From 9c64a79aef062219e1e9c282adcd1f14fcbc1f37 Mon Sep 17 00:00:00 2001 From: jv Date: Thu, 17 Sep 2026 20:20:33 -0500 Subject: [PATCH] feat: implement containerized gitea-runner with encrypted secrets --- apps/gitea-runner/deployment.yaml | 41 ++++++++ apps/gitea-runner/namespace.yaml | 4 + apps/gitea-runner/secrets.enc.yaml | 146 +++++++++++++++++++++++++++++ apps/gitea-runner/secrets.yaml | 9 ++ 4 files changed, 200 insertions(+) create mode 100644 apps/gitea-runner/deployment.yaml create mode 100644 apps/gitea-runner/namespace.yaml create mode 100644 apps/gitea-runner/secrets.enc.yaml create mode 100644 apps/gitea-runner/secrets.yaml diff --git a/apps/gitea-runner/deployment.yaml b/apps/gitea-runner/deployment.yaml new file mode 100644 index 0000000..da14121 --- /dev/null +++ b/apps/gitea-runner/deployment.yaml @@ -0,0 +1,41 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: gitea-runner + namespace: gitea-runner +spec: + replicas: 1 + selector: + matchLabels: + app: gitea-runner + template: + metadata: + labels: + app: gitea-runner + spec: + containers: + - name: runner + image: gitea/act_runner:latest + env: + - name: GITEA_INSTANCE_URL + valueFrom: + secretKeyRef: + name: gitea-runner-secrets + key: GITEA_INSTANCE_URL + - name: GITEA_RUNNER_REGISTRATION_TOKEN + valueFrom: + secretKeyRef: + name: gitea-runner-secrets + key: GITEA_REGISTRATION_TOKEN + - name: GITEA_RUNNER_NAME + value: "k8s-runner" + - name: GITEA_RUNNER_LABELS + value: "ubuntu-latest:docker://node:18-bullseye,debian-latest:docker://node:18-bullseye" + volumeMounts: + - name: docker-sock + mountPath: /var/run/docker.sock + volumes: + - name: docker-sock + hostPath: + path: /var/run/docker.sock + type: Socket diff --git a/apps/gitea-runner/namespace.yaml b/apps/gitea-runner/namespace.yaml new file mode 100644 index 0000000..79e8af0 --- /dev/null +++ b/apps/gitea-runner/namespace.yaml @@ -0,0 +1,4 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: gitea-runner diff --git a/apps/gitea-runner/secrets.enc.yaml b/apps/gitea-runner/secrets.enc.yaml new file mode 100644 index 0000000..89e4543 --- /dev/null +++ b/apps/gitea-runner/secrets.enc.yaml @@ -0,0 +1,146 @@ +Incorrect Usage. flag provided but not defined: -encrypt-file + +NAME: + sops - sops - encrypted file editor with AWS KMS, GCP KMS, HuaweiCloud KMS, Azure Key Vault, age, and GPG support + +USAGE: + sops is an editor of encrypted files that supports AWS KMS, GCP, HuaweiCloud KMS, AZKV, + PGP, and Age + + To encrypt or decrypt a document with AWS KMS, specify the KMS ARN + in the -k flag or in the SOPS_KMS_ARN environment variable. + (you need valid credentials in ~/.aws/credentials or in your env) + + To encrypt or decrypt a document with GCP KMS, specify the + GCP KMS resource ID in the --gcp-kms flag or in the SOPS_GCP_KMS_IDS + environment variable. + (You need to setup Google application default credentials. See + https://developers.google.com/identity/protocols/application-default-credentials) + + To encrypt or decrypt a document with HuaweiCloud KMS, specify the + HuaweiCloud KMS key ID (format: region:key-uuid) in the --hckms flag or in the + SOPS_HUAWEICLOUD_KMS_IDS environment variable. + (You need to setup HuaweiCloud credentials via environment variables: + HUAWEICLOUD_SDK_AK, HUAWEICLOUD_SDK_SK, HUAWEICLOUD_SDK_PROJECT_ID, or + use credentials file at ~/.huaweicloud/credentials) + + To encrypt or decrypt a document with HashiCorp Vault's Transit Secret + Engine, specify the Vault key URI name in the --hc-vault-transit flag + or in the SOPS_VAULT_URIS environment variable (for example + https://vault.example.org:8200/v1/transit/keys/dev, where + 'https://vault.example.org:8200' is the vault server, 'transit' the + enginePath, and 'dev' is the name of the key). + (You need to enable the Transit Secrets Engine in Vault. See + https://www.vaultproject.io/docs/secrets/transit/index.html) + + To encrypt or decrypt a document with Azure Key Vault, specify the + Azure Key Vault key URL in the --azure-kv flag or in the + SOPS_AZURE_KEYVAULT_URL environment variable. + (Authentication is based on environment variables, see + https://docs.microsoft.com/en-us/go/azure/azure-sdk-go-authorization#use-environment-based-authentication. + The user/sp needs the key/encrypt and key/decrypt permissions.) + + To encrypt or decrypt using age, specify the recipient in the -a flag, + or in the SOPS_AGE_RECIPIENTS