gitlab-runner

Helm chart

Last changed

Request a free trial

Contact our team to test out this Helm chart and related images for free. Please also indicate any other images you would like to evaluate.

Tag:

Compare:

## Configure namespace where the GitLab Runner deployment will be created

## By default, the runner deployment uses the Release namespace (.Release.Namespace)

## Set this value to override and deploy the runner in a different namespace

## This allows separation between runner management (this namespace) and job execution (runners.jobNamespace)

## Example: Deploy runner in "ops" namespace while jobs run in "gitlab" namespace

# namespace: ""

## GitLab Runner Image

## By default it's using registry.gitlab.com/gitlab-org/gitlab-runner:alpine-v{VERSION}

## where {VERSION} is taken from Chart.yaml from appVersion field

## ref: https://gitlab.com/gitlab-org/gitlab-runner/container_registry/29383?orderBy=NAME&sort=asc&search[]=alpine-v&search[]=

## Note: If you change the image to the ubuntu release

## don't forget to change the securityContext;

## these images run on different user IDs.

image:

registry: cgr.dev

image: scratch-images/test-tmp/gitlab-runner

# tag: alpine-v{{.Chart.AppVersion}}

tag: 19.3.1-r3@sha256:1aec2132115838609742394be8199907e43bd23b7b6de1c089cd56d24bc0688c

## When using GitLab Runner Helm Chart with gitlab-runner-ubi-images (https://gitlab.com/gitlab-org/ci-cd/gitlab-runner-ubi-images/container_registry)

## the installation fails because `dumb-init` is not packaged in the image. However, `tini` is present.

## This configuration will allow gitlab-runner-ubi-images users to explicitly enable the use of `tini` instead of `dumb-init`

useTini: false

## Specify a imagePullPolicy for the main runner deployment

## 'Always' if imageTag is 'latest', else set to 'IfNotPresent'

## Note: it does not apply to job containers launched by this executor.

## Use `pull_policy` in [runners.kubernetes] to change it.

## ref: https://kubernetes.io/docs/concepts/containers/images/#pre-pulled-images

imagePullPolicy: IfNotPresent

## Specifying ImagePullSecrets on a Pod

## Kubernetes supports specifying container image registry keys on a Pod.

## ref: https://kubernetes.io/docs/concepts/containers/images/#specifying-imagepullsecrets-on-a-pod

# imagePullSecrets:

# - name: "image-pull-secret"

## Timeout, in seconds, for liveness and readiness probes of a runner pod.

# probeTimeoutSeconds: 4

## Configure the livenessProbe

livenessProbe: {}

# initialDelaySeconds: 60

# periodSeconds: 60

# successThreshold: 1

# failureThreshold: 3

# terminationGracePeriodSeconds: 30

## Configure the readinessProbe

readinessProbe: {}

# initialDelaySeconds: 60

# periodSeconds: 60

# successThreshold: 1

# failureThreshold: 3

## Configure an optional startupProbe.

## Useful when the runner does work at boot (e.g. a deeper health check that

## dispatches a synthetic job) that should complete before the pod accepts

## traffic. While the startupProbe is running, kubelet does not run the

## liveness or readiness probes, so during a rolling update the new pod

## stays NotReady — and the old pod isn't terminated — until startupProbe

## passes. Specify the full Kubernetes probe spec.

## The example below uses the built-in `/health/ready` endpoint available

## since GitLab Runner 19.2, which gates readiness on the boot-time canary

## (opt in per runner via `[runners.experimental.boot_verify]` in the runner

## configuration; experimental). It is served by the

## metrics/debug server, so `metrics.enabled` must be set to `true` and the

## probe port must match `metrics.port`. You can also point the probe at any

## endpoint you provide yourself.

# startupProbe:

# httpGet:

# path: /health/ready

# port: 9252

# periodSeconds: 10

# failureThreshold: 30

startupProbe: {}

## How many runner pods to launch.

# replicas: 1

## How many old ReplicaSets for this Deployment you want to retain

# revisionHistoryLimit: 10

## The GitLab Server URL (with protocol) that want to register the runner against

## ref: https://docs.gitlab.com/runner/commands/index.html#gitlab-runner-register

# gitlabUrl: https://gitlab.your-domain.com/

100

## The Runner Token for adding new Runners to the GitLab Server. This must

101

## be retrieved from your GitLab instance. It is the token of an already registered runner.

102

## ref: (we don't have docs for that yet, but we want to use an existing token)

103

104

# runnerToken: ""

105

106

107

## Unregister all runners before termination

108

109

## Updating the runner's chart version or configuration will cause the runner container

110

## to be terminated and created again. This may cause your Gitlab instance to reference

111

## non-existant runners. Un-registering the runner before termination mitigates this issue.

112

## ref: https://docs.gitlab.com/runner/commands/index.html#gitlab-runner-unregister

113

114

## This property ensures that all the Runners present in the local config.toml are unregistered when the chart is uninstalled

115

## - If the token is prefixed with `glrt-` (meaning the runner was created in the UI or API),

116

## the unregisterRunners property deletes the runner manager, not the runner.

117

## The runner manager is identified by the runner and the machine that contains the config.toml.

118

unregisterRunners: true

119

## When stopping the runner, give it time to wait for its jobs to terminate.

120

121

## Updating the runner's chart version or configuration will cause the runner container

122

## to be terminated with a graceful stop request. terminationGracePeriodSeconds

123

## instructs Kubernetes to wait long enough for the runner pod to terminate gracefully.

124

## ref: https://docs.gitlab.com/runner/commands/#signals

125

terminationGracePeriodSeconds: 3600

126

## Set the certsSecretName in order to pass custom certficates for GitLab Runner to use.

127

## Provide resource name for a Kubernetes Secret Object in the same namespace,

128

## this is used to populate the /home/gitlab-runner/.gitlab-runner/certs/ directory

129

## ref: https://docs.gitlab.com/runner/configuration/tls-self-signed.html#supported-options-for-self-signed-certificates-targeting-the-gitlab-server

