---
# Source: gitlab-runner/templates/configmap.yaml
apiVersion: v1
kind: ConfigMap
metadata:
  name: gitlab-runner
  namespace: "default"
  labels:
    app: gitlab-runner
    chart: gitlab-runner-0.89.0
    release: "gitlab-runner"
    heritage: "Helm"
data:
  entrypoint: |
    #!/bin/bash
    set -e

    export CONFIG_PATH_FOR_INIT="/home/gitlab-runner/.gitlab-runner/"
    mkdir -p ${CONFIG_PATH_FOR_INIT}
    cp /configmaps/config.toml ${CONFIG_PATH_FOR_INIT}
    # Set up environment variables for cache
    if [[ -f /secrets/accesskey && -f /secrets/secretkey ]]; then
      export CACHE_S3_ACCESS_KEY=$(cat /secrets/accesskey)
      export CACHE_S3_SECRET_KEY=$(cat /secrets/secretkey)
    fi

    if [[ -f /secrets/gcs-applicaton-credentials-file ]]; then
      export GOOGLE_APPLICATION_CREDENTIALS="/secrets/gcs-applicaton-credentials-file"
    elif [[ -f /secrets/gcs-application-credentials-file ]]; then
      export GOOGLE_APPLICATION_CREDENTIALS="/secrets/gcs-application-credentials-file"
    else
      if [[ -f /secrets/gcs-access-id && -f /secrets/gcs-private-key ]]; then
        export CACHE_GCS_ACCESS_ID=$(cat /secrets/gcs-access-id)
        # echo -e used to make private key multiline (in google json auth key private key is oneline with \n)
        export CACHE_GCS_PRIVATE_KEY=$(echo -e $(cat /secrets/gcs-private-key))
      fi
    fi

    if [[ -f /secrets/azure-account-name && -f /secrets/azure-account-key ]]; then
      export CACHE_AZURE_ACCOUNT_NAME=$(cat /secrets/azure-account-name)
      export CACHE_AZURE_ACCOUNT_KEY=$(cat /secrets/azure-account-key)
    fi

    if [[ -f /secrets/runner-registration-token ]]; then
      export REGISTRATION_TOKEN=$(cat /secrets/runner-registration-token)
    fi

    if [[ -f /secrets/runner-token ]]; then
      export CI_SERVER_TOKEN=$(cat /secrets/runner-token)
    fi
    if ! sh /configmaps/register-the-runner; then
      exit 1
    fi

    # Run pre-entrypoint-script
    if ! bash /configmaps/pre-entrypoint-script; then
      exit 1
    fi

    # Start the runner
    exec /entrypoint run \
      --working-directory=/home/gitlab-runner
  config.toml: |
    shutdown_timeout = 0
    concurrent = 10
    check_interval = 3
    log_level = "info"


  config.template.toml:   |
    [[runners]]
      [runners.kubernetes]
        namespace = "default"
        image = "alpine"


  register-the-runner: |
    #!/bin/sh
    signal_handler() {
      if [ ! -d "/proc/$register_pid" ]; then
        wait $register_pid
      fi
      exit
    }
    trap 'signal_handler' QUIT INT

    MAX_REGISTER_ATTEMPTS=30

    # Reset/unset the not needed flags when an authentication token
    RUN_UNTAGGED=""
    ACCESS_LEVEL=""

    if [ -n "$CI_SERVER_TOKEN" ] && [ "${CI_SERVER_TOKEN#glrt-}" != "$CI_SERVER_TOKEN" ]; then
      RUN_UNTAGGED=""
      ACCESS_LEVEL=""
      unset REGISTER_LOCKED
      unset RUNNER_TAG_LIST
    fi

    for i in $(seq 1 "${MAX_REGISTER_ATTEMPTS}"); do
      echo "Registration attempt ${i} of ${MAX_REGISTER_ATTEMPTS}"
      /entrypoint register \
        ${RUN_UNTAGGED} \
        ${ACCESS_LEVEL} \
        --template-config /configmaps/config.template.toml \
        --non-interactive &

      register_pid=$!
      wait $register_pid
      retval=$?

