public_git
/
actions-runner-controller
mirror of https://github.com/actions-runner-controller/actions-runner-controller.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

Use TLS for secure docker connection (#192)

This commit is contained in:
Shinnosuke Sawada 2020-11-30 08:57:33 +09:00 committed by GitHub
parent 4ca825eef0
commit be25715e1e
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 30 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

35
controllers/runner_controller.go
View File

@ -397,6 +397,12 @@ func (r *RunnerReconciler) newPod(runner v1alpha1.Runner) (corev1.Pod, error) {
EmptyDir: &corev1.EmptyDirVolumeSource{}, EmptyDir: &corev1.EmptyDirVolumeSource{},
}, },
}, },
{
Name: "certs-client",
VolumeSource: corev1.VolumeSource{
EmptyDir: &corev1.EmptyDirVolumeSource{},
},
},
} }
pod.Spec.Containers[0].VolumeMounts = []corev1.VolumeMount{ pod.Spec.Containers[0].VolumeMounts = []corev1.VolumeMount{
{ {
@ -407,11 +413,26 @@ func (r *RunnerReconciler) newPod(runner v1alpha1.Runner) (corev1.Pod, error) {
Name: "externals", Name: "externals",
MountPath: "/runner/externals", MountPath: "/runner/externals",
}, },
{
Name: "certs-client",
MountPath: "/certs/client",
ReadOnly: true,
},
} }
pod.Spec.Containers[0].Env = append(pod.Spec.Containers[0].Env, corev1.EnvVar{ pod.Spec.Containers[0].Env = append(pod.Spec.Containers[0].Env, []corev1.EnvVar{
Name: "DOCKER_HOST", {
Value: "tcp://localhost:2375", Name: "DOCKER_HOST",
}) Value: "tcp://localhost:2376",
},
{
Name: "DOCKER_TLS_VERIFY",
Value: "1",
},
{
Name: "DOCKER_CERT_PATH",
Value: "/certs/client",
},
}...)
pod.Spec.Containers = append(pod.Spec.Containers, corev1.Container{ pod.Spec.Containers = append(pod.Spec.Containers, corev1.Container{
Name: "docker", Name: "docker",
Image: r.DockerImage, Image: r.DockerImage,
@ -424,11 +445,15 @@ func (r *RunnerReconciler) newPod(runner v1alpha1.Runner) (corev1.Pod, error) {
Name: "externals", Name: "externals",
MountPath: "/runner/externals", MountPath: "/runner/externals",
}, },
{
Name: "certs-client",
MountPath: "/certs/client",
},
}, },
Env: []corev1.EnvVar{ Env: []corev1.EnvVar{
{ {
Name: "DOCKER_TLS_CERTDIR", Name: "DOCKER_TLS_CERTDIR",
Value: "", Value: "/certs",
}, },
}, },
SecurityContext: &corev1.SecurityContext{ SecurityContext: &corev1.SecurityContext{