gitlab-runner-flux-values.yaml

application:
  name: gitlab-runner
  createNamespace: ###ZARF_VAR_GITLAB_RUNNER_CREATE_NAMESPACE###
  namespace: gitlab-runner
  path: chart
  repository: https://repo1.dso.mil/big-bang/product/packages/gitlab-runner.git
  ref:
    # renovate: datasource=gitlab-tags depName=big-bang/product/packages/gitlab-runner versioning=loose registryUrl=https://repo1.dso.mil
    tag: 0.59.1-bb.1
  values: |
    ###ZARF_VAR_GITLAB_RUNNER_VALUES###
  dependsOn:
    ###ZARF_VAR_GITLAB_RUNNER_DEPENDS_ON###
  baseValues:
    imagePullPolicy: IfNotPresent

    istio:
      enabled: true
      injection: enabled

    networkPolicies:
      enabled: true
      additionalPolicies:
      # expected use case is to open egress for runner jobs
      # This is a dev example policy spec and CIDR 0.0.0.0/0 is unsafe for operational environments
      # requests to controlPlane should also be blocked in an operational policy
      - name: egress-runner-jobs
        spec:
          podSelector: {}
          policyTypes:
          - Egress
          egress:
          - to:
            - ipBlock:
                cidr: 0.0.0.0/0
                except:
                # Block requests to AWS cloud metadata IP
                - 169.254.169.254/32
                # Block requests to controlPlane if CIDR not 0.0.0.0/0
                # - "{{ $.Values.networkPolicies.controlPlaneCidr }}"


    # no longer necessary to directly pass through .Values.monitoring.enabled
    # the package chart uses: .Capabilities.APIVersions.Has "monitoring.coreos.com/v1" to toggle monitoring
    metrics:
      enabled: true
      serviceMonitor:
        enabled: true

    # When istio injected, add an annotation with the istio version to the manager pods only
    podAnnotations:
      bigbang.dev/istioVersion: ###ZARF_VAR_ISTIO_VERSION###

    monitoring:
      enabled: true

    # autoRegister requires kyverno
    autoRegister:
      enabled: ###ZARF_VAR_AUTO_REGISTER###

    unregisterRunners: true

    runners:
      job:
        # Adding this as a workaround
        # bigbang package-images.yaml says its using 8.8 but gitlab-runner is actually using 8.7. Forcing it to use 8.8
        # since the capability is pulling that in based on bigbang package-images.yaml
        tag: "8.8"
      config: |
        [[runners]]
          clone_url = "http://gitlab-webservice-default.gitlab.svc.cluster.local:8181"
          cache_dir = "/tmp/gitlab-runner/cache"
          [runners.kubernetes]
            namespace = "gitlab-runner-sandbox"
            image = "{{ printf "%s/%s:%s" .Values.runners.job.registry .Values.runners.job.repository .Values.runners.job.tag }}"
            helper_image = "{{ printf "%s/%s:%s" .Values.runners.helper.registry .Values.runners.helper.repository .Values.runners.helper.tag }}"
            image_pull_secrets = ["private-registry"]
          [runners.kubernetes.pod_labels]
            "job_id" = "${CI_JOB_ID}"
            "job_name" = "${CI_JOB_NAME}"
            "pipeline_id" = "${CI_PIPELINE_ID}"

    rbac:
      create: false