apiVersion: v1
kind: Secret
metadata:
  name: gitea-runner-secret
  namespace: soo
type: Opaque
stringData:
  token: cLwr1iibt23oBSMqcWUJ6vcn3Wj8DQI9huCe2ATK
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: gitea-runner-config
  namespace: soo
data:
  config.yaml: |
    log:
      level: info
    runner:
      file: .runner
      capacity: 1
      timeout: 3h
      labels:
        - "ubuntu-latest:docker://node:20-bookworm"
        - "ubuntu-22.04:docker://ubuntu:22.04"
        - "self-hosted:host"
    container:
      network: ""
      privileged: false
      options:
      valid_volumes: []
    host:
      workdir_parent: /data/cache
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: gitea-runner
  namespace: soo
  labels:
    app: gitea-runner
spec:
  replicas: 1
  selector:
    matchLabels:
      app: gitea-runner
  template:
    metadata:
      labels:
        app: gitea-runner
    spec:
      nodeSelector:
        nodegroup: nd
      containers:
        - name: runner
          image: gitea/act_runner:latest
          command:
            - sh
            - -c
            - |
              # Register if not already registered
              if [ ! -f /data/.runner ]; then
                act_runner register --no-interactive \
                  --instance https://gitea.inje-private.com \
                  --token $(cat /secrets/token) \
                  --name mlops-runner \
                  --labels "ubuntu-latest:docker://node:20-bookworm,self-hosted:host"
              fi
              act_runner daemon --config /config/config.yaml
          env:
            - name: DOCKER_HOST
              value: tcp://localhost:2376
            - name: DOCKER_TLS_VERIFY
              value: "1"
            - name: DOCKER_CERT_PATH
              value: /certs/client
          volumeMounts:
            - name: runner-data
              mountPath: /data
            - name: runner-config
              mountPath: /config
            - name: runner-secret
              mountPath: /secrets
            - name: docker-certs
              mountPath: /certs
        - name: docker-in-docker
          image: docker:dind
          securityContext:
            privileged: true
          env:
            - name: DOCKER_TLS_CERTDIR
              value: /certs
          volumeMounts:
            - name: docker-certs
              mountPath: /certs
            - name: runner-data
              mountPath: /data
      volumes:
        - name: runner-data
          emptyDir: {}
        - name: docker-certs
          emptyDir: {}
        - name: runner-config
          configMap:
            name: gitea-runner-config
        - name: runner-secret
          secret:
            secretName: gitea-runner-secret