Gitlab Runner in Kubernetes

home/baseline/xonsh_footer.xsh

@@ -11,7 +11,7 @@ def bw_unlock():
     while result.returncode != 0:
         result = !(bw unlock --raw)
     $BW_SESSION = result.output.strip()
-    return token
+    return $BW_SESSION
 
 def vpn(con, bwname):
     nmcli c down @(con)

home/hosts/exodus/default.nix

@@ -13,6 +13,10 @@
     cargo
     freeciv
     gimp
+    k9s
+    kubernetes-helm
+    kubectl
+    kubectl-cnpg
     wineWowPackages.stable
   ];
 }

manifests/apply.sh

@@ -11,4 +11,4 @@ kubectl apply -f helm/flux.yaml
 sleep 5
 kubectl apply -k helm
 sleep 5
-kubectl apply .
+kubectl apply -k .

manifests/gitlab-runner/chart.yaml

@@ -0,0 +1,55 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: gitlab-runner
+spec:
+  interval: "24h"
+  url: https://charts.gitlab.io
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: gitlab-runner
+spec:
+  interval: 10m
+  chart:
+    spec:
+      chart: gitlab-runner
+      version: "0.74.1"
+      sourceRef:
+        kind: HelmRepository
+        name: gitlab-runner
+      interval: "1h"
+  values:
+    crds:
+      create: true
+    includeCRDs: true
+    gitlabUrl: https://src.thehellings.com
+    runners:
+      secret: gitlab-runner
+    imagePullSecrets:
+      - image-pull-secrets
+    rbac:
+      create: true
+    extraEnv:
+      CACHE_TYPE: s3
+      CACHE_SHARED: "true"
+      CACHE_S3_BUCKET_NAME: gitlab-runner-cache
+      CACHE_S3_INSECURE: "true"
+    extraEnvFrom:
+      PACKER_GITHUB_API_TOKEN:
+        secretKeyRef:
+          name: gitlab-runner
+          key: PACKER_GITHUB_API_TOKEN
+      CACHE_S3_SERVER_ADDRESS:
+        secretKeyRef:
+          name: gitlab-runner
+          key: CACHE_S3_SERVER_ADDRESS
+      CACHE_S3_ACCESS_KEY:
+        secretKeyRef:
+          name: s3-access
+          key: username
+      CACHE_S3_SECRET_KEY:
+        secretKeyRef:
+          name: s3-access
+          key: password

manifests/gitlab-runner/kustomization.yaml

@@ -0,0 +1,4 @@
+namespace: gitlab-runner
+
+resources:
+  - chart.yaml

manifests/kustomization.yaml

@@ -5,3 +5,4 @@ resources:
   - secrets
   - databases
   - matrix
+  - gitlab-runner

manifests/namespaces/gitlab-runner.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: gitlab-runner

manifests/namespaces/kustomization.yaml

@@ -1,4 +1,5 @@
 resources:
   - bitwarden.yaml
   - db.yaml
+  - gitlab-runner.yaml
   - matrix.yaml

manifests/secrets/gitlab-runner.yaml

@@ -0,0 +1,101 @@
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: gitlab-runner
+  namespace: gitlab-runner
+spec:
+  secretStoreRef:
+    name: bitwarden-fields
+    kind: ClusterSecretStore
+  target:
+    name: gitlab-runner
+    deletionPolicy: Delete
+    template:
+      type: Opaque
+      data:
+        runner-registration-token: ""
+        runner-token: "{{ .runnerToken }}"
+        PACKER_GITHUB_API_TOKEN: "{{ .PACKER_GITHUB_API_TOKEN }}"
+        CACHE_S3_SERVER_ADDRESS: "{{ .CACHE_S3_SERVER_ADDRESS }}"
+  data:
+    - secretKey: runnerToken
+      remoteRef:
+        key: &key 53719920-b100-4355-8c80-b2f9002fad22
+        property: CI_SERVER_TOKEN
+    - secretKey: PACKER_GITHUB_API_TOKEN
+      remoteRef:
+        key: *key
+        property: PACKER_GITHUB_API_TOKEN
+    - secretKey: CACHE_S3_SERVER_ADDRESS
+      remoteRef:
+        key: *key
+        property: CACHE_S3_SERVER_ADDRESS
+        # Includes
+        # CI_SERVER_TOKEN
+        # PACKER_GITHUB_API_TOKEN
+        # CACHE_S3_SERVER_ADDRESS
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: s3-access
+  namespace: gitlab-runner
+spec:
+  secretStoreRef:
+    name: bitwarden-login
+    kind: ClusterSecretStore
+  target:
+    name: s3-access
+    deletionPolicy: Delete
+  data:
+    - secretKey: username
+      remoteRef:
+        key: &key 04dd39c2-268d-4a33-aa4c-b1550166139f
+        property: username
+    - secretKey: password
+      remoteRef:
+        key: *key
+        property: password
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: image-pull-secrets
+  namespace: gitlab-runner
+spec:
+  secretStoreRef:
+    name: bitwarden-login
+    kind: ClusterSecretStore
+  target:
+    deletionPolicy: Delete
+    template:
+      type: kubernetes.io/dockerconfigjson
+      data:
+        .dockerconfigjson: >-
+          {
+            "auths": {
+              "https://index.docker.io/v1/": {
+                "username": "{{ .user }}",
+                "password": "{{ .password }}",
+                "email": "greg.hellings@gmail.com",
+                "auth": "{{ .auth }}"
+              }
+            }
+          }
+  data:
+    - secretKey: user
+      remoteRef:
+        key: &key f560ae38-368c-4e58-898c-aeb90012d597
+        property: username
+    - secretKey: password
+      remoteRef:
+        key: *key
+        property: password
+    - secretKey: auth
+      sourceRef:
+        storeRef:
+          name: bitwarden-fields
+          kind: ClusterSecretStore
+      remoteRef:
+        key: *key
+        property: auth

manifests/secrets/kustomization.yaml

@@ -3,3 +3,4 @@ resources:
   - postgres-user-pgadmin.yaml
   - postgres-user-matrix.yaml
   - k3sbackup.yaml
+  - gitlab-runner.yaml