Runner 清单示例
故障排除
- associative list with keys has an element that omits key field "protocol"

使用代理安装极狐GitLab Runner

在安装及配置 Kubernetes 的极狐GitLab 代理之后，您可以在您的集群中使用代理安装极狐GitLab Runner。

通过 GitOps 工作流，您的仓库包含了极狐GitLab Runner 配置文件，并且您的集群会进行自动升级。

将未加密的极狐GitLab Runner secret 添加到 runner-manifest.yaml 会在您的仓库文件中公开 secret。如果您在公共项目中使用 GitOps 工作流，请参阅在 GitOps 工作流中管理 Kubernetes Secret。

检查极狐GitLab Runner 的 Helm Chart 值。

创建 runner-chart-values.yaml 文件。例如：

# The GitLab Server URL (with protocol) that you want to register the runner against
# ref: https://docs.gitlab.cn/runner/commands/index.html#gitlab-runner-register
#
gitlabUrl: https://gitlab.my.domain.example.com/

# The registration token for adding new runners to the GitLab server
# Retrieve this value from your GitLab instance
# For more info: https://docs.gitlab.cn/jh/ci/runners/index.html
#
runnerRegistrationToken: "yrnZW46BrtBFqM7xDzE7dddd"

# For RBAC support:
rbac:
    create: true

# Run all containers with the privileged flag enabled
# This flag allows the docker:dind image to run if you need to run Docker commands
# Read the docs before turning this on:
# https://docs.gitlab.cn/runner/executors/kubernetes.html#using-dockerdind
runners:
    privileged: true

创建单个清单文件，使用您的集群代理安装极狐GitLab Runner Chart：
```
helm template --namespace GITLAB-NAMESPACE gitlab-runner -f runner-chart-values.yaml gitlab/gitlab-runner > runner-manifest.yaml
```
用命名空间替换 GITLAB-NAMESPACE。查看示例。

编辑 runner-manifest.yaml 文件，包含您 ServiceAccount 的 namespace。helm template的输出不包括生成资源中的 ServiceAccount 命名空间。

---
# Source: gitlab-runner/templates/service-account.yaml
apiVersion: v1
kind: ServiceAccount
metadata:
  annotations:
  name: gitlab-runner-gitlab-runner
  namespace: gitlab
  labels:
...

将 runner-manifest.yaml 推送到存放 Kubernetes 清单的仓库。

使用 GitOps 配置您的代理以同步 Runner 清单。例如：

gitops:
  manifest_projects:
  - id: path/to/manifest/project
    paths:
    - glob: 'path/to/runner-manifest.yaml'

详情请参见GitOps 配置参考。

代理在每次检查仓库是否进行了清单升级的时候，您的集群都会升级并包含极狐GitLab Runner。

Runner 清单示例

以下是 Runner 清单文件示例。创建您自己的 manifest.yaml 文件以满足项目需求。

---
# Source: gitlab-runner/templates/service-account.yaml
apiVersion: v1
kind: ServiceAccount
metadata:
  annotations:
  name: gitlab-runner-gitlab-runner
  labels:
    app: gitlab-runner-gitlab-runner
    chart: gitlab-runner-0.51.0
    release: "gitlab-runner"
    heritage: "Helm"
---
# Source: gitlab-runner/templates/secrets.yaml
apiVersion: v1
kind: Secret
metadata:
  name: "gitlab-runner-gitlab-runner"
  labels:
    app: gitlab-runner-gitlab-runner
    chart: gitlab-runner-0.51.0
    release: "gitlab-runner"
    heritage: "Helm"
type: Opaque
data:
  runner-registration-token: "FAKE-TOKEN"
  runner-token: ""
---
# Source: gitlab-runner/templates/configmap.yaml
apiVersion: v1
kind: ConfigMap
metadata:
  name: gitlab-runner-gitlab-runner
  labels:
    app: gitlab-runner-gitlab-runner
    chart: gitlab-runner-0.51.0
    release: "gitlab-runner"
    heritage: "Helm"
data:
  entrypoint: |
    #!/bin/bash
    set -e
    mkdir -p /home/gitlab-runner/.gitlab-runner/
    cp /scripts/config.toml /home/gitlab-runner/.gitlab-runner/

