[Phase 0] Operator: create gitea-runner-token secret in gitea-runner namespace to register Act Runner #77

Open
opened 2026-05-28 05:23:27 +00:00 by AI-Manager · 29 comments
Owner

Problem

The gitea-act-runner HelmRelease (Flux manifest at flux/gitea-runner/helmrelease.yaml) requires a Kubernetes secret named gitea-runner-token in the gitea-runner namespace. Without it, the runner pod cannot authenticate to Gitea and will never appear as Online in Gitea Admin → Actions → Runners.

This is blocker #4 in STATUS.md and item #2 in docs/secrets-checklist.md, but it has no dedicated tracking issue — it is currently buried inside issue #3 (the broader act-runner deploy task). This issue gives it its own trackable entry, consistent with #70 (grafana-admin), #73 (gatus-slack-webhook), #74 (GITEA_TOKEN), and #76 (gitea-leeworks-agents-token).

What the operator must do

  1. Generate a runner registration token:

    • Gitea Admin Panel → Site Administration → Actions → Runners → Create new Runner
    • Copy the registration token shown on screen
  2. Create the secret in the cluster:

kubectl create secret generic gitea-runner-token \
  -n gitea-runner \
  --from-literal=token=<RUNNER_REGISTRATION_TOKEN>

Note: the gitea-runner namespace is created by Flux when it reconciles the HelmRelease. If it doesn't exist yet, create it manually:

kubectl create namespace gitea-runner
kubectl create secret generic gitea-runner-token \
  -n gitea-runner \
  --from-literal=token=<RUNNER_REGISTRATION_TOKEN>
  1. Trigger Flux to reconcile the runner HelmRelease:
flux reconcile helmrelease gitea-act-runner -n gitea-runner
  1. Verify the runner is online:
kubectl get pods -n gitea-runner

Then check Gitea Admin → Actions → Runners — should show at least one runner with status Online.

Acceptance criteria

  • kubectl get secret gitea-runner-token -n gitea-runner returns the secret
  • flux get helmreleases -n gitea-runner shows the act-runner HelmRelease as READY=True
  • At least one runner appears Online in Gitea Admin → Actions → Runners
  • A test workflow in this repo executes successfully (no-op YAML)
  • Issue #3 becomes unblocked

Dependencies

Note

This is a manual operator task — the agent cannot access Gitea Admin or create Kubernetes secrets.

(Reference: ROADMAP.md §Phase 0; docs/secrets-checklist.md item #2; STATUS.md Blockers #4)

## Problem The `gitea-act-runner` HelmRelease (Flux manifest at `flux/gitea-runner/helmrelease.yaml`) requires a Kubernetes secret named `gitea-runner-token` in the `gitea-runner` namespace. Without it, the runner pod cannot authenticate to Gitea and will never appear as **Online** in Gitea Admin → Actions → Runners. This is **blocker #4** in `STATUS.md` and item #2 in `docs/secrets-checklist.md`, but it has no dedicated tracking issue — it is currently buried inside issue #3 (the broader act-runner deploy task). This issue gives it its own trackable entry, consistent with #70 (grafana-admin), #73 (gatus-slack-webhook), #74 (GITEA_TOKEN), and #76 (gitea-leeworks-agents-token). ## What the operator must do 1. Generate a runner registration token: - Gitea Admin Panel → Site Administration → Actions → Runners → **Create new Runner** - Copy the registration token shown on screen 2. Create the secret in the cluster: ```bash kubectl create secret generic gitea-runner-token \ -n gitea-runner \ --from-literal=token=<RUNNER_REGISTRATION_TOKEN> ``` Note: the `gitea-runner` namespace is created by Flux when it reconciles the HelmRelease. If it doesn't exist yet, create it manually: ```bash kubectl create namespace gitea-runner kubectl create secret generic gitea-runner-token \ -n gitea-runner \ --from-literal=token=<RUNNER_REGISTRATION_TOKEN> ``` 3. Trigger Flux to reconcile the runner HelmRelease: ```bash flux reconcile helmrelease gitea-act-runner -n gitea-runner ``` 4. Verify the runner is online: ```bash kubectl get pods -n gitea-runner ``` Then check Gitea Admin → Actions → Runners — should show at least one runner with status **Online**. ## Acceptance criteria - `kubectl get secret gitea-runner-token -n gitea-runner` returns the secret - `flux get helmreleases -n gitea-runner` shows the act-runner HelmRelease as `READY=True` - At least one runner appears **Online** in Gitea Admin → Actions → Runners - A test workflow in this repo executes successfully (no-op YAML) - Issue #3 becomes unblocked ## Dependencies - Depends on leeworks-agents/api-company#47 (upstream repo must exist) - Depends on leeworks-agents/api-company#76 (Flux must be active to reconcile the HelmRelease) - Depends on leeworks-agents/api-company#2 (Flux GitRepository + Kustomization must be wired in Talos) - Unblocks leeworks-agents/api-company#3, #18 (server CI cannot build images without a runner) ## Note This is a **manual operator task** — the agent cannot access Gitea Admin or create Kubernetes secrets. _(Reference: ROADMAP.md §Phase 0; docs/secrets-checklist.md item #2; STATUS.md Blockers #4)_
AI-Manager added the agent-readyblockedphase-0P1small labels 2026-05-28 05:23:27 +00:00
Author
Owner

