Skip to content

Commit 2e4b5c9

Browse files
joshyorkojoshyorko
committed
fix: refactor Kaniko workflow and values-kaniko.yaml for improved clarity and efficiency
1 parent 170a723 commit 2e4b5c9

File tree

2 files changed

+41
-137
lines changed

2 files changed

+41
-137
lines changed

‎.github/workflows/build-kaniko-docker.yaml‎

Lines changed: 30 additions & 47 deletions
Original file line numberDiff line numberDiff line change
@@ -1,56 +1,39 @@
1-
name: Build and Push Fetch Repos Bot Runner Docker Image with Kaniko
2-
3-
on:
4-
push:
5-
paths:
6-
- 'robot.yaml'
7-
- 'conda.yaml'
8-
- 'repos/fetch-repos/Dockerfile'
9-
pull_request:
10-
paths:
11-
- 'robot.yaml'
12-
- 'conda.yaml'
13-
- 'repos/fetch-repos/Dockerfile'
14-
workflow_dispatch:
1+
name: Build & Push with Kaniko
2+
on: [workflow_dispatch]
153

164
env:
17-
REGISTRY: ghcr.io
18-
IMAGE_NAME: ${{ github.repository_owner }}/fetch-repos-bot-runner
19-
20-
concurrency:
21-
group: kaniko-${{ github.ref }}
22-
cancel-in-progress: true
5+
IMAGE: ghcr.io/joshyorko/fetch-repos-bot-runner
236

247
jobs:
25-
build-and-push:
8+
build:
269
runs-on: fetch-repos-bot-runner-k8s-kaniko
27-
container: { image: ghcr.io/actions/actions-runner:latest } # slim base
10+
# Run the whole job *inside* Kaniko’s image — no docker:// indirection
11+
container:
12+
image: gcr.io/kaniko-project/executor:v1.23.2-debug
13+
permissions:
14+
contents: read # checkout
15+
packages: write # push to GHCR
16+
2817
steps:
2918
- uses: actions/checkout@v4
30-
- name: Kaniko build
31-
uses: docker://gcr.io/kaniko-project/executor:v1.23.2
32-
env: { DOCKER_CONFIG: /kaniko/.docker } # picked up from secret
33-
with:
34-
args: >
35-
--dockerfile=repos/fetch-repos/Dockerfile
36-
--context=.
37-
--destination=ghcr.io/joshyorko/fetch-repos-bot-runner:${{ github.sha }}
38-
--cache=true
39-
--cache-repo=ghcr.io/joshyorko/fetch-repos-bot-runner-cache:latest
4019

41-
- name: Build and push latest tag (if main branch)
42-
if: github.ref == 'refs/heads/main'
43-
uses: docker://gcr.io/kaniko-project/executor:v1.23.2
44-
env:
45-
DOCKER_CONFIG: /kaniko/.docker/
46-
with:
47-
args: >
48-
--dockerfile=repos/fetch-repos/Dockerfile
49-
--context=.
50-
--destination=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest
51-
--cache=true
52-
--cache-repo=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}-cache:latest
53-
--cache-dir=/workspace/.kaniko/cache
54-
--snapshotMode=redo
55-
--push-retry=3
20+
- name: Write GHCR auth file
21+
run: |
22+
mkdir -p /kaniko/.docker
23+
echo "{\"auths\":{\"ghcr.io\":{\"auth\":\"$(echo -n '${{ github.actor }}:${{ secrets.CR_PAT }}' | base64 -w0)\"}}}" \
24+
> /kaniko/.docker/config.json
25+
26+
- name: Build & push
27+
run: |
28+
/kaniko/executor --dockerfile Dockerfile \
29+
--context . \
30+
--destination ${IMAGE}:${GITHUB_SHA::7} \
31+
--cache=true --cache-repo=${IMAGE}-cache:latest
5632
33+
- name: Tag latest on default branch
34+
if: github.ref == 'refs/heads/main'
35+
run: |
36+
/kaniko/executor --dockerfile Dockerfile \
37+
--context . \
38+
--destination ${IMAGE}:latest \
39+
--cache=true --cache-repo=${IMAGE}-cache:latest

‎repos/fetch-repos/values-kaniko.yaml‎

Lines changed: 11 additions & 90 deletions
Original file line numberDiff line numberDiff line change
@@ -1,103 +1,24 @@
1-
# --------------------------------------------------------------------
2-
# GitHub configuration
3-
# --------------------------------------------------------------------
4-
githubConfigUrl: "https://github.com/joshyorko/fetch-repos-bot"
5-
githubConfigSecret: pre-defined-secret
1+
runnerScaleSetName: fetch-repos-bot-runner-k8s-kaniko
62

