diff --git a/docs/setup-k8s-gitlab-runner.md b/docs/setup-k8s-gitlab-runner.md new file mode 100644 index 0000000000000000000000000000000000000000..2d5e8ce57422322334db7e5fff6f8e5b9ba2ae1c --- /dev/null +++ b/docs/setup-k8s-gitlab-runner.md @@ -0,0 +1,217 @@ + +# Setup gitlab runner in Azure cloud + +## Tools needed locally to control + +* kubectl - Comandline tool für k8s +* helm - 'Paketmanager' für k8s +* aks - Azure kubernetes service +* azure-cli - Comandline tools für azure + +* unter Manjaro: `yay kubectl helm aks azure-cli` + +## Create a kubernetes cluster in azure + +* Mostly followed: +`https://docs.microsoft.com/en-us/azure/aks/kubernetes-walkthrough-portal` +* Nodetype: `Standard_D4ds_v5` +* + * Log into Azure Web + * Home -> Create resource + * Create Kubernetes Service -> Create + * Fill in + * Subscription + * Resource group -> Create new -> "gitlab-test-resource-group" + * Reset is default: Region East US ... + * Node size: Standard_D4ds_v5 ( maximum allowed for free substriction) + * Node count 1 + + +## Install gitlab runner in k8s + +* Mostly followed: +`https://medium.com/@ruben.laguna/installing-a-gitlab-runner-on-kubernetes-ac386c924bc8` + +* Connect to azure: + +`az login` + +`az aks get-credentials --resource-group gitlab-test-resource-group --name gitlab-test-cluster` + +`kubectl cluster-info` + +`kubectl get nodes` + + NAME STATUS ROLES AGE VERSION + aks-agentpool-94672520-vmss000000 Ready agent 8d v1.21.9 + +### Create namespace in k8s for the runner + +`gitlab-runner-namespace.yaml` + + { + "apiVersion": "v1", + "kind": "Namespace", + "metadata": { + "name": "gitlab-runner", + "labels": { + "name": "gitlab-runner" + } + } + } + +`kubectl create -f gitlab-runner-namespace.json` + +`kubectl get namespace` + +### Create a role and set permissions + +`gitlab-runner-gitlab-runner-role.yml` from article: + + apiVersion: rbac.authorization.k8s.io/v1 + kind: Role + metadata: + name: gitlab-runner + namespace: gitlab-runner + rules: + - apiGroups: [""] + resources: ["pods"] + verbs: ["list", "get", "watch", "create", "delete"] + - apiGroups: [""] + resources: ["pods/exec"] + verbs: ["create"] + - apiGroups: [""] + resources: ["pods/log"] + verbs: ["get"] + +Working rules (for me, not nessacarily correct and secure): + +`gitlab-runner-gitlab-runner-role.yml` + + apiVersion: rbac.authorization.k8s.io/v1 + kind: Role + metadata: + name: gitlab-runner + namespace: gitlab-runner + rules: + - apiGroups: [""] + resources: ["pods"] + verbs: ["list", "get", "watch", "create", "delete", "update"] + - apiGroups: [""] + resources: ["pods/exec"] + verbs: ["create"] + - apiGroups: [""] + resources: ["pods/log"] + verbs: ["get"] + - apiGroups: [""] + resources: ["pods/attach"] + verbs: ["list", "get", "create", "delete", "update"] + - apiGroups: [""] + resources: ["secrets"] + verbs: ["list", "get", "create", "delete", "update"] + - apiGroups: [""] + resources: ["configmaps"] + verbs: ["list", "get", "create", "delete", "update"] + +`kubectl create -f gitlab-runner-gitlab-runner-role.yaml` + +`kubectl replace -f gitlab-runner-gitlab-runner-role.yaml` + +`kubectl edit role --namespace gitlab-runner` + +`kubectl get --namespace=gitlab-runner role` + + +Used the following permissions, more then in the article: + +`kubectl describe role --namespace gitlab-runner gitlab-runner` + + Name: gitlab-runner + Labels: <none> + Annotations: <none> + PolicyRule: + Resources Non-Resource URLs Resource Names Verbs + --------- ----------------- -------------- ----- + pods/exec [] [] [create] + pods/log [] [] [get] + configmaps [] [] [list get create delete update] + pods/attach [] [] [list get create delete update] + secrets [] [] [list get create delete update] + pods [] [] [list get watch create delete update] + +### Assign the role to the service account + +`kubectl create rolebinding --namespace=gitlab-runner gitlab-runner-binding --role=gitlab-runner --serviceaccount=gitlab-runner:default` + +`kubectl get --namespace gitlab-runner rolebinding` + +### Install gitlab runner on Kubernetes using Helm + +Get runner registration token from gitlab: + +`https://gitlab.com/groups/SECO-Northern-Europe/-/settings/ci_cd` + +The values.yml file contains a set of variables configuring the package installed with helm: + +`values.yml` as in article: + + gitlabUrl: https://gitlab.com/ + runnerRegistrationToken: "ssssssssssss" + + +`values.yml` actually used: + + ## The GitLab Server URL (with protocol) that want to register the runner against + ## ref: https://docs.gitlab.com/runner/commands/README.html#gitlab-runner-register + ## + gitlabUrl: https://gitlab.com/ + + ## The Registration Token for adding new Runners to the GitLab Server. This must + ## be retrieved from your GitLab Instance. + ## ref: https://docs.gitlab.com/ce/ci/runners/README.html + ## + runnerRegistrationToken: "GR1348941XWJHK4__ZszXTLTPda2R" + + ## Unregister all runners before termination + ## + ## Updating the runner's chart version or configuration will cause the runner container + ## to be terminated and created again. This may cause your Gitlab instance to reference + ## non-existant runners. Un-registering the runner before termination mitigates this issue. + ## ref: https://docs.gitlab.com/runner/commands/README.html#gitlab-runner-unregister + ## + # unregisterRunners: true + + ## Configuration for the Pods that the runner launches for each new job + ## + runners: + ## Specify the tags associated with the runner. Comma-separated list of tags. + ## + ## ref: https://docs.gitlab.com/ee/ci/runners/configure_runners.html#use-tags-to-control-which-jobs-a-runner-can-run + ## + tags: "azure" + +Get the complete values.yml for the package: + +`helm show values gitlab/gitlab-runner` + + +### Helm + +`helm init` + +### Gitlab repo zu helm hinzufügen + +`helm repo add gitlab https://charts.gitlab.io` + +`helm search repo -l gitlab/gitlab-runner` + +`helm install --namespace gitlab-runner gitlab-runner -f values.yaml gitlab/gitlab-runner` + +`kubectl get --namespace gitlab-runner pod` + + NAME READY STATUS RESTARTS AGE + gitlab-runner-gitlab-runner-86f5c5647-qc475 1/1 Running 0 6d20h + runner-m6sb9pz-project-17852514-concurrent-0ggqd8 2/2 Running 0 114m + + +### Check gitlab for the new registered runner