gh-runner.yml

templates:
  - |
      # Service account which can decrypt helm secrets
      apiVersion: v1
      kind: ServiceAccount
      metadata:
        name: github-actions-deployer
        namespace: github-actions
        annotations:
          iam.gke.io/gcp-service-account: [email protected]
  - |
      apiVersion: garo.tietoevry.com/v1alpha1
      kind: GithubActionRunner
      metadata:
        name: github-actions-deployer-pool
      spec:
        minRunners: 4
        maxRunners: 6
        organization: {{`{{ .Values.githubOrg }}`}}
        reconciliationPeriod: 1m
        repository: {{`{{ .Values.githubRepo }}`}}
        tokenRef:
          key: GH_TOKEN
          ## !!NB matches the operator chart release name
          name: github-actions-github-actions-runner-operator
        podTemplateSpec:
          metadata:
            annotations: {}
            #   "prometheus.io/scrape": "true"
            #   "prometheus.io/port": "3903"
          spec:
            serviceAccountName: github-actions-deployer
            affinity:
              podAntiAffinity:
                preferredDuringSchedulingIgnoredDuringExecution:
                  - weight: 1
                    podAffinityTerm:
                      topologyKey: kubernetes.io/hostname
                      labelSelector:
                        matchExpressions:
                          - key: garo.tietoevry.com/pool
                            operator: In
                            values:
                              - github-actions-deployer-pool
            initContainers:
              - name: init-runner
                image: dysnix/github-actions-runner:gcloud
                imagePullPolicy: Always
                command:
                  - bash
                  - -c
                  - cp -rp /home/runner/. /emptydir_home
                volumeMounts:
                  - mountPath: /emptydir_home
                    name: runner-home
            containers:
              - name: runner
                env:
                  - name: RUNNER_DEBUG
                    value: "true"
                  - name: DOCKER_HOST
                    value: tcp://localhost:2375
                  - name: GH_ORG
                    value: {{`{{ .Values.githubOrg }}`}}
                  - name: GH_REPO
                    value: {{`{{ .Values.githubRepo }}`}}
                  - name: DOCKER_BUILDKIT
                    value: "1"
                  - name: ACTIONS_RUNNER_INPUT_LABELS
                    value: {{`{{ .Values.labels.deployer }}`}}
                envFrom:
                  - secretRef:
                      name: github-actions-deployer-pool-regtoken
                image: dysnix/github-actions-runner:gcloud
                imagePullPolicy: Always
                resources: {}
                securityContext:
                  privileged: true
                volumeMounts:
                  - mountPath: /home/runner
                    name: runner-home
              - name: docker
                image: docker:20.10-dind
                imagePullPolicy: IfNotPresent
                args:
                  # See linked issues from: https://github.com/evryfs/github-actions-runner-operator/issues/39
                  - --mtu=1430
                env:
                  - name: DOCKER_TLS_CERTDIR
                    value: ""
                resources: {}
                securityContext:
                  privileged: true
                volumeMounts:
                  - mountPath: /var/lib/docker
                    name: docker-storage
                  - mountPath: /home/runner
                    name: runner-home
              # - name: exporter
              #   image: quay.io/evryfs/github-actions-runner-metrics:v0.0.3
              #   ports:
              #     - containerPort: 3903
              #       protocol: TCP
              #   volumeMounts:
              #     - name: runner-diag
              #       mountPath: /_diag
              #       readOnly: true
            volumes:
              - emptyDir: {}
                name: runner-home
              - emptyDir: {}
                name: docker-storage