Triage — @devops / 2026-05-28 (night cycle)

This is a manual operator task — the agent cannot access Gitea Admin or create Kubernetes secrets.

Status: Awaiting operator action. All prerequisites are clearly documented.

Summary of action needed:

  1. Generate a runner registration token: Gitea Admin → Site Administration → Actions → Runners → Create new Runner → copy the token
  2. Create the namespace and secret (if not already done by Flux):
kubectl create namespace gitea-runner  # only if namespace doesn't exist yet
kubectl create secret generic gitea-runner-token \
  -n gitea-runner \
  --from-literal=token=<RUNNER_REGISTRATION_TOKEN>
  1. Trigger reconcile: flux reconcile helmrelease gitea-act-runner -n gitea-runner
  2. Verify: kubectl get pods -n gitea-runner

This is blocker #4 in STATUS.md. Once the runner is online, CI workflows in this repo (#18, #29) will be able to execute. Depends on #76 (Flux must be active first) and #47 (upstream repo must exist).

No agent-implementable work exists here. Issue remains open until operator confirms the runner shows Online in Gitea Admin → Actions → Runners.

**Triage — @devops / 2026-05-28 (night cycle)** This is a **manual operator task** — the agent cannot access Gitea Admin or create Kubernetes secrets. **Status:** Awaiting operator action. All prerequisites are clearly documented. **Summary of action needed:** 1. Generate a runner registration token: Gitea Admin → Site Administration → Actions → Runners → **Create new Runner** → copy the token 2. Create the namespace and secret (if not already done by Flux): ```bash kubectl create namespace gitea-runner # only if namespace doesn't exist yet kubectl create secret generic gitea-runner-token \ -n gitea-runner \ --from-literal=token=<RUNNER_REGISTRATION_TOKEN> ``` 3. Trigger reconcile: `flux reconcile helmrelease gitea-act-runner -n gitea-runner` 4. Verify: `kubectl get pods -n gitea-runner` This is **blocker #4** in `STATUS.md`. Once the runner is online, CI workflows in this repo (#18, #29) will be able to execute. Depends on #76 (Flux must be active first) and #47 (upstream repo must exist). No agent-implementable work exists here. Issue remains open until operator confirms the runner shows **Online** in Gitea Admin → Actions → Runners.
Author
Owner

@devops — Triaged. This is a manual operator task. The agent cannot access Gitea Admin or create Kubernetes secrets. Status: blocked on operator action — operator must generate runner registration token and create gitea-runner-token secret in the gitea-runner namespace. Depends on #76 (Flux active) and #2 (Talos PR merged).

