cluster/k3s/stacks/droneci.yml

---
# Namespace for Drone CI
apiVersion: v1
kind: Namespace
metadata:
  name: droneci

---
# Service Account
apiVersion: v1
kind: ServiceAccount
metadata:
  name: droneci-sa
  namespace: droneci

---
# ConfigMap for Drone configuration
apiVersion: v1
kind: ConfigMap
metadata:
  name: droneci-config
  namespace: droneci
data:
  server.domain: "droneci.apps.mngoma.lab"
  server.proto: "https"
  server.runnername: "drone-runner"
  server.runnercapacity: "2"
  server.runnernetworks: "default"
  database.type: "postgres"
  database.host: "192.168.1.137:5432"
  database.name: "dronecim"
  gitea.server: "https://gitea.apps.mngoma.lab"
  gitea.server.internal: "https://gitea-server.gitea.svc.cluster.local"

---
# Secret for Drone credentials
apiVersion: v1
kind: Secret
metadata:
  name: droneci-secret
  namespace: droneci
type: Opaque
data:
  server.rpctoken: MDFLNlFHTkE4VEMxQjJGVzNGV0JSWDJFNE4=
  database.username: YXBwX3VzZXI=
  database.password: MTIzNDU=
  database.connectstring: cG9zdGdyZXM6Ly9hcHBfdXNlcjoxMjM0NUAxOTIuMTY4LjEuMTM3OjU0MzIvZHJvbmVjaW0/c3NsbW9kZT1kaXNhYmxl
  gitea.clientid: MGRiNTliZDAtMGI3Ni00ODgxLThhODQtNjI0N2ZlYTExOTcz
  gitea.clientsecret: Z3RvX3l6bXB6NmJvZG52cmRnMnM1MmVmNWF1c3ozZTYzNGdyeTc0MjJqZ2hwd3ZnbGc2M2JtcnE=

---
# Persistent Volume for Drone data
apiVersion: v1
kind: PersistentVolume
metadata:
  name: droneci-pv
  labels:
    type: local
spec:
  capacity:
    storage: 5Gi
  accessModes: ["ReadWriteOnce"]
  storageClassName: local-pvs
  local:
    path: /home/ansible/k3s/makhiwane/droneci
  nodeAffinity:
    required:
      nodeSelectorTerms:
        - matchExpressions:
            - key: kubernetes.io/hostname
              operator: In
              values: ["lead"]
  persistentVolumeReclaimPolicy: Retain

---
# Persistent Volume Claim
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: droneci-pvc
  namespace: droneci
spec:
  accessModes: ["ReadWriteOnce"]
  storageClassName: local-pvs
  resources:
    requests:
      storage: 5Gi

---
# Drone Server Deployment
apiVersion: apps/v1
kind: Deployment
metadata:
  name: drone
  namespace: droneci
  labels:
    app.kubernetes.io/name: drone
spec:
  replicas: 1
  selector:
    matchLabels:
      app.kubernetes.io/name: drone
  template:
    metadata:
      labels:
        app.kubernetes.io/name: drone
    spec:
      serviceAccountName: droneci-sa
      hostAliases:
        - ip: "192.168.1.160"
          hostnames:
            - "gitea.apps.mngoma.lab"
      containers:
        - name: drone
          image: drone/drone:latest
          ports:
            - containerPort: 80
              name: http
          resources:
            requests:
              memory: "256Mi"
              cpu: "250m"
            limits:
              memory: "512Mi"
              cpu: "500m"
          env:
            - name: DRONE_SERVER_HOST
              valueFrom:
                configMapKeyRef:
                  name: droneci-config
                  key: server.domain
            - name: DRONE_SERVER_PROTO
              valueFrom:
                configMapKeyRef:
                  name: droneci-config
                  key: server.proto
            - name: DRONE_SERVER_PORT
              value: ":80"
            - name: DRONE_TLS_AUTOCERT
              value: "false"
            - name: DRONE_LOGS_DEBUG
              value: "true"
            - name: DRONE_RPC_SECRET
              valueFrom:
                secretKeyRef:
                  name: droneci-secret
                  key: server.rpctoken
            - name: DRONE_DATABASE_DRIVER
              valueFrom:
                configMapKeyRef:
                  name: droneci-config
                  key: database.type
            - name: DRONE_DATABASE_DATASOURCE
              valueFrom:
                secretKeyRef:
                  name: droneci-secret
                  key: database.connectstring
            - name: DRONE_DB_USER
              valueFrom:
                secretKeyRef:
                  name: droneci-secret
                  key: database.username
            - name: DRONE_DB_PASS
              valueFrom:
                secretKeyRef:
                  name: droneci-secret
                  key: database.password
            - name: DRONE_GITEA_SERVER
              valueFrom:
                configMapKeyRef:
                  name: droneci-config
                  key: gitea.server
            - name: DRONE_GITEA_CLIENT_ID
              valueFrom:
                secretKeyRef:
                  name: droneci-secret
                  key: gitea.clientid
            - name: DRONE_GITEA_CLIENT_SECRET
              valueFrom:
                secretKeyRef:
                  name: droneci-secret
                  key: gitea.clientsecret
            - name: DRONE_GITEA_SKIP_VERIFY
              value: "true"
          volumeMounts:
            - name: drone-storage
              mountPath: /data
      volumes:
        - name: drone-storage
          persistentVolumeClaim:
            claimName: droneci-pvc

