CYBER-0 initial concept ready

platform/gitlab-runner/values.example.yml

@@ -0,0 +1,23 @@
+# Merge this fragment into the existing testserv GitLab Runner Helm values.
+# Keep the runner manager in namespace "ci"; only CI job pods move.
+runners:
+  config: |
+    [[runners]]
+      name = "testserv-k3s-runner"
+      url = "https://gitlab.com/"
+      executor = "kubernetes"
+
+      [runners.kubernetes]
+        namespace = "test-automation"
+        image = "alpine:3.20"
+        helper_image = "registry.gitlab.com/gitlab-org/gitlab-runner/gitlab-runner-helper:x86_64-latest"
+        privileged = false
+        poll_timeout = 600
+        cpu_request = "250m"
+        memory_request = "256Mi"
+        cpu_limit = "2"
+        memory_limit = "2Gi"
+
+      [[runners.kubernetes.volumes.pvc]]
+        name = "tool-cache"
+        mount_path = "/cache/tools"

platform/kubernetes/kustomization.yml

@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - namespace.yml
+  - runner-rbac.yml
+  - storage.yml

platform/kubernetes/namespace.yml

@@ -0,0 +1,6 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: test-automation
+  labels:
+    app.kubernetes.io/part-of: test-automation

platform/kubernetes/runner-rbac.yml

@@ -0,0 +1,41 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: gitlab-runner-executor
+  namespace: test-automation
+rules:
+  - apiGroups: [""]
+    resources: ["pods"]
+    verbs: ["create", "delete", "get", "list", "watch"]
+  - apiGroups: [""]
+    resources: ["pods/attach"]
+    verbs: ["create", "delete", "get", "patch"]
+  - apiGroups: [""]
+    resources: ["pods/log"]
+    verbs: ["get", "list"]
+  - apiGroups: [""]
+    resources: ["secrets"]
+    verbs: ["create", "delete", "get", "update"]
+  - apiGroups: [""]
+    resources: ["serviceaccounts"]
+    verbs: ["get"]
+  - apiGroups: [""]
+    resources: ["services"]
+    verbs: ["create", "delete", "get"]
+  - apiGroups: [""]
+    resources: ["events"]
+    verbs: ["list", "watch"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: gitlab-runner-executor
+  namespace: test-automation
+subjects:
+  - kind: ServiceAccount
+    name: gitlab-runner
+    namespace: ci
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: gitlab-runner-executor

platform/kubernetes/storage.yml

@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: tool-cache
+  namespace: test-automation
+  labels:
+    app.kubernetes.io/part-of: test-automation
+    app.kubernetes.io/component: tool-cache
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 20Gi