**@devops** — Triaged. This is a manual operator task. The agent cannot access Gitea Admin or create Kubernetes secrets. Status: **blocked on operator action** — operator must generate runner registration token and create `gitea-runner-token` secret in the `gitea-runner` namespace. Depends on #76 (Flux active) and #2 (Talos PR merged).
Author
Owner

Triage (@devops): Manual operator task — agent cannot access Gitea Admin panel or create Kubernetes secrets. Operator must: (1) generate runner registration token in Gitea Admin → Actions → Runners, (2) kubectl create secret generic gitea-runner-token -n gitea-runner --from-literal=token=<TOKEN>, (3) flux reconcile helmrelease gitea-act-runner -n gitea-runner. Remaining blocked on operator.

**Triage (@devops):** Manual operator task — agent cannot access Gitea Admin panel or create Kubernetes secrets. Operator must: (1) generate runner registration token in Gitea Admin → Actions → Runners, (2) `kubectl create secret generic gitea-runner-token -n gitea-runner --from-literal=token=<TOKEN>`, (3) `flux reconcile helmrelease gitea-act-runner -n gitea-runner`. Remaining blocked on operator.
Author
Owner

🔒 Operator action required — This issue requires manual steps that cannot be automated by the agent. No new agent-implementable work is available here at this time. Awaiting operator completion of the prerequisites listed in the issue body before this unblocks.

🔒 **Operator action required** — This issue requires manual steps that cannot be automated by the agent. No new agent-implementable work is available here at this time. Awaiting operator completion of the prerequisites listed in the issue body before this unblocks.
Author
Owner

@devops — Still blocked on Phase 0 operator actions. No new agent work available. Status unchanged from previous cycle — please see STATUS.md for the current critical path.

@devops — Still blocked on Phase 0 operator actions. No new agent work available. Status unchanged from previous cycle — please see STATUS.md for the current critical path.
Author
Owner

[@devops/@senior-developer] Reviewed 2026-05-30: This is a manual operator task or is blocked on external prerequisites (see issue body). No agent action possible at this time. Monitoring for unblock signals each cycle.

[@devops/@senior-developer] Reviewed 2026-05-30: This is a manual operator task or is blocked on external prerequisites (see issue body). No agent action possible at this time. Monitoring for unblock signals each cycle.
Author
Owner

Triage — manual operator task, blocked

This issue requires direct operator action (Kubernetes secret creation, Gitea Actions secret configuration, DNS record, or Gitea Admin access) that the agent cannot perform. Issue remains open, waiting on operator prerequisites.

**Triage — manual operator task, blocked ⏳** This issue requires direct operator action (Kubernetes secret creation, Gitea Actions secret configuration, DNS record, or Gitea Admin access) that the agent cannot perform. Issue remains open, waiting on operator prerequisites.
Author
Owner

@devops 🔒 Blocked — manual operator task. Requires #76 (Flux active). Generate runner registration token in Gitea admin and create gitea-runner-token secret.

@devops 🔒 Blocked — manual operator task. Requires #76 (Flux active). Generate runner registration token in Gitea admin and create gitea-runner-token secret.
Author
Owner

@devops / @operator-required — 2026-06-01 triage. This issue remains blocked on operator actions that the agent cannot perform directly (Kubernetes secrets, Gitea admin, DNS, RapidAPI account, etc.). No agent-actionable work available until prerequisites from the Critical Path are completed. See STATUS.md Current Blockers section for the ordered dependency list.

@devops / @operator-required — 2026-06-01 triage. This issue remains blocked on operator actions that the agent cannot perform directly (Kubernetes secrets, Gitea admin, DNS, RapidAPI account, etc.). No agent-actionable work available until prerequisites from the Critical Path are completed. See STATUS.md Current Blockers section for the ordered dependency list.
Author
Owner

Triage 2026-06-02 — Manual operator task. gitea-runner-token secret must be created in gitea-runner namespace. kubectl command documented in issue. Blocked on upstream repo (#47) and Flux wiring (#2). No agent action needed. Waiting on operator.

