mirror of
https://gitea.com/gitea/runner.git
synced 2026-11-15 04:13:42 +00:00
enhance: trust a private CA with runner.ca_file and add container.volumes (#1366)
Adds `container.volumes`, mounted into every Docker job, service and action container. Sources are paths on the Docker daemon's host and need no `valid_volumes` entry, and workflow volumes may use them only with the same access. Adds `runner.ca_file`, a private CA trusted for the Gitea instance besides the system's by the runner's connections and its artifact proxy. Runner-side git and `builtin:checkout` use it as their CA bundle for the instance, persisted with the checkout's credentials. Jobs get it at `/var/run/act/ca.crt` with `NODE_EXTRA_CA_CERTS` pointing there unless the job or its image sets it. Git in jobs, as run by `actions/checkout`, needs the CA in the image's bundle, for example through `container.volumes`. Fixes: https://gitea.com/gitea/runner/issues/568 Fixes: https://gitea.com/gitea/runner/issues/671 Co-authored-by: silverwind <[email protected]> Co-authored-by: silverwind <[email protected]> Reviewed-on: https://gitea.com/gitea/runner/pulls/1366 Reviewed-by: silverwind <[email protected]> Co-authored-by: bircni <[email protected]>
This commit is contained in:
authored and silverwind committed
1 parent
7a9fccb842
commit
aa56f46c89
22 files changed
+309
-75
No files matched your search
@@ -44,6 +44,12 @@ runner:
|
||||
# PEM client certificate and key for a Gitea instance that requires mutual TLS.
|
||||
#client_cert_file: /etc/gitea-runner/client.crt
|
||||
#client_key_file: /etc/gitea-runner/client.key
|
||||
# PEM CA certificates of a Gitea instance with a private CA, trusted besides the system's.
|
||||
# Runner-side git and builtin:checkout use it instead of the system's bundle for the instance.
|
||||
# Jobs get it at /var/run/act/ca.crt, or in their act directory on the host, with NODE_EXTRA_CA_CERTS
|
||||
# pointing there unless the job, or on Docker its image, sets it. Other tools in jobs, such as the
|
||||
# git that actions/checkout runs, need the CA in the image's bundle, for example via container.volumes.
|
||||
#ca_file: /etc/gitea-runner/ca.crt
|
||||
# The timeout for fetching the job from the Gitea instance.
|
||||
# Values above the 60s RPC timeout are capped to it.
|
||||
#fetch_timeout: 5s
|
||||
@@ -264,6 +270,15 @@ container:
|
||||
# valid_volumes:
|
||||
# - '**'
|
||||
#valid_volumes: []
|
||||
# Volumes and bind mounts the runner adds to every job, service and docker action container, as in
|
||||
# `docker run --volume`, with sources on the docker daemon's host. One the workflow mounts on the same
|
||||
# container path takes its place. Their sources need no valid_volumes entry, and workflow volumes may
|
||||
# use them only with the same access, though a job given the docker socket can mount anything.
|
||||
# Docker only, use pod_template on Kubernetes. For example, to trust a private CA in Debian and
|
||||
# Ubuntu based images:
|
||||
# volumes:
|
||||
# - /etc/ssl/certs/ca-certificates.crt:/etc/ssl/certs/ca-certificates.crt:ro
|
||||
#volumes: []
|
||||
# Overrides the docker client host with the specified one.
|
||||
# If it's empty, runner will find an available docker host automatically.
|
||||
# If it's "-", runner will find an available docker host automatically, but won't mount it into the job and action containers.
|
||||
|
||||
@@ -5,6 +5,7 @@ package config
|
||||
|
||||
import (
|
||||
"crypto/tls"
|
||||
"crypto/x509"
|
||||
"errors"
|
||||
"fmt"
|
||||
"maps"
|
||||
@@ -16,7 +17,9 @@ import (
|
||||
"time"
|
||||
|
||||
"gitea.com/gitea/runner/act/common/logging"
|
||||
"gitea.com/gitea/runner/act/container"
|
||||
|
||||
"github.com/docker/go-connections/tlsconfig"
|
||||
"github.com/docker/go-units"
|
||||
"github.com/joho/godotenv"
|
||||
"go.yaml.in/yaml/v4"
|
||||
@@ -67,6 +70,7 @@ type Runner struct {
|
||||
Insecure bool `yaml:"insecure"` // Insecure indicates whether the runner operates in an insecure mode.
|
||||
ClientCertFile string `yaml:"client_cert_file"` // ClientCertFile is the PEM certificate presented to a Gitea instance that requires mutual TLS.
