HOMELAB-988: feat(forgejo-runner): bake terraform/sops/age + add infra label #187

Merged

aaron merged 1 commit from plane/HOMELAB-988-runner-image-bake into live

2026-04-26 00:13:48 +00:00

aaron commented

2026-04-26 00:12:32 +00:00

Owner

First of four PRs for HOMELAB-988 (move terraform plan/apply onto K8s Forgejo runner; deprecate mgmt-VM infra runner).

Dockerfile: adds terraform v1.14.8, sops v3.12.2, age v1.3.1 to the existing image.

deployment.yaml: bumps image SHA; initContainer now registers with labels k8s-runner:host,infra:host so runs-on: infra workflows route here. Re-register-on-label-change logic added (idempotent; no-op while /data is emptyDir but survives a future PVC move).

This PR alone does not make infra-plan.yaml runnable. Still pending: PR-B (secrets), PR-C (main.tf module-source refactor + workflow git-auth step), PR-D (verification PR).

First of four PRs for HOMELAB-988 (move terraform plan/apply onto K8s Forgejo runner; deprecate mgmt-VM `infra` runner). Dockerfile: adds terraform v1.14.8, sops v3.12.2, age v1.3.1 to the existing image. deployment.yaml: bumps image SHA; initContainer now registers with labels `k8s-runner:host,infra:host` so `runs-on: infra` workflows route here. Re-register-on-label-change logic added (idempotent; no-op while /data is emptyDir but survives a future PVC move). This PR alone does not make infra-plan.yaml runnable. Still pending: PR-B (secrets), PR-C (main.tf module-source refactor + workflow git-auth step), PR-D (verification PR).

aaron added 1 commit

2026-04-26 00:12:32 +00:00

HOMELAB-988: feat(forgejo-runner): bake terraform/sops/age + add infra label

0/0 projects applied successfully.

Lint & Validate / shellcheck (pull_request) Has been cancelled

Details

CI Review / pr-title (pull_request) Has been cancelled

Details

CI Review / helm-validate (pull_request) Has been cancelled

Details

CI Review / ai-review (pull_request) Has been cancelled

Details

Lint & Validate / terraform-validate (pull_request) Has been cancelled

Details

Lint & Validate / yaml-lint (pull_request) Has been cancelled

Details

79dd6168b7

Updates the K8s Forgejo runner image to support running Terraform jobs
(infra-plan.yaml, infra-apply.yaml) so we can retire the mgmt VM 110 runner.

Dockerfile:
  - terraform v1.14.8 — pinned to match prod/atlantis.yaml; v1.14.9 publishes
    against an expired HashiCorp PGP key bundled in the atlantis image, so
    pinning to v1.14.8 dodges that and stays consistent across both runners.
  - sops v3.12.2 — terraform's carlpett/sops provider shells out to this.
  - age v1.3.1 — handy for ad-hoc encrypt/decrypt; sops uses it internally
    via library but having the standalone binary aids debugging.

deployment.yaml:
  - New image: harbor.aaron.reynoza.org/platform/forgejo-runner@sha256:56f25...
  - initContainer registers with labels "k8s-runner:host,infra:host" so
    runs-on: infra (the canonical label in .forgejo/workflows/infra-plan.yaml
    and infra-apply.yaml) routes to this runner. k8s-runner:host preserved
    for existing container-build workflows.
  - Re-register-on-label-change logic: if /data/.runner already exists with
    a different label set, delete it so registration runs again. /data is
    emptyDir today so this is currently a no-op (every pod restart re-
    registers anyway), but the explicit check survives a future move to a
    PVC and makes intent obvious.

Side-effect: each registration creates a new runner record in Forgejo;
the old k8s-runner:host-only record will go offline on next rollout and
can be pruned via the Forgejo admin UI when convenient.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>