mirror of
https://gitea.com/gitea/act_runner.git
synced 2026-10-30 03:46:33 +08:00
0cedd98051
Adds a Kubernetes backend. A `name:kubernetes://image` label runs the job as one pod through the Kubernetes API, with services as containers of the same pod. Step env is exported by a script sent over exec stdin, keeping it out of the pod spec and process arguments, and service env goes into a per-job Secret. Docker actions and container options are rejected. See `docs/kubernetes.md`. Operators shape job pods with `kubernetes.pod_template`, with per-label `pod_templates` merged in `runs-on` order and a `$services` entry for service containers. The idle cleanup removes pods and Secrets a runner left behind. The client calls the Kubernetes API directly and runs step commands over `coder/websocket` (same dependency used in gitea) instead of pulling in the heavyweight `kubernetes/client-go`. Includes an e2e test against k3s. Replaces: https://gitea.com/gitea/runner/pulls/1000 Fixes: https://gitea.com/gitea/runner/issues/31 Assisted-by: Claude Code:claude-opus-5-5 Co-authored-by: Zettat123 <zettat123@gmail.com> Co-authored-by: bircni <bircni@icloud.com> Reviewed-on: https://gitea.com/gitea/runner/pulls/1260 Reviewed-by: Lunny Xiao <xiaolunwen@gmail.com> Reviewed-by: Zettat123 <39446+zettat123@noreply.gitea.com> Co-authored-by: silverwind <me@silverwind.io>
Kubernetes deployments of gitea-runner
Jobs can run on Kubernetes in two ways:
- Job pods: each job runs as its own pod, without privileged containers and under the cluster's quotas and policies. Docker actions and
docker://steps are not supported. Deploy withkubernetes-pods.yamland see docs/kubernetes.md. - Docker in Docker: jobs run in a Docker daemon next to the runner. Every workflow feature works, but the daemon is privileged, so a job can break out to the node. Deploy with
dind-docker.yaml,statefulset-dind.yamlfor several replicas,rootless-docker.yamlfor a rootless daemon, or the Helm chart. The sidecars in the first two need Kubernetes 1.29 or later.
All examples read the registration token from the runner-secret Secret and the Gitea URL from GITEA_INSTANCE_URL, and keep the registration in /data. They give a stopping pod three hours to finish its jobs, so keep runner.shutdown_timeout below terminationGracePeriodSeconds.