Drone.io Configuration Kubernetes

drone-runner-crb.yml

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  # "namespace" omitted since ClusterRoles are not namespaced
  name: ci
rules:
- apiGroups: ["*"]
  #
  # at the HTTP level, the name of the resource for accessing Secret
  # objects is "secrets"
  resources:
  - secrets
  - pods
  - deployments
  - services
  - namespaces
  - ingressroutes
  verbs: ["get", "watch", "list", "create", "delete", "patch"]

---
apiVersion: rbac.authorization.k8s.io/v1
# This cluster role binding allows anyone in the "manager" group to read secrets in any namespace.
kind: ClusterRoleBinding
metadata:
  name: cicd
subjects:
- kind: ServiceAccount
  name: drone # Name is case sensitive
  namespace: default
roleRef:
  kind: ClusterRole
  name: ci
  apiGroup: rbac.authorization.k8s.io

drone-runner-deployment.yml

apiVersion: apps/v1
kind: Deployment
metadata:
  name: drone
  namespace: default
  labels:
    app.kubernetes.io/name: drone
spec:
  replicas: 4
  selector:
    matchLabels:
      app.kubernetes.io/name: drone
  template:
    metadata:
      labels:
        app.kubernetes.io/name: drone
    spec:
      containers:
      - name: runner
        image: drone/drone-runner-kube:latest
        ports:
        - containerPort: 3000
        env:
        - name: DRONE_SERVICE_ACCOUNT_DEFAULT
          value: drone
        - name: DRONE_NAMESPACE_DEFAULT
          value: default
        - name: DRONE_RPC_HOST
          value: drone-server.drone.svc.cluster.local:8666
        - name: DRONE_RPC_PROTO
          value: http
        - name: DRONE_RPC_SECRET
          valueFrom:
           secretKeyRef:
             name: drone-secrets
             key: DRONE_RPC_SECRET

drone-runner-rb.yml

kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: drone
  namespace: default
subjects:
- kind: ServiceAccount
  name: default
  namespace: default
roleRef:
  kind: Role
  name: drone
  apiGroup: rbac.authorization.k8s.io

drone-runner-role.yml

kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  namespace: drone
  name: default
rules:
- apiGroups:
  - ""
  resources:
  - secrets
  verbs:
  - create
  - delete
- apiGroups:
  - ""
  resources:
  - pods
  - pods/log
  verbs:
  - get
  - create
  - delete
  - list
  - watch
  - update

drone-runner-sa.yml

apiVersion: v1
kind: ServiceAccount
metadata:
  name: drone
  namespace: default
  labels:
    app.kubernetes.io/name: drone
    app.kubernetes.io/instance: drone
    app.kubernetes.io/component: drone

drone-server-deployment.yml

apiVersion: apps/v1
kind: Deployment
metadata:
  name: drone-server
  labels:
    app: drone-server
spec:
  selector:
    matchLabels:
      app: drone-server
      tier: drone-server
  strategy:
    #type: Recreate
    type: RollingUpdate
    rollingUpdate:
      maxSurge: 1
      maxUnavailable: 0
  template:
    metadata:
      labels:
        app: drone-server
        tier: drone-server
    spec:
      containers:
      - image: drone/drone:2
        name: drone-server
        env:
        - name: DRONE_DEBUG
          value: "true"
        - name: DRONE_USER_FILTER
          value: thesetkehproject
        - name: DRONE_SERVER_PORT
          value: ":8666"
        - name: DRONE_DATABASE_DRIVER
          value: "mysql"
        - name: DRONE_NAMESPACE_DEFAULT
          value: drone
        - name: DRONE_USER_CREATE
          value: username:setkeh,admin:true
        - name: DRONE_DATABASE_DATASOURCE
          valueFrom:
            secretKeyRef:
              name: drone-secrets
              key: DRONE_DATABASE_DATASOURCE
        - name: DRONE_RPC_SECRET
          valueFrom:
            secretKeyRef:
              name: drone-secrets
              key: DRONE_RPC_SECRET
        - name: DRONE_SERVER_HOST
          value: "drone.setkeh.com"
        - name: DRONE_SERVER_PROTO
          value: "https"
        - name: DRONE_TLS_AUTOCERT
          value: "false"
        - name: DRONE_GITHUB_CLIENT_ID
          valueFrom:
            secretKeyRef:
              name: drone-secrets
              key: DRONE_GITHUB_CLIENT_ID
        - name: DRONE_GITHUB_CLIENT_SECRET
          valueFrom:
            secretKeyRef:
              name: drone-secrets
              key: DRONE_GITHUB_CLIENT_SECRET

        ports:
        - containerPort: 8666
          name: drone-server
        volumeMounts:
        - name: drone-server-persistent-storage
          mountPath: /var/lib/drone
      volumes:
      - name: drone-server-persistent-storage
        persistentVolumeClaim:
          claimName: drone-server-pv-claim

drone-server-ingressroute.yml

apiVersion: traefik.containo.us/v1alpha1
kind: IngressRoute
metadata:
  name: static-site-route
  namespace: drone
spec:
  entryPoints:
  - websecure
  routes:
  - match: Host(`drone.setkeh.com`)
    kind: Rule
    services:
      - name: drone-server
        passHostHeader: true
        port: 8666
  tls:
    secretName: setkeh-cert

drone-server-pvc.yml

apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: drone-server-pv-claim
  labels:
    app: drone-server
spec:
  storageClassName: longhorn
  accessModes:
    - ReadWriteOnce
  resources:
    requests:
      storage: 10Gi
  storageClassName: linode-block-storage

drone-server-svc.yml

apiVersion: v1
kind: Service
metadata:
  name: drone-server
spec:
  ports:
  - name: drone-server
    port: 8666
    targetPort: 8666
  selector:
    app: drone-server
  clusterIP: None