|
||||
ClientKeyFile string `yaml:"client_key_file"` // ClientKeyFile is the PEM private key paired with ClientCertFile.
|
||||
CAFile string `yaml:"ca_file"` // CAFile holds PEM CA certificates trusted for the Gitea instance besides the system's.
|
||||
ExtraHeaders map[string]string `yaml:"extra_headers"` // ExtraHeaders adds HTTP headers to runner API requests to Gitea.
|
||||
FetchTimeout time.Duration `yaml:"fetch_timeout"` // FetchTimeout specifies the timeout duration for fetching resources.
|
||||
FetchInterval time.Duration `yaml:"fetch_interval"` // FetchInterval specifies the interval duration for fetching resources.
|
||||
@@ -90,6 +94,8 @@ type Runner struct {
|
||||
PostTaskScript string `yaml:"post_task_script"` // PostTaskScript is the path to an executable script run on the host after each task's cleanup completes. Empty disables the hook. On Windows use .exe/.bat/.cmd; PowerShell (.ps1) is not supported yet as the configured path.
|
||||
PostTaskScriptTimeout time.Duration `yaml:"post_task_script_timeout"` // PostTaskScriptTimeout caps how long the post-task script may run. Default is 5m when post_task_script is set.
|
||||
Hooks RunnerHooks `yaml:"hooks"` // Hooks are scripts run inside the job environment around the job's steps.
|
||||
|
||||
rootCAs *x509.CertPool // the system's and CAFile's, nil for the system's alone
|
||||
}
|
||||
|
||||
// RunnerHooks represents the scripts run inside the job environment around the job's steps.
|
||||
@@ -176,6 +182,7 @@ type Container struct {
|
||||
Options string `yaml:"options"` // Options specifies additional options for the container.
|
||||
WorkdirParent string `yaml:"workdir_parent"` // WorkdirParent specifies the parent directory for the container's working directory.
|
||||
ValidVolumes []string `yaml:"valid_volumes"` // ValidVolumes specifies the volumes (including bind mounts) can be mounted to containers.
|
||||
Volumes []string `yaml:"volumes"` // Volumes are mounted into every job, service and docker action container.
|
||||
DockerHost string `yaml:"docker_host"` // DockerHost specifies the Docker host. It overrides the value specified in environment variable DOCKER_HOST.
|
||||
ForcePull bool `yaml:"force_pull"` // Pull docker image(s) even if already present, except digest-pinned ones. A pull that fails while a local copy exists is a warning, not a job failure.
|
||||
ForceRebuild bool `yaml:"force_rebuild"` // Rebuild docker image(s) even if already present
|
||||
@@ -313,6 +320,17 @@ func LoadDefault(file string) (*Config, error) {
|
||||
}
|
||||
}
|
||||
|
||||
if cfg.Runner.CAFile != "" {
|
||||
if err := cfg.Runner.loadCAFile(); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
}
|
||||
for _, spec := range cfg.Container.Volumes {
|
||||
if parsed, err := container.ParseVolume(spec); err != nil || parsed.Source == "" {
|
||||
return nil, fmt.Errorf("container.volumes entry %q is not source:target[:options]", spec)
|
||||
}
|
||||
}
|
||||
|
||||
if cfg.Log.Level == "" {
|
||||
cfg.Log.Level = "info"
|
||||
}
|
||||
@@ -465,8 +483,22 @@ func LoadDefault(file string) (*Config, error) {
|
||||
return cfg, nil
|
||||
}
|
||||
|
||||
func (r *Runner) loadCAFile() error {
|
||||
abs, err := filepath.Abs(r.CAFile) // git resolves a relative path against the repository it runs in
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
r.CAFile = abs
|
||||
tlsConfig, err := tlsconfig.Client(tlsconfig.Options{CAFile: r.CAFile})
|
||||
if err != nil {
|
||||
return fmt.Errorf("load runner CA file: %w", err)
|
||||
}
|
||||
r.rootCAs = tlsConfig.RootCAs
|
||||
return nil
|
||||
}
|
||||
|
||||
func (r *Runner) TLSConfig() *tls.Config {
|
||||
tlsConfig := &tls.Config{InsecureSkipVerify: r.Insecure}
|
||||
