From fffddc9a39060c4acb7b17c53c49e977a242d9e0 Mon Sep 17 00:00:00 2001
From: William P <me@williamtpeebles.com>
Date: Sat, 7 Feb 2026 11:50:50 -0500
Subject: [PATCH] gitea-runner: integrate buildkit, migrate runner to
 statefulset

---
 gitea-runner/buildkitd/deployment.yaml | 40 +++++++++++++
 gitea-runner/buildkitd/svc.yaml        | 14 +++++
 gitea-runner/deployment.yaml           | 79 --------------------------
 gitea-runner/pvc.yaml                  | 12 ----
 gitea-runner/statefulset.yaml          | 76 +++++++++++++++++++++++++
 5 files changed, 130 insertions(+), 91 deletions(-)
 create mode 100644 gitea-runner/buildkitd/deployment.yaml
 create mode 100644 gitea-runner/buildkitd/svc.yaml
 delete mode 100644 gitea-runner/deployment.yaml
 delete mode 100644 gitea-runner/pvc.yaml
 create mode 100644 gitea-runner/statefulset.yaml

diff --git a/gitea-runner/buildkitd/deployment.yaml b/gitea-runner/buildkitd/deployment.yaml
new file mode 100644
index 0000000..bfa84c1
--- /dev/null
+++ b/gitea-runner/buildkitd/deployment.yaml
@@ -0,0 +1,40 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: buildkitd
+  namespace: gitea-runner
+spec:
+  progressDeadlineSeconds: 600
+  replicas: 3
+  revisionHistoryLimit: 10
+  selector:
+    matchLabels:
+      app: buildkitd
+  strategy:
+    rollingUpdate:
+      maxSurge: 25%
+      maxUnavailable: 25%
+    type: RollingUpdate
+  template:
+    metadata:
+      labels:
+        app: buildkitd
+    spec:
+      containers:
+      - args:
+        - --addr
+        - tcp://0.0.0.0:1234
+        image: moby/buildkit:v0.27.1
+        imagePullPolicy: Always
+        name: buildkitd
+        ports:
+        - containerPort: 1234
+          protocol: TCP
+        securityContext:
+          privileged: true
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+      dnsPolicy: ClusterFirst
+      restartPolicy: Always
+      schedulerName: default-scheduler
+      terminationGracePeriodSeconds: 30
\ No newline at end of file
diff --git a/gitea-runner/buildkitd/svc.yaml b/gitea-runner/buildkitd/svc.yaml
new file mode 100644
index 0000000..5aa6667
--- /dev/null
+++ b/gitea-runner/buildkitd/svc.yaml
@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: buildkitd
+  namespace: gitea-runner
+spec:
+  internalTrafficPolicy: Cluster
+  ipFamilies:
+  - IPv4
+  ipFamilyPolicy: SingleStack
+  ports:
+  - port: 1234
+  selector:
+    app: buildkitd
\ No newline at end of file
diff --git a/gitea-runner/deployment.yaml b/gitea-runner/deployment.yaml
deleted file mode 100644
index 9388db4..0000000
--- a/gitea-runner/deployment.yaml
+++ /dev/null
@@ -1,79 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  annotations:
-    deployment.kubernetes.io/revision: "4"
-  labels:
-    app: act-runner
-  name: act-runner
-  namespace: gitea-runner
-spec:
-  progressDeadlineSeconds: 600
-  replicas: 1
-  revisionHistoryLimit: 10
-  selector:
-    matchLabels:
-      app: act-runner
-  strategy:
-    rollingUpdate:
-      maxSurge: 25%
-      maxUnavailable: 25%
-    type: RollingUpdate
-  template:
-    metadata:
-      creationTimestamp: null
-      labels:
-        app: act-runner
-    spec:
-      containers:
-      - command:
-        - sh
-        - -c
-        - while ! nc -z localhost 2376 </dev/null; do echo 'waiting for docker daemon...';
-          sleep 5; done; /sbin/tini -- run.sh
-        env:
-        - name: DOCKER_HOST
-          value: tcp://localhost:2376
-        - name: DOCKER_CERT_PATH
-          value: /certs/client
-        - name: DOCKER_TLS_VERIFY
-          value: "1"
-        - name: GITEA_INSTANCE_URL
-          value: https://git.dubyatp.xyz
-        - name: GITEA_RUNNER_REGISTRATION_TOKEN
-          valueFrom:
-            secretKeyRef:
-              key: token
-              name: runner-secret
-        image: gitea/act_runner:nightly
-        imagePullPolicy: Always
-        name: runner
-        terminationMessagePath: /dev/termination-log
-        terminationMessagePolicy: File
-        volumeMounts:
-        - mountPath: /certs
-          name: docker-certs
-        - mountPath: /data
-          name: runner-data
-      - env:
-        - name: DOCKER_TLS_CERTDIR
-          value: /certs
-        image: docker:23.0.6-dind
-        imagePullPolicy: IfNotPresent
-        name: daemon
-        securityContext:
-          privileged: true
-        terminationMessagePath: /dev/termination-log
-        terminationMessagePolicy: File
-        volumeMounts:
-        - mountPath: /certs
-          name: docker-certs
-      dnsPolicy: ClusterFirst
-      restartPolicy: Always
-      schedulerName: default-scheduler
-      terminationGracePeriodSeconds: 30
-      volumes:
-      - name: docker-certs
-      - name: runner-data
-        persistentVolumeClaim:
-          claimName: act-runner-vol
diff --git a/gitea-runner/pvc.yaml b/gitea-runner/pvc.yaml
deleted file mode 100644
index 42f8f32..0000000
--- a/gitea-runner/pvc.yaml
+++ /dev/null
@@ -1,12 +0,0 @@
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: gitea-runner-pvc
-spec:
-  resources:
-    requests:
-      storage: 1Gi
-  volumeMode: Filesystem
-  accessModes:
-    - ReadWriteOnce
-  storageClassName: weyma-shared
diff --git a/gitea-runner/statefulset.yaml b/gitea-runner/statefulset.yaml
new file mode 100644
index 0000000..9ca8d0b
--- /dev/null
+++ b/gitea-runner/statefulset.yaml
@@ -0,0 +1,76 @@
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: act-runner
+  namespace: gitea-runner
+  labels:
+    app: act-runner
+spec:
+  serviceName: ""
+  selector:
+    matchLabels:
+      app: act-runner
+  replicas: 3
+  template:
+    metadata:
+      labels:
+        app: act-runner
+    spec:
+      containers:
+      - name: runner
+        command:
+          - sh
+          - -c
+          - while ! nc -z localhost 2376 </dev/null; do echo 'waiting for docker daemon...';
+            sleep 5; done; /sbin/tini -- run.sh
+        image: gitea/act_runner:nightly
+        imagePullPolicy: Always
+        env:
+          - name: DOCKER_HOST
+            value: tcp://localhost:2376
+          - name: DOCKER_CERT_PATH
+            value: /certs/client
+          - name: DOCKER_TLS_VERIFY
+            value: "1"
+          - name: GITEA_INSTANCE_URL
+            value: https://git.dubyatp.xyz
+          - name: GITEA_RUNNER_REGISTRATION_TOKEN
+            valueFrom:
+              secretKeyRef:
+                key: token
+                name: runner-secret
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+        volumeMounts:
+        - name: docker-certs
+          mountPath: /certs
+        - name: runner-data
+          mountPath: /data
+      - name: daemon
+        env:
+          - name: DOCKER_TLS_CERTDIR
+            value: /certs
+        image: docker:23.0.6-dind
+        imagePullPolicy: IfNotPresent
+        securityContext:
+          privileged: true
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+        volumeMounts:
+          - mountPath: /certs
+            name: docker-certs
+      dnsPolicy: ClusterFirst
+      restartPolicy: Always
+      schedulerName: default-scheduler
+      terminationGracePeriodSeconds: 30
+      volumes:
+        - name: docker-certs
+  volumeClaimTemplates:
+  - metadata:
+      name: runner-data
+    spec:
+      accessModes: [ "ReadWriteOnce" ]
+      storageClassName: weyma-shared
+      resources:
+        requests:
+          storage: 32Gi