environment variable. + + To encrypt or decrypt using PGP, specify the PGP fingerprint in the + -p flag or in the SOPS_PGP_FP environment variable. + + To use multiple KMS or PGP keys, separate them by commas. For example: + $ sops -p "10F2...0A, 85D...B3F21" file.yaml + + The -p, -k, --gcp-kms, --hckms, --hc-vault-transit, and --azure-kv flags are only + used to encrypt new documents. Editing or decrypting existing documents + can be done with "sops file" or "sops decrypt file" respectively. The KMS and + PGP keys listed in the encrypted documents are used then. To manage master + keys in existing documents, use the "add-{kms,pgp,gcp-kms,hckms,azure-kv,hc-vault-transit}" + and "rm-{kms,pgp,gcp-kms,hckms,azure-kv,hc-vault-transit}" flags with --rotate + or the updatekeys command. + + To use a different GPG binary than the one in your PATH, set SOPS_GPG_EXEC. + + To select a different editor than the default (vim), set SOPS_EDITOR or + EDITOR. + + Note that flags must always be provided before the filename to operate on. + Otherwise, they will be ignored. + + For more information, see the README at https://github.com/getsops/sops + +VERSION: + 3.13.3 + +AUTHOR: + CNCF Maintainers + +COMMANDS: + completion Generate shell completion scripts + exec-env execute a command with decrypted values inserted into the environment + exec-file execute a command with the decrypted contents as a temporary file + publish Publish sops file or directory to a configured destination + keyservice start a SOPS key service server + filestatus check the status of the file, returning encryption status + groups modify the groups on a SOPS file + updatekeys update the keys of SOPS files using the config file + decrypt decrypt a file, and output the results to stdout. If no filename is provided, stdin will be used. + encrypt encrypt a file, and output the results to stdout. If no filename is provided, stdin will be used. + rotate generate a new data encryption key and reencrypt all values with the new key + edit edit an encrypted file + set set a specific key or branch in the input document. value must be a JSON encoded string, for example '/path/to/file ["somekey"][0] {"somevalue":true}', or a path if --value-file is used, or omitted if --value-stdin is used + unset unset a specific key or branch in the input document. + help, h Shows a list of commands or help for one command + +GLOBAL OPTIONS: + --decrypt, -d decrypt a file and output the result to stdout + --encrypt, -e encrypt a file and output the result to stdout + --rotate, -r generate a new data encryption key and reencrypt all values with the new key + --disable-version-check do not check whether the current version is latest during --version [$SOPS_DISABLE_VERSION_CHECK] + --check-for-updates do check whether the current version is latest during --version + --kms value, -k value comma separated list of KMS ARNs [$SOPS_KMS_ARN] + --aws-profile value The AWS profile to use for requests to AWS + --gcp-kms value comma separated list of GCP KMS resource IDs [$SOPS_GCP_KMS_IDS] + --hckms value comma separated list of HuaweiCloud KMS key IDs (format: region:key-uuid) [$SOPS_HUAWEICLOUD_KMS_IDS] + --azure-kv value comma separated list of Azure Key Vault URLs [$SOPS_AZURE_KEYVAULT_URLS] + --hc-vault-transit value comma separated list of vault's key URI (e.g. 'https://vault.example.org:8200/v1/transit/keys/dev') [$SOPS_VAULT_URIS] + --pgp value, -p value comma separated list of PGP fingerprints [$SOPS_PGP_FP] + --age value, -a value comma separated list of age recipients [$SOPS_AGE_RECIPIENTS] + --in-place, -i write output back to the same file instead of stdout + --extract value extract a specific key or branch from the input document. Decrypt mode only. Example: --extract '["somekey"][0]' + --input-type value currently json, yaml, dotenv, ini and binary are supported. If not set, sops will use the file's extension to determine the type + --output-type value currently json, yaml, dotenv, ini and binary are supported. If not set, sops will use the input file's extension to determine the output format + --show-master-keys, -s display master encryption keys in the file during editing + --add-gcp-kms value add the provided comma-separated list of GCP KMS key resource IDs to the list of master keys on the given file + --rm-gcp-kms value remove the provided comma-separated list of GCP KMS key resource IDs from