7-
# --------------------------------------------------------------------
8-
# Runner scale set configuration for Kaniko builds
9-
# --------------------------------------------------------------------
10-
runnerScaleSetName: "fetch-repos-bot-runner-k8s-kaniko"
3+
githubConfigUrl: https://github.com/joshyorko/fetch-repos-bot
4+
githubConfigSecret: pre-defined-secret # PAT or GitHub App for runner registration
115

12-
# --------------------------------------------------------------------
13-
# Kubernetes container mode configuration
14-
# --------------------------------------------------------------------
156
containerMode:
16-
type: "kubernetes"
7+
type: kubernetes
178
kubernetesModeWorkVolumeClaim:
9+
storageClassName: local-path
1810
accessModes: ["ReadWriteOnce"]
19-
storageClassName: "local-path" # Adjust for your cluster (e.g., gp2, local-path, etc.)
2011
resources:
21-
requests:
22-
storage: 5Gi # Kaniko needs scratch space for layer cache and build context
12+
requests: { storage: 5Gi }
2313

24-
# --------------------------------------------------------------------
25-
# Runner Pod template configuration for Kaniko
26-
# --------------------------------------------------------------------
2714
template:
2815
spec:
29-
# Removed dnsPolicy and dnsConfig to use cluster defaults
30-
31-
# Image pull secrets for accessing private container registries
32-
imagePullSecrets:
33-
- name: ghcr-login # Secret for GHCR authentication
34-
16+
# let Kaniko write its own auth file, no extra volumes needed
17+
imagePullSecrets: [{ name: ghcr-login }]
3518
containers:
3619
- name: runner
37-
image: ghcr.io/actions/actions-runner:latest # Use stock GitHub Actions runner image
38-
imagePullPolicy: Always
20+
image: ghcr.io/actions/actions-runner:latest
3921
command: ["/home/runner/run.sh"]
40-
resources:
41-
requests:
42-
cpu: "500m"
43-
memory: "1Gi"
44-
limits:
45-
cpu: "500m"
46-
memory: "1Gi"
47-
48-
# Environment variables for Kaniko authentication
4922
env:
50-
- name: DOCKER_CONFIG
51-
value: "/kaniko/.docker/"
52-
53-
# Volume mounts for Kaniko authentication
54-
volumeMounts:
55-
- name: docker-config
56-
mountPath: /kaniko/.docker
57-
readOnly: true
58-
59-
# Volumes for Kaniko authentication
60-
volumes:
61-
- name: docker-config
62-
secret:
63-
secretName: ghcr-login
64-
items:
65-
- key: .dockerconfigjson
66-
path: config.json
67-
68-
# Add jobTemplate block to mount the secret into every job-pod
69-
# values-kaniko.yaml (replace the whole jobTemplate with this)
70-
jobTemplate:
71-
spec:
72-
# add the secret volume
73-
volumes:
74-
- name: docker-config
75-
secret:
76-
secretName: ghcr-login
77-
items:
78-
- key: .dockerconfigjson
79-
path: config.json
80-
# patch *all* containers (no name field → merge into every container)
81-
containers:
82-
- volumeMounts:
83-
- name: docker-config
84-
mountPath: /kaniko/.docker
85-
readOnly: true
86-
env: # (optional but nice)
87-
- name: DOCKER_CONFIG
88-
value: /kaniko/.docker
89-
90-
# --------------------------------------------------------------------
91-
# Scaling configuration
92-
# --------------------------------------------------------------------
93-
maxRunners: 3 # Reduced since Kaniko builds are more resource-efficient
94-
minRunners: 0
95-
96-
# --------------------------------------------------------------------
97-
# RBAC for Kubernetes container mode
98-
# This is automatically handled by the ARC Helm chart when containerMode.type is set to "kubernetes"
99-
# The chart will create the necessary ServiceAccount, Role, and RoleBinding for:
100-
# - Creating/managing pods in the namespace
101-
# - Creating/managing secrets for job isolation
102-
# - Creating/managing PVCs for work volumes
103-
# --------------------------------------------------------------------
23+
- name: ACTIONS_RUNNER_REQUIRE_JOB_CONTAINER
24+
value: "false" # lets you mix shell + container steps

0 commit comments

Comments
 (0)