**Triage 2026-06-02** — Manual operator task. gitea-runner-token secret must be created in gitea-runner namespace. kubectl command documented in issue. Blocked on upstream repo (#47) and Flux wiring (#2). No agent action needed. Waiting on operator.
Author
Owner

@devops/@security-reviewer — Triage 2026-06-02: Status confirmed. This issue remains open and blocked on operator or external prerequisites. No agent-actionable code changes possible this cycle. Critical path tracked in STATUS.md Current Blockers. No regressions: kustomize build flux/ = PASS.

@devops/@security-reviewer — Triage 2026-06-02: Status confirmed. This issue remains open and blocked on operator or external prerequisites. No agent-actionable code changes possible this cycle. Critical path tracked in STATUS.md Current Blockers. No regressions: `kustomize build flux/` = PASS.
Author
Owner

2026-06-04 sprint triage (@devops): No change since last triage. This is a manual operator task — waiting on operator completion of #47 (upstream repo) and Talos PR merge (#187) before Flux can activate. Instructions remain accurate in the issue body.

**2026-06-04 sprint triage (@devops):** No change since last triage. This is a manual operator task — waiting on operator completion of #47 (upstream repo) and Talos PR merge (#187) before Flux can activate. Instructions remain accurate in the issue body.
Author
Owner

Status check 2026-06-04 — @devops

Manual operator task. gitea-runner-token secret must be created in gitea-runner namespace using a Gitea Admin → Actions → Runners registration token. Blocked on Flux active (#2). No agent action.

**Status check 2026-06-04** — @devops Manual operator task. `gitea-runner-token` secret must be created in `gitea-runner` namespace using a Gitea Admin → Actions → Runners registration token. Blocked on Flux active (#2). No agent action.
Author
Owner

2026-06-05 Triage

Status: BLOCKED/PENDING (as of 2026-06-05) — No change from prior cycle. All agent-ready conditions are unmet pending operator completion of critical-path items: (1) create 0xWheatyz/api-company (#47), (2) merge upstream Talos PR #14 (#187) to activate Flux, (3) configure DNS (#33, #106, #150). See STATUS.md for full ordered blocker list. No agent action available today.

## 2026-06-05 Triage **Status: BLOCKED/PENDING** (as of 2026-06-05) — No change from prior cycle. All agent-ready conditions are unmet pending operator completion of critical-path items: (1) create `0xWheatyz/api-company` (#47), (2) merge upstream Talos PR #14 (#187) to activate Flux, (3) configure DNS (#33, #106, #150). See STATUS.md for full ordered blocker list. No agent action available today.
Author
Owner

@devops/@tech-writer status check (2026-06-05): This is a manual operator task — the agent cannot create Kubernetes secrets, Gitea Actions secrets, RapidAPI listings, DNS records, or social media posts. Issue remains open awaiting operator action. All prerequisites tracked in the issue body. No agent-side code changes required at this time.

@devops/@tech-writer status check (2026-06-05): This is a **manual operator task** — the agent cannot create Kubernetes secrets, Gitea Actions secrets, RapidAPI listings, DNS records, or social media posts. Issue remains open awaiting operator action. All prerequisites tracked in the issue body. No agent-side code changes required at this time.
Author
Owner

2026-06-05 triage — Status unchanged. This issue remains blocked on operator actions or upstream dependencies. Critical path: operator must (1) create 0xWheatyz/api-company (#47), (2) merge upstream Talos PR #14 (#187) to activate Flux, (3) configure DNS (#33/#106/#150). No agent-actionable items beyond what is already committed. kustomize build flux/ = PASS .

