Runner 清单示例
故障排除
- associative list with keys has an element that omits key field "protocol"

使用代理安装极狐GitLab Runner (BASIC ALL)

在安装及配置 Kubernetes 的极狐GitLab 代理之后，您可以在您的集群中使用代理安装极狐GitLab Runner。

通过 GitOps 工作流，您的仓库包含了极狐GitLab Runner 配置文件，并且您的集群会进行自动升级。

将未加密的极狐GitLab Runner secret 添加到 runner-manifest.yaml 会在您的仓库文件中公开 secret。如果您在公共项目中使用 GitOps 工作流，请参阅在 GitOps 工作流中管理 Kubernetes Secret。

检查极狐GitLab Runner 的 Helm Chart 值。

创建 runner-chart-values.yaml 文件。例如：

# The GitLab Server URL (with protocol) that you want to register the runner against
# ref: https://docs.gitlab.cn/runner/commands/index.html#gitlab-runner-register
#
gitlabUrl: https://gitlab.my.domain.example.com/

# The registration token for adding new runners to the GitLab server
# Retrieve this value from your GitLab instance
# For more info: https://docs.gitlab.cn/jh/ci/runners/index.html
#
runnerRegistrationToken: "yrnZW46BrtBFqM7xDzE7dddd"

# For RBAC support:
rbac:
    create: true

# Run all containers with the privileged flag enabled
# This flag allows the docker:dind image to run if you need to run Docker commands
# Read the docs before turning this on:
# https://docs.gitlab.cn/runner/executors/kubernetes.html#using-dockerdind
runners:
    privileged: true

创建单个清单文件，使用您的集群代理安装极狐GitLab Runner Chart：
```
helm template --namespace GITLAB-NAMESPACE gitlab-runner -f runner-chart-values.yaml gitlab/gitlab-runner > runner-manifest.yaml
```
用命名空间替换 GITLAB-NAMESPACE。查看示例。

编辑 runner-manifest.yaml 文件，包含您 ServiceAccount 的 namespace。helm template的输出不包括生成资源中的 ServiceAccount 命名空间。

---
# Source: gitlab-runner/templates/service-account.yaml
apiVersion: v1
kind: ServiceAccount
metadata:
  annotations:
  name: gitlab-runner-gitlab-runner
  namespace: gitlab
  labels:
...

将 runner-manifest.yaml 推送到存放 Kubernetes 清单的仓库。

使用 GitOps 配置您的代理以同步 Runner 清单。例如：

gitops:
  manifest_projects:
  - id: path/to/manifest/project
    paths:
    - glob: 'path/to/runner-manifest.yaml'

详情请参见GitOps 配置参考。

代理在每次检查仓库是否进行了清单升级的时候，您的集群都会升级并包含极狐GitLab Runner。

Runner 清单示例

以下是 Runner 清单文件示例。创建您自己的 manifest.yaml 文件以满足项目需求。

---
# Source: gitlab-runner/templates/service-account.yaml
apiVersion: v1
kind: ServiceAccount
metadata:
  annotations:
  name: gitlab-runner-gitlab-runner
  labels:
    app: gitlab-runner-gitlab-runner
    chart: gitlab-runner-0.51.0
    release: "gitlab-runner"
    heritage: "Helm"
---
# Source: gitlab-runner/templates/secrets.yaml
apiVersion: v1
kind: Secret
metadata:
  name: "gitlab-runner-gitlab-runner"
  labels:
    app: gitlab-runner-gitlab-runner
    chart: gitlab-runner-0.51.0
    release: "gitlab-runner"
    heritage: "Helm"
type: Opaque
data:
  runner-registration-token: "FAKE-TOKEN"
  runner-token: ""
---
# Source: gitlab-runner/templates/configmap.yaml
apiVersion: v1
kind: ConfigMap
metadata:
  name: gitlab-runner-gitlab-runner
  labels:
    app: gitlab-runner-gitlab-runner
    chart: gitlab-runner-0.51.0
    release: "gitlab-runner"
    heritage: "Helm"
data:
  entrypoint: |
    #!/bin/bash
    set -e
    mkdir -p /home/gitlab-runner/.gitlab-runner/
    cp /scripts/config.toml /home/gitlab-runner/.gitlab-runner/

