# act_runner x3 with docker-in-docker sidecars, so Gitea Actions jobs
# run as containers on the worker nodes (ARM64).
apiVersion: apps/v1
kind: Deployment
metadata:
  name: act-runner
  namespace: git
spec:
  replicas: 3
  selector:
    matchLabels: {app: act-runner}
  template:
    metadata:
      labels: {app: act-runner}
    spec:
      containers:
        - name: runner
          image: gitea/act_runner:latest
          env:
            - {name: GITEA_INSTANCE_URL, value: "http://gitea.git.svc:3000"}
            - {name: GITEA_RUNNER_REGISTRATION_TOKEN, value: "eEsa5oEXUCQyTM6Gj9iAqDzofDj0TmoTYftyPOLd"}
            - {name: DOCKER_HOST, value: "tcp://127.0.0.1:2375"}
            - {name: CONFIG_FILE, value: /config/config.yaml}
          resources:
            requests: {cpu: 50m, memory: 64Mi}
            limits: {memory: 256Mi}
          volumeMounts:
            - {name: work, mountPath: /data}
            - {name: config, mountPath: /config}
        - name: dind
          image: docker:27-dind
          securityContext:
            privileged: true
          env:
            - {name: DOCKER_TLS_CERTDIR, value: ""}
          resources:
            requests: {cpu: 100m, memory: 256Mi}
            limits: {memory: 1Gi}
          volumeMounts:
            - {name: work, mountPath: /data}
      volumes:
        - name: work
          emptyDir: {}
        - name: config
          configMap: {name: act-runner-config}
      affinity:
        podAntiAffinity:
          preferredDuringSchedulingIgnoredDuringExecution:
            - weight: 100
              podAffinityTerm:
                labelSelector:
                  matchLabels: {app: act-runner}
                topologyKey: kubernetes.io/hostname
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: act-runner-config
  namespace: git
data:
  config.yaml: |
    runner:
      capacity: 4
      timeout: 30m
      insecure: false
      fetch_timeout: 5s
      labels:
        - "arm64:host"
        - "ubuntu-latest:docker://node:22-bookworm"
    cache:
      enabled: false
    container:
      privileged: false
      options: ""
      valid_volumes: []