Remove --user 1000:1000 option to allow workflow containers to run as root.
This is needed for the Docker CLI installation step which requires root
permissions for apt-get commands.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Change runner container network from bridge to host to allow workflow
containers to resolve Kubernetes service DNS names. With bridge network,
containers couldn't resolve forgejo.forgejo.svc.cluster.local.
Using host network gives containers access to the cluster's DNS resolver.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Add --add-host mapping for forgejo.forgejo.svc.cluster.local to the
Forgejo service ClusterIP (10.102.251.20) in the runner container options.
This fixes the DNS resolution issue where workflow containers created by
the runner (via Docker-in-Docker) cannot resolve Kubernetes service DNS
names, causing the actions/checkout step to fail with "Could not resolve
host: forgejo.forgejo.svc.cluster.local".
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Run the forgejo-runner container as root (uid 0) to allow access to the
Docker socket. This is required for Docker-in-Docker functionality needed
by Forgejo Actions workflows.
Without this, the runner fails with "permission denied" when trying to
access /var/run/docker.sock.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Create sealed secret for forgejo-runner-token to enable Forgejo Actions
runner deployment. This token allows the runner to register with the
Forgejo instance and execute CI/CD workflows.
Fixes basicstack.org workflow failures (DEV-335) caused by missing runner.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Create runner deployment with:
- ServiceAccount and RBAC for runner pod
- ConfigMap for runner configuration
- Deployment using code.forgejo.org/forgejo/runner:4.0.1
- Argo CD application for automated deployment
Note: Runner requires a sealed secret with registration token.
See apps/forgejo-runner/README.md for setup instructions.
Part of DEV-334 CI/CD workflow implementation.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