---
# Drone Server Service
apiVersion: v1
kind: Service
metadata:
  name: drone-server
  namespace: droneci
spec:
  selector:
    app.kubernetes.io/name: drone
  ports:
    - name: http
      port: 80
      targetPort: 80
  type: ClusterIP

---
# Drone Runner Deployment
apiVersion: apps/v1
kind: Deployment
metadata:
  name: drone-runner
  namespace: droneci
  labels:
    app.kubernetes.io/name: drone-runner
spec:
  replicas: 1
  selector:
    matchLabels:
      app.kubernetes.io/name: drone-runner
  template:
    metadata:
      labels:
        app.kubernetes.io/name: drone-runner
    spec:
      serviceAccountName: droneci-sa
      hostAliases:
        - ip: "192.168.1.160"
          hostnames:
            - "droneci.apps.mngoma.lab"
      containers:
        - name: runner
          image: drone/drone-runner-kube:latest
          ports:
            - containerPort: 3000
          env:
            # propagate SSL skip and internal Gitea to ephemeral pods
            - name: DRONE_RUNNER_ENV_VARS
              valueFrom:
                configMapKeyRef:
                  name: droneci-config
                  key: gitea.server.internal
            - name: DRONE_RPC_HOST
              value: drone-server.droneci.svc.cluster.local
            - name: DRONE_RPC_PROTO
              value: "http"
            - name: DRONE_RPC_SECRET
              valueFrom:
                secretKeyRef:
                  name: droneci-secret
                  key: server.rpctoken
            - name: DRONE_RUNNER_NAME
              valueFrom:
                configMapKeyRef:
                  name: droneci-config
                  key: server.runnername
            - name: DRONE_RUNNER_CAPACITY
              valueFrom:
                configMapKeyRef:
                  name: droneci-config
                  key: server.runnercapacity
            - name: DRONE_RUNNER_NETWORKS
              valueFrom:
                configMapKeyRef:
                  name: droneci-config
                  key: server.runnernetworks
          resources:
            requests:
              memory: "128Mi"
              cpu: "200m"
            limits:
              memory: "256Mi"
              cpu: "400m"

---
# Drone IngressRoute for Traefik
apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: droneci-web
  namespace: droneci
spec:
  entryPoints:
    - websecure
  routes:
    - match: Host(`droneci.apps.mngoma.lab`)
      kind: Rule
      services:
        - name: drone-server
          port: 80
          scheme: http
  tls: {}
---
# ClusterRole for Drone CI Service Account
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: droneci-cluster-role
rules:
  - apiGroups: [""] # core API
    resources: ["pods", "pods/exec", "pods/log", "services", "endpoints", "configmaps", "secrets", "persistentvolumeclaims", "namespaces"]
    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
  - apiGroups: ["apps"]
    resources: ["deployments", "replicasets", "statefulsets"]
    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
  - apiGroups: ["batch"]
    resources: ["jobs", "cronjobs"]
    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
  - apiGroups: ["extensions", "networking.k8s.io"]
    resources: ["ingresses"]
    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
  - apiGroups: ["policy"]
    resources: ["poddisruptionbudgets"]
    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]

---
# ClusterRoleBinding for Drone CI Service Account
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: droneci-cluster-rolebinding
subjects:
  - kind: ServiceAccount
    name: droneci-sa
    namespace: droneci
roleRef:
  kind: ClusterRole
  name: droneci-cluster-role
  apiGroup: rbac.authorization.k8s.io