119 lines
3.5 KiB
Bash
119 lines
3.5 KiB
Bash
#!/bin/bash
|
|
set -ex
|
|
|
|
# =====================================================================
|
|
# OPTIONAL — MicroK8s setup/reset steps (only use when doing a hard reset)
|
|
# =====================================================================
|
|
# sudo microk8s reset --destroy-storage
|
|
# sudo snap remove microk8s
|
|
# sudo snap install microk8s --classic
|
|
# sudo microk8s enable dns rbac hostpath-storage host-access metrics-server
|
|
#
|
|
# # Rebuild kubeconfig for your local user (optional)
|
|
# microk8s kubectl config view --raw > ~/.kube/config
|
|
# chmod 600 ~/.kube/config
|
|
# sudo usermod -aG microk8s $USER
|
|
# sudo chown -f -R $USER ~/.kube
|
|
|
|
NAMESPACE="arc-systems"
|
|
RUNNER_NAME="mealcraft-runners"
|
|
|
|
# =====================================================================
|
|
# Remove previous ARC installation (safe even if missing)
|
|
# =====================================================================
|
|
helm uninstall arc -n "${NAMESPACE}" || true
|
|
helm uninstall "${RUNNER_NAME}" -n "${NAMESPACE}" || true
|
|
|
|
echo "=== Installing ARC Scale Set Controller ==="
|
|
|
|
helm install arc \
|
|
--namespace "${NAMESPACE}" \
|
|
--create-namespace \
|
|
oci://ghcr.io/actions/actions-runner-controller-charts/gha-runner-scale-set-controller
|
|
|
|
echo "=== Installing MealCraft Runner Scale Set (NO Docker-in-Docker) ==="
|
|
|
|
helm install "${RUNNER_NAME}" \
|
|
--namespace "${NAMESPACE}" \
|
|
--create-namespace \
|
|
--set runnerScaleSetName="${RUNNER_NAME}" \
|
|
--set githubConfigUrl="https://github.com/MealCraft" \
|
|
--set githubConfigSecret.name="github-secret" \
|
|
--set githubConfigSecret.github_token="$GITHUB_PAT" \
|
|
--set dockerInDockerEnabled=false \
|
|
--set containerMode.type="runner" \
|
|
--set runnerLabels[0]="mealcraft" \
|
|
oci://ghcr.io/actions/actions-runner-controller-charts/gha-runner-scale-set
|
|
|
|
# =====================================================================
|
|
# RBAC — IMPORTANT
|
|
# Grants permissions to the exact ARC runner SA detected earlier.
|
|
# =====================================================================
|
|
|
|
echo "=== Applying RBAC for all ARC runners ==="
|
|
|
|
microk8s kubectl apply -f - <<EOF
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRole
|
|
metadata:
|
|
name: mealcraft-bootstrap-role
|
|
rules:
|
|
# Storage
|
|
- apiGroups: ["storage.k8s.io"]
|
|
resources: ["storageclasses"]
|
|
verbs: ["*"]
|
|
|
|
# Core API: PV, PVC, namespaces, secrets, configmaps, services, serviceaccounts (NEW)
|
|
- apiGroups: [""]
|
|
resources:
|
|
- persistentvolumes
|
|
- persistentvolumeclaims
|
|
- namespaces
|
|
- secrets
|
|
- configmaps
|
|
- services
|
|
- serviceaccounts # <── NEW
|
|
verbs: ["*"]
|
|
|
|
# Apps (Deployments, DS, etc)
|
|
- apiGroups: ["apps"]
|
|
resources: ["deployments", "daemonsets", "replicasets", "statefulsets"]
|
|
verbs: ["*"]
|
|
|
|
# Networking & Ingress
|
|
- apiGroups: ["networking.k8s.io", "extensions"]
|
|
resources: ["ingresses", "ingressclasses", "*"]
|
|
verbs: ["*"]
|
|
|
|
# Traefik v1
|
|
- apiGroups: ["traefik.containo.us"]
|
|
resources: ["*"]
|
|
verbs: ["*"]
|
|
|
|
# Traefik v2
|
|
- apiGroups: ["traefik.io"]
|
|
resources: ["*"]
|
|
verbs: ["*"]
|
|
|
|
# CRDs
|
|
- apiGroups: ["apiextensions.k8s.io"]
|
|
resources: ["customresourcedefinitions"]
|
|
verbs: ["*"]
|
|
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRoleBinding
|
|
metadata:
|
|
name: mealcraft-bootstrap-binding
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: ClusterRole
|
|
name: mealcraft-bootstrap-role
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: mealcraft-runners-gha-rs-no-permission
|
|
namespace: arc-systems
|
|
EOF
|
|
|
|
|
|
echo "=== ARC installation + RBAC complete ==="
|