tlsConfig := &tls.Config{InsecureSkipVerify: r.Insecure, RootCAs: r.rootCAs}
|
||||
if r.ClientCertFile != "" {
|
||||
tlsConfig.GetClientCertificate = func(info *tls.CertificateRequestInfo) (*tls.Certificate, error) {
|
||||
pair, err := tls.LoadX509KeyPair(r.ClientCertFile, r.ClientKeyFile) // per handshake, so renewed files apply
|
||||
|
||||
@@ -10,7 +10,11 @@ import (
|
||||
"crypto/tls"
|
||||
"crypto/x509"
|
||||
"encoding/pem"
|
||||
"io"
|
||||
"log"
|
||||
"math/big"
|
||||
"net/http"
|
||||
"net/http/httptest"
|
||||
"os"
|
||||
"path/filepath"
|
||||
"strings"
|
||||
@@ -66,6 +70,46 @@ func TestClientCertIsValidatedAndAbsoluteOnLoadReadOnUseAndOfferedOnlyWhenAccept
|
||||
require.Empty(t, pair.Certificate)
|
||||
}
|
||||
|
||||
func TestCAFileIsValidatedAndAbsoluteOnLoadAndTrustedBesidesTheSystem(t *testing.T) {
|
||||
server := httptest.NewUnstartedServer(http.HandlerFunc(func(_writer http.ResponseWriter, _request *http.Request) {}))
|
||||
server.Config.ErrorLog = log.New(io.Discard, "", 0)
|
||||
server.StartTLS()
|
||||
defer server.Close()
|
||||
dir := t.TempDir()
|
||||
require.NoError(t, os.WriteFile(filepath.Join(dir, "ca.crt"), pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: server.Certificate().Raw}), 0o600))
|
||||
require.NoError(t, os.WriteFile(filepath.Join(dir, "empty.crt"), nil, 0o600))
|
||||
load := func(file string) (*Config, error) { return LoadDefault(write(t, "runner:\n ca_file: '"+file+"'\n")) }
|
||||
|
||||
t.Chdir(dir)
|
||||
_, err := load("empty.crt")
|
||||
require.ErrorContains(t, err, "failed to append certificates")
|
||||
_, err = load("missing.crt")
|
||||
require.ErrorContains(t, err, "could not read CA certificate")
|
||||
cfg, err := load("ca.crt")
|
||||
require.NoError(t, err)
|
||||
require.Equal(t, filepath.Join(dir, "ca.crt"), cfg.Runner.CAFile)
|
||||
|
||||
get := func(runner *Runner) error {
|
||||
resp, err := (&http.Client{Transport: &http.Transport{TLSClientConfig: runner.TLSConfig()}}).Get(server.URL)
|
||||
if err == nil {
|
||||
resp.Body.Close()
|
||||
}
|
||||
return err
|
||||
}
|
||||
require.Error(t, get(&Runner{}))
|
||||
require.NoError(t, get(&cfg.Runner))
|
||||
}
|
||||
|
||||
func TestLoadDefault_RejectsContainerVolumesWithoutSource(t *testing.T) {
|
||||
cfg, err := LoadDefault(write(t, "container:\n volumes: ['/etc/ssl/certs:/etc/ssl/certs:ro', 'data:/data']\n"))
|
||||
require.NoError(t, err)
|
||||
require.Equal(t, []string{"/etc/ssl/certs:/etc/ssl/certs:ro", "data:/data"}, cfg.Container.Volumes)
|
||||
for _, spec := range []string{"/etc/ssl/certs", "/a:/b:ro:/c"} {
|
||||
_, err = LoadDefault(write(t, "container:\n volumes: ['"+spec+"']\n"))
|
||||
require.ErrorContains(t, err, "is not source:target", spec)
|
||||
}
|
||||
}
|
||||
|
||||
func TestLoadDefault_ExpandsEnvironmentValues(t *testing.T) {
|
||||
t.Setenv("RUNNER_CAPACITY", "4")
|
||||
t.Setenv("RUNNER_LABEL", "linux:host")
|
||||
@@ -307,11 +351,11 @@ func TestLoadDefault_MalformedYAMLReturnsParseError(t *testing.T) {
|
||||
func TestLoadDefault_WarnsOnUnknownKeysButStillLoads(t *testing.T) {
|
||||
hook := logtest.SetDefault(t)
|
||||
|
||||
cfg, err := LoadDefault(write(t, "container:\n volumes:\n - /host:/ctr\n privileged: true\n"))
|
||||
cfg, err := LoadDefault(write(t, "container:\n mounts:\n - /host:/ctr\n privileged: true\n"))
|
||||
require.NoError(t, err)
|
||||
assert.True(t, cfg.Container.Privileged)
|
||||
require.Len(t, hook.AllRecords(), 1)
|
||||
assert.Contains(t, hook.LastRecord().Message, "field volumes not found")
|
||||
assert.Contains(t, hook.LastRecord().Message, "field mounts not found")
|
||||
}
|
||||
|
||||
func TestContainerNetworkCreateOptions(t *testing.T) {
|
||||
|
||||
Reference in new issue
Block a user