the list of master keys on the given file + --add-hckms value add the provided comma-separated list of HuaweiCloud KMS key IDs (format: region:key-uuid) to the list of master keys on the given file + --rm-hckms value remove the provided comma-separated list of HuaweiCloud KMS key IDs (format: region:key-uuid) from the list of master keys on the given file + --add-azure-kv value add the provided comma-separated list of Azure Key Vault key URLs to the list of master keys on the given file + --rm-azure-kv value remove the provided comma-separated list of Azure Key Vault key URLs from the list of master keys on the given file + --add-kms value add the provided comma-separated list of KMS ARNs to the list of master keys on the given file + --rm-kms value remove the provided comma-separated list of KMS ARNs from the list of master keys on the given file + --add-hc-vault-transit value add the provided comma-separated list of Vault's URI key to the list of master keys on the given file ( eg. https://vault.example.org:8200/v1/transit/keys/dev) + --rm-hc-vault-transit value remove the provided comma-separated list of Vault's URI key from the list of master keys on the given file ( eg. https://vault.example.org:8200/v1/transit/keys/dev) + --add-age value add the provided comma-separated list of age recipients fingerprints to the list of master keys on the given file + --rm-age value remove the provided comma-separated list of age recipients from the list of master keys on the given file + --add-pgp value add the provided comma-separated list of PGP fingerprints to the list of master keys on the given file + --rm-pgp value remove the provided comma-separated list of PGP fingerprints from the list of master keys on the given file + --ignore-mac ignore Message Authentication Code during decryption + --mac-only-encrypted compute MAC only over values which end up encrypted + --unencrypted-suffix value override the unencrypted key suffix. + --encrypted-suffix value override the encrypted key suffix. When empty, all keys will be encrypted, unless otherwise marked with unencrypted-suffix. + --unencrypted-regex value set the unencrypted key regex. When specified, only keys matching the regex will be left unencrypted. + --encrypted-regex value set the encrypted key regex. When specified, only keys matching the regex will be encrypted. + --unencrypted-comment-regex value set the unencrypted comment suffix. When specified, only keys that have comment matching the regex will be left unencrypted. + --encrypted-comment-regex value set the encrypted comment suffix. When specified, only keys that have comment matching the regex will be encrypted. + --config value path to sops' config file. If set, sops will not search for the config file recursively. [$SOPS_CONFIG] + --encryption-context value comma separated list of KMS encryption context key:value pairs + --set value set a specific key or branch in the input document. value must be a json encoded string. (edit mode only). eg. --set '["somekey"][0] {"somevalue":true}' + --shamir-secret-sharing-threshold value the number of master keys required to retrieve the data key with shamir (default: 0) + --indent value the number of spaces to indent YAML or JSON encoded file (default: 0) + --verbose Enable verbose logging output + --output value Save the output after encryption or decryption to the file specified + --filename-override value Use this filename instead of the provided argument for loading configuration, and for determining input type and output type + --decryption-order value comma separated list of decryption key types [$SOPS_DECRYPTION_ORDER] + --enable-local-keyservice use local key service [$SOPS_ENABLE_LOCAL_KEYSERVICE] + --keyservice value Specify the key services to use in addition to the local one. Can be specified more than once. Syntax: protocol://address. Example: tcp://myserver.com:5000 [$SOPS_KEYSERVICE] + --help, -h show help + --version, -v print the version diff --git a/apps/gitea-runner/secrets.yaml b/apps/gitea-runner/secrets.yaml new file mode 100644 index 0000000..b33efb5 --- /dev/null +++ b/apps/gitea-runner/secrets.yaml @@ -0,0 +1,9 @@ +apiVersion: v1 +kind: Secret +metadata: + name: gitea-runner-secrets + namespace: gitea-runner +type: Opaque +stringData: + GITEA_INSTANCE_URL: "https://lab2025.duckdns.org/git/" + GITEA_REGISTRATION_TOKEN: "c1ce1b4396109c5c906513a7ea8b29bc63bfbcbd"