    # Register the runner
    if [[ -f /secrets/accesskey && -f /secrets/secretkey ]]; then
      export CACHE_S3_ACCESS_KEY=$(cat /secrets/accesskey)
      export CACHE_S3_SECRET_KEY=$(cat /secrets/secretkey)
    fi

    if [[ -f /secrets/gcs-application-credentials-file ]]; then
      export GOOGLE_APPLICATION_CREDENTIALS="/secrets/gcs-application-credentials-file"
    elif [[ -f /secrets/gcs-application-credentials-file ]]; then
      export GOOGLE_APPLICATION_CREDENTIALS="/secrets/gcs-application-credentials-file"
    else
      if [[ -f /secrets/gcs-access-id && -f /secrets/gcs-private-key ]]; then
        export CACHE_GCS_ACCESS_ID=$(cat /secrets/gcs-access-id)
        # echo -e used to make private key multiline (in google json auth key private key is one line with \n)
        export CACHE_GCS_PRIVATE_KEY=$(echo -e $(cat /secrets/gcs-private-key))
      fi
    fi

    if [[ -f /secrets/runner-registration-token ]]; then
      export REGISTRATION_TOKEN=$(cat /secrets/runner-registration-token)
    fi

    if [[ -f /secrets/runner-token ]]; then
      export CI_SERVER_TOKEN=$(cat /secrets/runner-token)
    fi

    if ! sh /scripts/register-the-runner; then
      exit 1
    fi

    # Run pre-entrypoint-script
    if ! bash /scripts/pre-entrypoint-script; then
      exit 1
    fi

    # Start the runner
    exec /entrypoint run --user=gitlab-runner \
      --working-directory=/home/gitlab-runner

  config.toml: |
    concurrent = 10
    check_interval = 30
    log_level = "info"
    listen_address = ':9252'
  configure: |
    set -e
    cp /init-secrets/* /secrets
  register-the-runner: |
    #!/bin/bash
    MAX_REGISTER_ATTEMPTS=30

    for i in $(seq 1 "${MAX_REGISTER_ATTEMPTS}"); do
      echo "Registration attempt ${i} of ${MAX_REGISTER_ATTEMPTS}"
      /entrypoint register \
        --non-interactive

      retval=$?

      if [ ${retval} = 0 ]; then
        break
      elif [ ${i} = ${MAX_REGISTER_ATTEMPTS} ]; then
        exit 1
      fi

      sleep 5
    done

    exit 0

  check-live: |
    #!/bin/bash
    if /usr/bin/pgrep -f .*register-the-runner; then
      exit 0
    elif /usr/bin/pgrep gitlab.*runner; then
      exit 0
    else
      exit 1
    fi

  pre-entrypoint-script: |
---
# Source: gitlab-runner/templates/role.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: "Role"
metadata:
  name: gitlab-runner-gitlab-runner
  labels:
    app: gitlab-runner-gitlab-runner
    chart: gitlab-runner-0.51.0
    release: "gitlab-runner"
    heritage: "Helm"
rules:
  - apiGroups: [""]
    resources: ["*"]
    verbs: ["*"]
---
# Source: gitlab-runner/templates/role-binding.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: "RoleBinding"
metadata:
  name: gitlab-runner-gitlab-runner
  labels:
    app: gitlab-runner-gitlab-runner
    chart: gitlab-runner-0.51.0
    release: "gitlab-runner"
    heritage: "Helm"
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: "Role"
  name: gitlab-runner-gitlab-runner
subjects:
  - kind: ServiceAccount
    name: gitlab-runner-gitlab-runner
    namespace: "gitlab"
---
# Source: gitlab-runner/templates/deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: gitlab-runner-gitlab-runner
  labels:
    app: gitlab-runner-gitlab-runner
    chart: gitlab-runner-0.51.0
    release: "gitlab-runner"
    heritage: "Helm"
spec:
  replicas: 1
  selector:
    matchLabels:
      app: gitlab-runner-gitlab-runner
  template:
    metadata:
      labels:
        app: gitlab-runner-gitlab-runner
        chart: gitlab-runner-0.51.0
        release: "gitlab-runner"
        heritage: "Helm"
      annotations:
        checksum/configmap: a6623303f6fcc3a043e87ea937bb8399d2d0068a901aa9c3419ed5c7a5afa9db
        checksum/secrets: 32c7d2c16918961b7b84a005680f748e774f61c6f4e4da30650d400d781bbb30
        prometheus.io/scrape: 'true'
        prometheus.io/port: '9252'
    spec:
      securityContext:
        runAsUser: 100
        fsGroup: 65533
      terminationGracePeriodSeconds: 3600
      initContainers:
        - name: configure
          command: ['sh', '/config/configure']
          image: gitlab/gitlab-runner:alpine-v13.4.1
          imagePullPolicy: "IfNotPresent"
          env:

            - name: CI_SERVER_URL
              value: "https://gitlab.qa.joaocunha.eu/"
            - name: CLONE_URL
              value: ""
            - name: RUNNER_REQUEST_CONCURRENCY
              value: "1"
            - name: RUNNER_EXECUTOR
              value: "kubernetes"
            - name: REGISTER_LOCKED
              value: "true"
            - name: RUNNER_TAG_LIST
              value: ""
            - name: RUNNER_OUTPUT_LIMIT
              value: "4096"
            - name: KUBERNETES_IMAGE
              value: "ubuntu:16.04"

            - name: KUBERNETES_PRIVILEGED
              value: "true"

            - name: KUBERNETES_NAMESPACE
              value: "gitlab"
            - name: KUBERNETES_POLL_TIMEOUT
              value: "180"
            - name: KUBERNETES_CPU_LIMIT
              value: ""
            - name: KUBERNETES_CPU_LIMIT_OVERWRITE_MAX_ALLOWED
              value: ""
            - name: KUBERNETES_MEMORY_LIMIT
              value: ""
            - name: KUBERNETES_MEMORY_LIMIT_OVERWRITE_MAX_ALLOWED
              value: ""
            - name: KUBERNETES_CPU_REQUEST
              value: ""
            - name: KUBERNETES_CPU_REQUEST_OVERWRITE_MAX_ALLOWED
              value: ""
            - name: KUBERNETES_MEMORY_REQUEST
              value: ""
            - name: KUBERNETES_MEMORY_REQUEST_OVERWRITE_MAX_ALLOWED
              value: ""
            - name: KUBERNETES_SERVICE_ACCOUNT
              value: ""
            - name: KUBERNETES_SERVICE_CPU_LIMIT
              value: ""
            - name: KUBERNETES_SERVICE_MEMORY_LIMIT
              value: ""
            - name: KUBERNETES_SERVICE_CPU_REQUEST
              value: ""
            - name: KUBERNETES_SERVICE_MEMORY_REQUEST
              value: ""
            - name: KUBERNETES_HELPER_CPU_LIMIT
              value: ""
            - name: KUBERNETES_HELPER_MEMORY_LIMIT
              value: ""
            - name: KUBERNETES_HELPER_CPU_REQUEST
              value: ""
            - name: KUBERNETES_HELPER_MEMORY_REQUEST
              value: ""
            - name: KUBERNETES_HELPER_IMAGE
              value: ""
            - name: KUBERNETES_PULL_POLICY
              value: ""
          volumeMounts:
            - name: runner-secrets
              mountPath: /secrets
              readOnly: false
            - name: scripts
              mountPath: /config
              readOnly: true
            - name: init-runner-secrets
              mountPath: /init-secrets
              readOnly: true
          resources:
            {}
      serviceAccountName: gitlab-runner-gitlab-runner
      containers:
        - name: gitlab-runner-gitlab-runner
          image: gitlab/gitlab-runner:alpine-v13.4.1
          imagePullPolicy: "IfNotPresent"
          lifecycle:
            preStop:
              exec:
                command: ["/entrypoint", "unregister", "--all-runners"]
          command: ["/bin/bash", "/scripts/entrypoint"]
          env:

