_SECRET_PLUGIN_ENDPOINT: "http://drone-drone-kubernetes-secrets:3000"
|
|
extraSecretNamesForEnvFrom:
|
|
- kubernetes-secrets-secret
|
|
dind:
|
|
commandArgs:
|
|
- "--host"
|
|
- "tcp://localhost:2375"
|
|
- "--mtu=1450"
|
|
affinity:
|
|
nodeAffinity:
|
|
requiredDuringSchedulingIgnoredDuringExecution:
|
|
nodeSelectorTerms:
|
|
- matchExpressions:
|
|
- key: kubernetes.io/arch
|
|
operator: In
|
|
values:
|
|
- arm64
|
|
# Avoid the cursed node!
|
|
- key: kubernetes.io/hostname
|
|
operator: NotIn
|
|
values:
|
|
- rasnu2
|
|
|
|
drone-kubernetes-secrets:
|
|
rbac:
|
|
secretNamespace: drone
|
|
env:
|
|
KUBERNETES_NAMESPACE: drone
|
|
extraSecretNamesForEnvFrom:
|
|
- kubernetes-secrets-secret
|
|
|
|
drone:
|
|
server: "drone.scubbo.org"
|
|
|
|
volume:
|
|
nfsServer: rassigma.avril
|
|
nfsPath: /mnt/BERTHA/drone
|
|
|
|
service:
|
|
type: ClusterIP
|
|
port: 3500
|
|
|
|
gitea:
|
|
server: https://gitea.scubbo.org
|
|
# Secret with keys `clientId` and `clientSecret`
|
|
oauthSecretName: gitea-oauth-creds
|
|
|
|
# Set this if you want to use an existing secret for the RPC
|
|
# secret (otherwise, a fresh one will be created if necessary)
|
|
manualRPCSecretName: "" |