**2026-06-05 triage** — Status unchanged. This issue remains blocked on operator actions or upstream dependencies. Critical path: operator must (1) create `0xWheatyz/api-company` (#47), (2) merge upstream Talos PR #14 (#187) to activate Flux, (3) configure DNS (#33/#106/#150). No agent-actionable items beyond what is already committed. `kustomize build flux/` = PASS ✅.
Author
Owner

@devops triage 2026-06-06: Manual operator task — gitea-runner-token secret needed in gitea-runner namespace. Generate runner registration token from Gitea Admin → Actions → Runners → Create new Runner. Blocked on Flux activation (#218) and cluster access (#47). flux/gitea-runner/ manifests are committed.

**@devops triage 2026-06-06:** Manual operator task — `gitea-runner-token` secret needed in `gitea-runner` namespace. Generate runner registration token from Gitea Admin → Actions → Runners → Create new Runner. Blocked on Flux activation (#218) and cluster access (#47). `flux/gitea-runner/` manifests are committed.
Author
Owner

🔍 Triage review 2026-06-06 — Operator task or blocked on upstream operator actions. No agent-implementable change available this cycle. Root critical-path blocker: operator merge of 0xWheatyz/Talos PR #14 to activate Flux GitOps for api-company.

🔍 **Triage review 2026-06-06** — Operator task or blocked on upstream operator actions. No agent-implementable change available this cycle. Root critical-path blocker: operator merge of 0xWheatyz/Talos PR #14 to activate Flux GitOps for api-company.
Author
Owner

@devops — Triage 2026-06-07: Manual operator task — create gitea-runner-token secret in gitea-runner namespace to register Act Runner. Blocked on #218 (Flux active) and #47 (upstream repo). Status unchanged.

@devops — Triage 2026-06-07: Manual operator task — create `gitea-runner-token` secret in gitea-runner namespace to register Act Runner. Blocked on #218 (Flux active) and #47 (upstream repo). Status unchanged.
Author
Owner

@devops / @qa-engineer triage — 2026-06-07

Status: BLOCKED — awaiting operator action

This issue remains blocked on the same critical-path operator prerequisites:

  1. #47 — Create 0xWheatyz/api-company upstream repo (highest priority)
  2. #218 — Operator merge 0xWheatyz/Talos PR #14 to activate Flux

All agent-side implementation work for this issue is complete. No agent action possible until cluster is live.

kustomize build flux/ = PASS — no manifest regressions.

## @devops / @qa-engineer triage — 2026-06-07 **Status: BLOCKED — awaiting operator action** This issue remains blocked on the same critical-path operator prerequisites: 1. **#47** — Create `0xWheatyz/api-company` upstream repo (highest priority) 2. **#218** — Operator merge `0xWheatyz/Talos` PR #14 to activate Flux All agent-side implementation work for this issue is complete. No agent action possible until cluster is live. **`kustomize build flux/` = PASS** — no manifest regressions.
Author
Owner

@devops triage (2026-06-08 — Cycle #233): Status unchanged — still BLOCKED on operator Flux activation (issue #218 / Talos PR #14 merge) and 0xWheatyz/api-company creation (issue #47). All agent-side work complete; this is a manual operator task. kustomize build flux/ passes (no regressions). No agent action possible until cluster is reachable.

**@devops triage (2026-06-08 — Cycle #233):** Status unchanged — still BLOCKED on operator Flux activation (issue #218 / Talos PR #14 merge) and `0xWheatyz/api-company` creation (issue #47). All agent-side work complete; this is a manual operator task. `kustomize build flux/` passes (no regressions). No agent action possible until cluster is reachable.
Author
Owner

@devops / @qa-engineer triage (2026-06-08, cycle #237): This is a manual operator task — no agent-side work is possible. All manifests and code are committed. This issue remains BLOCKED awaiting the operator to complete the listed steps. Critical path: (1) create 0xWheatyz/api-company (#47), (2) merge 0xWheatyz/Talos PR #14 (#218), (3) configure DNS (#33, #106, #150). kustomize build flux/ = PASS.

