---
apiVersion: v1
kind: ConfigMap
metadata:
  name: gitlab-runner-config
  namespace: mmedo-sorsed-prod
data:
  config.toml: |
    concurrent = 4
    check_interval = 0
    shutdown_timeout = 300

    [[runners]]
      name = "gitlab-runner"
      url = "gitlab.rty.ru"
      token = "glrt-8eXklVs9ZwwqP4PE6qMARGc6MjkKbzoxCnQ6Mgp1OjFjEQ.01.1a03ggx3j"
      # Путь к CA-сертификату для самого gitlab-runner
      tls-ca-file = "/etc/gitlab-runner/certs/ca-bundle.crt"
      executor = "kubernetes"
      request_concurrency = 4

      [runners.kubernetes]
        host = ""
        bearer_token_overwrite_allowed = false
        helper_image = "base-docker.artifacts-prod.rty.ru/gitlab/gitlab-runner-helper:alpine3.21-x86_64-latest-pwsh-checked"
        image = "sed-docker.artifacts-prod.rty.ru/helm:v4.1.4"
        namespace = "mmedo-sorsed-prod"
        privileged = false
        service_account = "gitlab-runner"
        image_pull_secrets = ["nexus-registry", "nexus-regestry-base"]

        # Таймауты и стабильность для v18
        poll_interval = 3
        poll_timeout = 600

        # Передача переменных окружения с путями к CA во все поды сборок
        [runners.kubernetes.pod_env]
          CURL_CA_BUNDLE = "/etc/ssl/certs/ca-bundle.crt"
          GIT_SSL_CAINFO = "/etc/ssl/certs/ca-bundle.crt"
          SSL_CERT_FILE = "/etc/ssl/certs/ca-bundle.crt"
          HELM_CACHE_HOME = "/tmp/.cache/helm"
          HELM_CONFIG_HOME = "/tmp/.config/helm"
          HELM_DATA_HOME = "/tmp/.data/helm"

        [runners.kubernetes.pod_security_context]
          run_as_non_root = true
          run_as_user = 1000
          run_as_group = 1000
          fs_group = 1000

        # Монтируем CA-сертификат из Secret во все поды сборок (Build Pods)
        [[runners.kubernetes.volumes.secret]]
          name = "corporate-ca-certs"
          mount_path = "/etc/ssl/certs/ca-bundle.crt"
          sub_path = "ca-bundle.crt"
          read_only = true

        # Монтируем /tmp в RAM для ускорения работы Helm/Git
        [[runners.kubernetes.volumes.empty_dir]]
          name = "helm-tmp"
          mount_path = "/tmp"
          medium = "Memory"