      if [ ${retval} = 0 ]; then
        break
      elif [ ${i} = ${MAX_REGISTER_ATTEMPTS} ]; then
        exit 1
      fi

      sleep 5
    done

  check-live: |
    #!/bin/bash
    set -eou pipefail

    # default timeout is 3 seconds, can be overriden
    VERIFY_TIMEOUT=${1:-${VERIFY_TIMEOUT:-3}}

    if ! /usr/bin/pgrep -f ".*register-the-runner"  > /dev/null && ! /usr/bin/pgrep -f "gitlab.*runner"  > /dev/null ; then
      exit 1
    fi

    status=0
    # empty --url= helps `gitlab-runner verify` select all configured runners (otherwise filters for $CI_SERVER_URL)
    verify_output=$(timeout "${VERIFY_TIMEOUT}" gitlab-runner verify --url= 2>&1) || status=$?

    # timeout exit code is 143 with busybox, and 124 with coreutils
    if (( status == 143 )) || (( status == 124 )) ; then
      echo "'gitlab-runner verify' terminated by timeout, not a conclusive failure" >&2
      exit 0
    elif (( status > 0 )) ; then
      exit ${status}
    fi

    grep -qE "is (alive|valid)" <<<"${verify_output}"

  pre-entrypoint-script: |
---
# Source: gitlab-runner/templates/deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: gitlab-runner
  namespace: "default"
  labels:
    app: gitlab-runner
    chart: gitlab-runner-0.89.0
    release: "gitlab-runner"
    heritage: "Helm"
spec:
  revisionHistoryLimit: 10
  selector:
    matchLabels:
      app: gitlab-runner
  template:
    metadata:
      labels:
        app: gitlab-runner
        chart: gitlab-runner-0.89.0
        release: "gitlab-runner"
        heritage: "Helm"
      annotations:
        checksum/configmap: aebf1756519e297bbada83cad525e174e897c8b5ab0d6cee75f1db59f4a1ea10
    spec:
      securityContext:
        fsGroup: 65533
        runAsUser: 100
      terminationGracePeriodSeconds: 3600
      serviceAccountName: ""
      containers:
      - name: gitlab-runner
        image: registry.gitlab.com/gitlab-org/gitlab-runner:alpine-v19.0.0
        imagePullPolicy: "IfNotPresent"
        securityContext:
          allowPrivilegeEscalation: false
          capabilities:
            drop:
            - ALL
          privileged: false
          readOnlyRootFilesystem: false
          runAsNonRoot: true
        lifecycle:
          preStop:
            exec:
              command: ["/entrypoint", "unregister", "--all-runners"]
        command: ["/usr/bin/dumb-init", "--", "/bin/bash", "/configmaps/entrypoint"]
        env:
        - name: CI_SERVER_URL
          value:
        - name: RUNNER_EXECUTOR
          value: "kubernetes"
        - name: REGISTER_LOCKED
          value: "true"
        - name: RUNNER_TAG_LIST
          value: ""
        - name: SESSION_SERVER_ADDRESS
          value:
        livenessProbe:
          exec:
            command: ["/bin/bash", "/configmaps/check-live", "3"]
          initialDelaySeconds: 60
          timeoutSeconds: 4
          periodSeconds: 60
          successThreshold: 1
          failureThreshold: 3
        readinessProbe:
          exec:
            command: ["/usr/bin/pgrep","gitlab.*runner"]
          initialDelaySeconds: 60
          timeoutSeconds: 4
          periodSeconds: 60
          successThreshold: 1
          failureThreshold: 3
        ports:
        - name: "metrics"
          containerPort: 9252
        volumeMounts:
        - name: etc-gitlab-runner
          mountPath: /home/gitlab-runner/.gitlab-runner
        - name: configmaps
          mountPath: /configmaps
        resources:
          {}
      volumes:
      - name: runner-secrets
        emptyDir:
          medium: "Memory"
      - name: etc-gitlab-runner
        emptyDir:
          medium: "Memory"
      - name: configmaps
        configMap:
          name: gitlab-runner