runner-instance-scope #19

Merged

slanski merged 3 commits from runner-instance-scope into main

2026-08-03 13:59:16 +00:00

slanski commented

2026-08-03 13:59:03 +00:00

Owner

No description provided.

slanski added 3 commits

2026-08-03 13:59:03 +00:00

switch runner from adicom org scope to instance scope f0773a2f0f

Runner ci-rust was registered under the adicom organization — invisible
to jobs from cinnae/* repos (notably cinnae/infrastructure's new
build-ci-job-image workflow). Re-registered at instance level via Forgejo
UI (Site Administration → Actions → Runners → Create new runner) to serve
all orgs on this Forgejo instance.

This commit only updates the UUID; the matching Token goes into the
existing forgejo-runner-token Secret via kubectl patch (never committed).

Rollout (live cluster, do not wait for PR merge):
  1. kubectl -n forgejo patch secret forgejo-runner-token \
       -p '{"data":{"RUNNER_TOKEN":"<base64-of-new-token>"}}'
  2. kubectl apply -f helm/runners/20-configmap.yaml
  3. kubectl rollout restart deployment/forgejo-runner -n forgejo
  4. Verify in Forgejo UI → Site Administration → Actions → Runners
     that ci-rust appears with Type=Instance and Status=Idle.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

feat(runner): switch to prebuilt ci-job image + enable Kyverno PolicyException d14106b58a

Pre-bake kubectl/helm/cosign/syft in custom image to dodge runner's flaky
CDN egress (SSL timeouts mid-RUN). Wire auth registry mount in dind so it
can pull from private cinnae org packages (Forgejo has no per-package
visibility — inherits from owner). Enable PolicyException feature in Kyverno
and add a scoped exception for the privileged dind sidecar.

fix(bootstrap): embed-certs + raw CA in kubeconfig, sopssecret admin aggregation b13e2c76d6

Two unrelated fixes that both blocked the first Phase C CI deploy on
adicom/test-ci:

1. 21-forgejo-deployer-kubeconfig.sh: --embed-certs=true + --raw
   Without --embed-certs, kubectl stored the temp file PATH in the
   kubeconfig (not the contents) — broke as soon as the temp file was
   shredded. Without --raw, kubectl redacts certificate-authority-data
   to "DATA+OMITTED" which base64-decodes to garbage. The two bugs
   surfaced sequentially in the deploy job:
     "unable to read certificate-authority /root/.kube/tmp.XXX"
     "unable to parse bytes as PEM block"

2. 02-sops-rbac-aggregation.yaml (new): sops-secrets-operator's CRD
   ships without the aggregate-to-admin annotation, so a RoleBinding
   to clusterrole=admin does NOT grant CRUD on SopsSecrets. Symptom:
     Forbidden: cannot get resource "sopssecrets" in API group
     "isindir.github.com"
   Fixed by a dedicated aggregation ClusterRole — auto-included in
   admin/edit going forward. README step 3 documents the apply.

slanski merged commit 379adcf7e8 into main

2026-08-03 13:59:16 +00:00

slanski deleted branch runner-instance-scope

2026-08-03 13:59:16 +00:00

slanski referenced this pull request from a commit

2026-08-03 13:59:17 +00:00

Merge pull request 'runner-instance-scope' (#19) from runner-instance-scope into main