            - name: CI_SERVER_URL
              value: "https://gitlab.qa.joaocunha.eu/"
            - name: CLONE_URL
              value: ""
            - name: RUNNER_REQUEST_CONCURRENCY
              value: "1"
            - name: RUNNER_EXECUTOR
              value: "kubernetes"
            - name: REGISTER_LOCKED
              value: "true"
            - name: RUNNER_TAG_LIST
              value: ""
            - name: RUNNER_OUTPUT_LIMIT
              value: "4096"
            - name: KUBERNETES_IMAGE
              value: "ubuntu:16.04"

            - name: KUBERNETES_PRIVILEGED
              value: "true"

            - name: KUBERNETES_NAMESPACE
              value: "gitlab"
            - name: KUBERNETES_POLL_TIMEOUT
              value: "180"
            - name: KUBERNETES_CPU_LIMIT
              value: ""
            - name: KUBERNETES_CPU_LIMIT_OVERWRITE_MAX_ALLOWED
              value: ""
            - name: KUBERNETES_MEMORY_LIMIT
              value: ""
            - name: KUBERNETES_MEMORY_LIMIT_OVERWRITE_MAX_ALLOWED
              value: ""
            - name: KUBERNETES_CPU_REQUEST
              value: ""
            - name: KUBERNETES_CPU_REQUEST_OVERWRITE_MAX_ALLOWED
              value: ""
            - name: KUBERNETES_MEMORY_REQUEST
              value: ""
            - name: KUBERNETES_MEMORY_REQUEST_OVERWRITE_MAX_ALLOWED
              value: ""
            - name: KUBERNETES_SERVICE_ACCOUNT
              value: ""
            - name: KUBERNETES_SERVICE_CPU_LIMIT
              value: ""
            - name: KUBERNETES_SERVICE_MEMORY_LIMIT
              value: ""
            - name: KUBERNETES_SERVICE_CPU_REQUEST
              value: ""
            - name: KUBERNETES_SERVICE_MEMORY_REQUEST
              value: ""
            - name: KUBERNETES_HELPER_CPU_LIMIT
              value: ""
            - name: KUBERNETES_HELPER_MEMORY_LIMIT
              value: ""
            - name: KUBERNETES_HELPER_CPU_REQUEST
              value: ""
            - name: KUBERNETES_HELPER_MEMORY_REQUEST
              value: ""
            - name: KUBERNETES_HELPER_IMAGE
              value: ""
            - name: KUBERNETES_PULL_POLICY
              value: ""
          livenessProbe:
            exec:
              command: ["/bin/bash", "/scripts/check-live"]
            initialDelaySeconds: 60
            timeoutSeconds: 1
            periodSeconds: 10
            successThreshold: 1
            failureThreshold: 3
          readinessProbe:
            exec:
              command: ["/usr/bin/pgrep","gitlab.*runner"]
            initialDelaySeconds: 10
            timeoutSeconds: 1
            periodSeconds: 10
            successThreshold: 1
            failureThreshold: 3
          ports:
            - name: metrics
              containerPort: 9252
          volumeMounts:
            - name: runner-secrets
              mountPath: /secrets
            - name: etc-gitlab-runner
              mountPath: /home/gitlab-runner/.gitlab-runner
            - name: scripts
              mountPath: /scripts
          resources:
            {}
      volumes:
        - name: runner-secrets
          emptyDir:
            medium: "Memory"
        - name: etc-gitlab-runner
          emptyDir:
            medium: "Memory"
        - name: init-runner-secrets
          projected:
            sources:
              - secret:
                  name: "gitlab-runner-gitlab-runner"
                  items:
                    - key: runner-registration-token
                      path: runner-registration-token
                    - key: runner-token
                      path: runner-token
        - name: scripts
          configMap:
            name: gitlab-runner-gitlab-runner

故障排除

`associative list with keys has an element that omits key field "protocol"`

由于 Kubernetes v1.19 中的错误，您在使用 Kubernetes 的极狐 GitLab 代理安装极狐GitLab Runner 或其他应用的时候，可能会看到这个错误。如果想解决这个错误，您可以：

将您的 Kubernetes 集群升级到 v1.20 或更高版本。

或者将 protocol: TCP 添加到 containers.ports 子部分。

...
ports:
  - name: metrics
    containerPort: 9252
    protocol: TCP
...