diff options
| author | Daniel Baumann <daniel@debian.org> | 2025-01-24 08:57:48 +0100 |
|---|---|---|
| committer | Daniel Baumann <daniel@debian.org> | 2025-01-24 08:57:48 +0100 |
| commit | c70c95ecbea0487586212a9437d120989a6c6e31 (patch) | |
| tree | 140d166690b4cf72737075f15001eee07bfb4d6c /examples/kubernetes/README.md | |
| parent | Initial commit. (diff) | |
| download | forgejo-runner-debian.tar.xz forgejo-runner-debian.zip | |
Adding upstream version 6.2.0.HEADupstream/6.2.0upstreamdebian
Signed-off-by: Daniel Baumann <daniel@debian.org>
Diffstat (limited to 'examples/kubernetes/README.md')
| -rw-r--r-- | examples/kubernetes/README.md | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/examples/kubernetes/README.md b/examples/kubernetes/README.md new file mode 100644 index 0000000..d00cf1a --- /dev/null +++ b/examples/kubernetes/README.md @@ -0,0 +1,7 @@ +## Kubernetes Docker in Docker Deployment + +Registers Kubernetes pod runners using [offline registration](https://forgejo.org/docs/v1.21/admin/actions/#offline-registration), allowing the scaling of runners as needed. + +NOTE: Docker in Docker (dind) requires elevated privileges on Kubernetes. The current way to achieve this is to set the pod `SecurityContext` to `privileged`. Keep in mind that this is a potential security issue that has the potential for a malicious application to break out of the container context. + +[`dind-docker.yaml`](dind-docker.yaml) creates a deployment and secret for Kubernetes to act as a runner. The Docker credentials are re-generated each time the pod connects and does not need to be persisted. |