    # Register the runner
    if [[ -f /secrets/accesskey && -f /secrets/secretkey ]]; then
      export CACHE_S3_ACCESS_KEY=$(cat /secrets/accesskey)
      export CACHE_S3_SECRET_KEY=$(cat /secrets/secretkey)
    fi

    if [[ -f /secrets/gcs-application-credentials-file ]]; then
      export GOOGLE_APPLICATION_CREDENTIALS="/secrets/gcs-application-credentials-file"
    elif [[ -f /secrets/gcs-application-credentials-file ]]; then
      export GOOGLE_APPLICATION_CREDENTIALS="/secrets/gcs-application-credentials-file"
    else
      if [[ -f /secrets/gcs-access-id && -f /secrets/gcs-private-key ]]; then
        export CACHE_GCS_ACCESS_ID=$(cat /secrets/gcs-access-id)
        # echo -e used to make private key multiline (in google json auth key private key is one line with \n)
        export CACHE_GCS_PRIVATE_KEY=$(echo -e $(cat /secrets/gcs-private-key))
      fi
    fi

    if [[ -f /secrets/runner-registration-token ]]; then
      export REGISTRATION_TOKEN=$(cat /secrets/runner-registration-token)
    fi

    if [[ -f /secrets/runner-token ]]; then
      export CI_SERVER_TOKEN=$(cat /secrets/runner-token)
    fi

    if ! sh /scripts/register-the-runner; then
      exit 1
    fi

    # Run pre-entrypoint-script
    if ! bash /scripts/pre-entrypoint-script; then
      exit 1
    fi

    # Start the runner
    exec /entrypoint run --user=gitlab-runner \
      --working-directory=/home/gitlab-runner

  config.toml: |
    concurrent = 10
    check_interval = 30
    log_level = "info"
    listen_address = ':9252'
  configure: |
    set -e
    cp /init-secrets/* /secrets
  register-the-runner: |
    #!/bin/bash
    MAX_REGISTER_ATTEMPTS=30

    for i in $(seq 1 "${MAX_REGISTER_ATTEMPTS}"); do
      echo "Registration attempt ${i} of ${MAX_REGISTER_ATTEMPTS}"
      /entrypoint register \
        --non-interactive

      retval=$?

      if [ ${retval} = 0 ]; then
        break
      elif [ ${i} = ${MAX_REGISTER_ATTEMPTS} ]; then
        exit 1
      fi

      sleep 5
    done

    exit 0

  check-live: |
    #!/bin/bash
    if /usr/bin/pgrep -f .*register-the-runner; then
      exit 0
    elif /usr/bin/pgrep gitlab.*runner; then
      exit 0
    else
      exit 1
    fi

  pre-entrypoint-script: |
---
# Source: gitlab-runner/templates/role.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: "Role"
metadata:
  name: gitlab-runner-gitlab-runner
  labels:
    app: gitlab-runner-gitlab-runner
    chart: gitlab-runner-0.51.0
    release: "gitlab-runner"
    heritage: "Helm"
rules:
  - apiGroups: [""]
    resources: ["*"]
    verbs: ["*"]
---
# Source: gitlab-runner/templates/role-binding.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: "RoleBinding"
metadata:
  name: gitlab-runner-gitlab-runner
  labels:
    app: gitlab-runner-gitlab-runner
    chart: gitlab-runner-0.51.0
    release: "gitlab-runner"
    heritage: "Helm"
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: "Role"
  name: gitlab-runner-gitlab-runner
subjects:
  - kind: ServiceAccount
    name: gitlab-runner-gitlab-runner
    namespace: "gitlab"
---
# Source: gitlab-runner/templates/deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: gitlab-runner-gitlab-runner
  labels:
    app: gitlab-runner-gitlab-runner
    chart: gitlab-runner-0.51.0
    release: "gitlab-runner"
    heritage: "Helm"
spec:
  replicas: 1
  selector:
    matchLabels:
      app: gitlab-runner-gitlab-runner
  template:
    metadata:
      labels:
        app: gitlab-runner-gitlab-runner
        chart: gitlab-runner-0.51.0
        release: "gitlab-runner"
        heritage: "Helm"
      annotations:
        checksum/configmap: a6623303f6fcc3a043e87ea937bb8399d2d0068a901aa9c3419ed5c7a5afa9db
        checksum/secrets: 32c7d2c16918961b7b84a005680f748e774f61c6f4e4da30650d400d781bbb30
        prometheus.io/scrape: 'true'
        prometheus.io/port: '9252'
    spec:
      securityContext:
        runAsUser: 100
        fsGroup: 65533
      terminationGracePeriodSeconds: 3600
      initContainers:
        - name: configure
          command: ['sh', '/config/configure']
          image: gitlab/gitlab-runner:alpine-v13.4.1
          imagePullPolicy: "IfNotPresent"
          env:

            - name: CI_SERVER_URL
              value: "https://gitlab.qa.joaocunha.eu/"
            - name: CLONE_URL
              value: ""
            - name: RUNNER_REQUEST_CONCURRENCY
              value: "1"
            - name: RUNNER_EXECUTOR
              value: "kubernetes"
            - name: REGISTER_LOCKED
              value: "true"
            - name: RUNNER_TAG_LIST
              value: ""
            - name: RUNNER_OUTPUT_LIMIT
              value: "4096"
            - name: KUBERNETES_IMAGE
              value: "ubuntu:16.04"

            - name: KUBERNETES_PRIVILEGED
              value: "true"

            - name: KUBERNETES_NAMESPACE
              value: "gitlab"
            - name: KUBERNETES_POLL_TIMEOUT
              value: "180"
            - name: KUBERNETES_CPU_LIMIT
              value: ""
            - name: KUBERNETES_CPU_LIMIT_OVERWRITE_MAX_ALLOWED
              value: ""
            - name: KUBERNETES_MEMORY_LIMIT
              value: ""
            - name: KUBERNETES_MEMORY_LIMIT_OVERWRITE_MAX_ALLOWED
              value: ""
            - name: KUBERNETES_CPU_REQUEST
              value: ""
            - name: KUBERNETES_CPU_REQUEST_OVERWRITE_MAX_ALLOWED
              value: ""
            - name: KUBERNETES_MEMORY_REQUEST
              value: ""
            - name: KUBERNETES_MEMORY_REQUEST_OVERWRITE_MAX_ALLOWED
              value: ""
            - name: KUBERNETES_SERVICE_ACCOUNT
              value: ""
            - name: KUBERNETES_SERVICE_CPU_LIMIT
              value: ""
            - name: KUBERNETES_SERVICE_MEMORY_LIMIT
              value: ""
            - name: KUBERNETES_SERVICE_CPU_REQUEST
              value: ""
            - name: KUBERNETES_SERVICE_MEMORY_REQUEST
              value: ""
            - name: KUBERNETES_HELPER_CPU_LIMIT
              value: ""
            - name: KUBERNETES_HELPER_MEMORY_LIMIT
              value: ""
            - name: KUBERNETES_HELPER_CPU_REQUEST
              value: ""
            - name: KUBERNETES_HELPER_MEMORY_REQUEST
              value: ""
            - name: KUBERNETES_HELPER_IMAGE
              value: ""
            - name: KUBERNETES_PULL_POLICY
              value: ""
          volumeMounts:
            - name: runner-secrets
              mountPath: /secrets
              readOnly: false
            - name: scripts
              mountPath: /config
              readOnly: true
            - name: init-runner-secrets
              mountPath: /init-secrets
              readOnly: true
          resources:
            {}
      serviceAccountName: gitlab-runner-gitlab-runner
      containers:
        - name: gitlab-runner-gitlab-runner
          image: gitlab/gitlab-runner:alpine-v13.4.1
          imagePullPolicy: "IfNotPresent"
          lifecycle:
            preStop:
              exec:
                command: ["/entrypoint", "unregister", "--all-runners"]
          command: ["/bin/bash", "/scripts/entrypoint"]
          env:

