Add gitlab-runner/configmap-gl-config.yml

2026-09-11 15:24:25 +08:00
parent 0fd84b8d59
commit 859fe5fd9c
1 changed files with 62 additions and 0 deletions
@@ -0,0 +1,62 @@
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: gitlab-runner-config
+  namespace: mmedo-sorsed-prod
+data:
+  config.toml: |
+    concurrent = 4
+    check_interval = 0
+    shutdown_timeout = 300
+
+    [[runners]]
+      name = "gitlab-runner"
+      url = "gitlab.rty.ru"
+      token = "glrt-8eXklVs9ZwwqP4PE6qMARGc6MjkKbzoxCnQ6Mgp1OjFjEQ.01.1a03ggx3j"
+      # Путь к CA-сертификату для самого gitlab-runner
+      tls-ca-file = "/etc/gitlab-runner/certs/ca-bundle.crt"
+      executor = "kubernetes"
+      request_concurrency = 4
+
+      [runners.kubernetes]
+        host = ""
+        bearer_token_overwrite_allowed = false
+        helper_image = "base-docker.artifacts-prod.rty.ru/gitlab/gitlab-runner-helper:alpine3.21-x86_64-latest-pwsh-checked"
+        image = "sed-docker.artifacts-prod.rty.ru/helm:v4.1.4"
+        namespace = "mmedo-sorsed-prod"
+        privileged = false
+        service_account = "gitlab-runner"
+        image_pull_secrets = ["nexus-registry", "nexus-regestry-base"]
+
+        # Таймауты и стабильность для v18
+        poll_interval = 3
+        poll_timeout = 600
+
+        # Передача переменных окружения с путями к CA во все поды сборок
+        [runners.kubernetes.pod_env]
+          CURL_CA_BUNDLE = "/etc/ssl/certs/ca-bundle.crt"
+          GIT_SSL_CAINFO = "/etc/ssl/certs/ca-bundle.crt"
+          SSL_CERT_FILE = "/etc/ssl/certs/ca-bundle.crt"
+          HELM_CACHE_HOME = "/tmp/.cache/helm"
+          HELM_CONFIG_HOME = "/tmp/.config/helm"
+          HELM_DATA_HOME = "/tmp/.data/helm"
+
+        [runners.kubernetes.pod_security_context]
+          run_as_non_root = true
+          run_as_user = 1000
+          run_as_group = 1000
+          fs_group = 1000
+
+        # Монтируем CA-сертификат из Secret во все поды сборок (Build Pods)
+        [[runners.kubernetes.volumes.secret]]
+          name = "corporate-ca-certs"
+          mount_path = "/etc/ssl/certs/ca-bundle.crt"
+          sub_path = "ca-bundle.crt"
+          read_only = true
+
+        # Монтируем /tmp в RAM для ускорения работы Helm/Git
+        [[runners.kubernetes.volumes.empty_dir]]
+          name = "helm-tmp"
+          mount_path = "/tmp"
+          medium = "Memory"