@devops / @qa-engineer triage (2026-06-08, cycle #237): This is a **manual operator task** — no agent-side work is possible. All manifests and code are committed. This issue remains BLOCKED awaiting the operator to complete the listed steps. Critical path: (1) create `0xWheatyz/api-company` (#47), (2) merge `0xWheatyz/Talos` PR #14 (#218), (3) configure DNS (#33, #106, #150). `kustomize build flux/` = PASS.
Author
Owner

@devops triage 2026-06-08 (cycle #240):

Status: BLOCKED — manual operator task (P1)

Operator must:

  1. Generate a runner registration token from Gitea Admin → Actions → Runners → Create new Runner
  2. Create gitea-runner-token secret in gitea-runner namespace

HelmRelease committed at flux/gitea-runner/helmrelease.yaml. Agent cannot create Kubernetes secrets or access Gitea Admin. No agent action possible this cycle.

@devops triage 2026-06-08 (cycle #240): **Status: BLOCKED — manual operator task (P1)** Operator must: 1. Generate a runner registration token from Gitea Admin → Actions → Runners → Create new Runner 2. Create `gitea-runner-token` secret in `gitea-runner` namespace HelmRelease committed at `flux/gitea-runner/helmrelease.yaml`. Agent cannot create Kubernetes secrets or access Gitea Admin. No agent action possible this cycle.
Author
Owner

@devops review 2026-06-08 (cycle #241): Status unchanged — BLOCKED on operator actions (Talos PR #14 merge → #218, upstream repo creation → #47). kustomize build flux/ PASS. No open PRs. No agent-side work outstanding this cycle.

@devops review 2026-06-08 (cycle #241): Status unchanged — BLOCKED on operator actions (Talos PR #14 merge → #218, upstream repo creation → #47). `kustomize build flux/` ✅ PASS. No open PRs. No agent-side work outstanding this cycle.
Author
Owner

[@devops triage 2026-06-09] Blocked on #218 (Flux not yet active). Once Flux is active, operator must create gitea-runner-token secret in gitea-runner namespace. No agent action possible.

**[@devops triage 2026-06-09]** Blocked on #218 (Flux not yet active). Once Flux is active, operator must create `gitea-runner-token` secret in `gitea-runner` namespace. No agent action possible.
Author
Owner

2026-06-15 triage cycle: still blocked on operator critical path (#47, #218, #33/#106/#150). No agent-implementable work; kustomize build flux/ = PASS. Status unchanged since cycle #240.

2026-06-15 triage cycle: still blocked on operator critical path (#47, #218, #33/#106/#150). No agent-implementable work; `kustomize build flux/` = PASS. Status unchanged since cycle #240.
Author
Owner

2026-07-24 triage cycle (@devops): no change. All 37 open agent-ready issues remain blocked on operator prerequisites — upstream repo 0xWheatyz/api-company (#47) still empty (verified via API), no live-cluster kubectl/flux access from workspace, RapidAPI listing not yet submitted (#44). Nothing agent-implementable in-repo this cycle. Re-triage next cycle.

2026-07-24 triage cycle (@devops): no change. All 37 open agent-ready issues remain blocked on operator prerequisites — upstream repo 0xWheatyz/api-company (#47) still empty (verified via API), no live-cluster kubectl/flux access from workspace, RapidAPI listing not yet submitted (#44). Nothing agent-implementable in-repo this cycle. Re-triage next cycle.
Author
Owner

Manager cycle triage (2026-07-24): still blocked — this is a manual operator task (or requires live Flux cluster). No agent-side action possible until the prerequisite is satisfied. Marking as reviewed; will re-check next cycle.

Manager cycle triage (2026-07-24): still blocked — this is a manual operator task (or requires live Flux cluster). No agent-side action possible until the prerequisite is satisfied. Marking as reviewed; will re-check next cycle.
Author
Owner

Triage 2026-07-27 (@devops): still blocked on operator prerequisite. No agent-actionable change possible until the manual step is completed. Re-checked; no state change.

Triage 2026-07-27 (@devops): still blocked on operator prerequisite. No agent-actionable change possible until the manual step is completed. Re-checked; no state change.
Sign in to join this conversation.
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: leeworks-agents/api-company#77