            - name: CI_SERVER_URL
              value: "https://gitlab.qa.joaocunha.eu/"
            - name: CLONE_URL
              value: ""
            - name: RUNNER_REQUEST_CONCURRENCY
              value: "1"
            - name: RUNNER_EXECUTOR
              value: "kubernetes"
            - name: REGISTER_LOCKED
              value: "true"
            - name: RUNNER_TAG_LIST
              value: ""
            - name: RUNNER_OUTPUT_LIMIT
              value: "4096"
            - name: KUBERNETES_IMAGE
              value: "ubuntu:16.04"

            - name: KUBERNETES_PRIVILEGED
              value: "true"

            - name: KUBERNETES_NAMESPACE
              value: "gitlab"
            - name: KUBERNETES_POLL_TIMEOUT
              value: "180"
            - name: KUBERNETES_CPU_LIMIT
              value: ""
            - name: KUBERNETES_CPU_LIMIT_OVERWRITE_MAX_ALLOWED
              value: ""
            - name: KUBERNETES_MEMORY_LIMIT
              value: ""
            - name: KUBERNETES_MEMORY_LIMIT_OVERWRITE_MAX_ALLOWED
              value: ""
            - name: KUBERNETES_CPU_REQUEST
              value: ""
            - name: KUBERNETES_CPU_REQUEST_OVERWRITE_MAX_ALLOWED
              value: ""
            - name: KUBERNETES_MEMORY_REQUEST
              value: ""
            - name: KUBERNETES_MEMORY_REQUEST_OVERWRITE_MAX_ALLOWED
              value: ""
            - name: KUBERNETES_SERVICE_ACCOUNT
              value: ""
            - name: KUBERNETES_SERVICE_CPU_LIMIT
              value: ""
            - name: KUBERNETES_SERVICE_MEMORY_LIMIT
              value: ""
            - name: KUBERNETES_SERVICE_CPU_REQUEST
              value: ""
            - name: KUBERNETES_SERVICE_MEMORY_REQUEST
              value: ""
            - name: KUBERNETES_HELPER_CPU_LIMIT
              value: ""
            - name: KUBERNETES_HELPER_MEMORY_LIMIT
              value: ""
            - name: KUBERNETES_HELPER_CPU_REQUEST
              value: ""
            - name: KUBERNETES_HELPER_MEMORY_REQUEST
              value: ""
            - name: KUBERNETES_HELPER_IMAGE
              value: ""
            - name: KUBERNETES_PULL_POLICY
              value: ""
          livenessProbe:
            exec:
              command: ["/bin/bash", "/scripts/check-live"]
            initialDelaySeconds: 60
            timeoutSeconds: 1
            periodSeconds: 10
            successThreshold: 1
            failureThreshold: 3
          readinessProbe:
            exec:
              command: ["/usr/bin/pgrep","gitlab.*runner"]
            initialDelaySeconds: 10
            timeoutSeconds: 1
            periodSeconds: 10
            successThreshold: 1
            failureThreshold: 3
          ports:
            - name: metrics
              containerPort: 9252
          volumeMounts:
            - name: runner-secrets
              mountPath: /secrets
            - name: etc-gitlab-runner
              mountPath: /home/gitlab-runner/.gitlab-runner
            - name: scripts
              mountPath: /scripts
          resources:
            {}
      volumes:
        - name: runner-secrets
          emptyDir:
            medium: "Memory"
        - name: etc-gitlab-runner
          emptyDir:
            medium: "Memory"
        - name: init-runner-secrets
          projected:
            sources:
              - secret:
                  name: "gitlab-runner-gitlab-runner"
                  items:
                    - key: runner-registration-token
                      path: runner-registration-token
                    - key: runner-token
                      path: runner-token
        - name: scripts
          configMap:
            name: gitlab-runner-gitlab-runner

故障排除

`associative list with keys has an element that omits key field "protocol"`

由于 Kubernetes v1.19 中的错误，您在使用 Kubernetes 的极狐 GitLab 代理安装极狐GitLab Runner 或其他应用的时候，可能会看到这个错误。如果想解决这个错误，您可以：

将您的 Kubernetes 集群升级到 v1.20 或更高版本。

或者将 protocol: TCP 添加到 containers.ports 子部分。

...
ports:
  - name: metrics
    containerPort: 9252
    protocol: TCP
...