130

131

# certsSecretName:

132

133

## Configure the maximum number of concurrent jobs

134

## ref: https://docs.gitlab.com/runner/configuration/advanced-configuration.html#the-global-section

135

136

concurrent: 10

137

## Number of seconds until the forceful shutdown operation times out and exits the process.

138

## ref: https://docs.gitlab.com/runner/configuration/advanced-configuration.html#the-global-section

139

140

shutdown_timeout: 0

141

## Defines in seconds how often to check GitLab for new builds

142

## ref: https://docs.gitlab.com/runner/configuration/advanced-configuration.html#the-global-section

143

144

checkInterval: 3

145

## Configure GitLab Runner's logging level. Available values are: debug, info, warn, error, fatal, panic

146

## ref: https://docs.gitlab.com/runner/configuration/advanced-configuration.html#the-global-section

147

148

# logLevel:

149

150

## Configure GitLab Runner's logging format. Available values are: runner, text, json

151

## ref: https://docs.gitlab.com/runner/configuration/advanced-configuration.html#the-global-section

152

153

# logFormat:

154

155

## Configure GitLab Runner's Sentry DSN.

156

## ref https://docs.gitlab.com/runner/configuration/advanced-configuration.html#the-global-section

157

158

# sentryDsn:

159

160

## Configure GitLab Runner's maximum connection age for TLS keepalive connections.

161

## ref https://docs.gitlab.com/runner/configuration/advanced-configuration.html#the-global-section

162

163

# connectionMaxAge: "15m"

164

165

## A custom bash script that will be executed prior to the invocation of the

166

## gitlab-runner process

167

168

#preEntrypointScript: |

169

# echo "hello"

170

171

## Specify whether the runner should start the session server.

172

## Defaults to false

173

## ref:

174

175

## When sessionServer is enabled, the user can either provide a public publicIP

176

## or rely on the external IP auto discovery.

177

## When a serviceAccountName is used with the automounting to the pod disabled,

178

## we recommend the usage of the publicIP

179

sessionServer:

180

enabled: false

181

# annotations: {}

182

# timeout: 1800

183

# internalPort: 8093

184

# externalPort: 9000

185

186

#In case sessionServer.serviceType is NodePort. If not defined, auto NodePort will be assigned.

187

# nodePort: 30093

188

189

# publicIP: ""

190

# loadBalancerSourceRanges:

191

# - 1.2.3.4/32

192

193

#Valid values: ClusterIP, Headless, NodePort, LoadBalancer

194

serviceType: LoadBalancer

195

## Specify the services external traffic policy

196

197

## ref: https://kubernetes.io/docs/concepts/services-networking/service/#traffic-policies

198

199

# externalTrafficPolicy:

200

201

## Specify the services internal traffic policy

202

203

## ref: https://kubernetes.io/docs/concepts/services-networking/service/#traffic-policies

204

205

# internalTrafficPolicy:

206

207

# if enabled, sessionServer.publicIP variable should be set to the host e.g. runner1.example.com

208

ingress:

209

enabled: false

210

className: ""

211

annotations: {}

212

tls:

213

- secretName: gitlab-runner-session-server

214

## For RBAC support:

215

rbac:

216

## Specifies whether a Role and RoleBinding should be created

217

## If this value is set to `true`, `serviceAccount.create` should also be set to either `true` or `false`

218

219

create: false

220

## Define the generated serviceAccountName when create is set to true

221

## It defaults to "gitlab-runner.fullname" if not provided

222

## DEPRECATED: Please use `serviceAccount.name` instead

223

generatedServiceAccountName: ""

224

## Define list of rules to be added to the rbac role permissions.

225

## Each rule supports the keys:

226

## - apiGroups: default "" (indicates the core API group) if missing or empty.

227

## - resources: default "*" if missing or empty.

228

## - verbs: default "*" if missing or empty.

229

230

## Read more about the recommended rules on the following link

231

232

## ref: https://docs.gitlab.com/runner/executors/kubernetes/index.html#configure-runner-api-permissions

233

234

rules: []

235

# - resources: ["events"]

236

# verbs: ["list", "watch"]

237

# - resources: ["namespaces"]

238

# verbs: ["create", "delete"]

239

# - resources: ["pods"]

240

# verbs: ["create","delete","get"]

241

# - apiGroups: [""]

242

# resources: ["pods/attach","pods/exec"]

243

# verbs: ["get","create","patch","delete"]

244

# - apiGroups: [""]

245

# resources: ["pods/log"]

246

# verbs: ["get","list"]

247

# - resources: ["secrets"]

248

# verbs: ["create","delete","get","update"]

249

# - resources: ["serviceaccounts"]

250

# verbs: ["get"]

251

# - resources: ["services"]

252

# verbs: ["create","get"]

253

254

## Run the gitlab-bastion container with the ability to deploy/manage containers of jobs

255

## cluster-wide or only within namespace

256

clusterWideAccess: false

257

## Use the following Kubernetes Service Account name if RBAC is disabled in this Helm chart (see rbac.create)

258

## DEPRECATED: Please use `serviceAccount.name` instead

259

260

# serviceAccountName: default

261

262

## Specify annotations for Service Accounts, useful for annotations such as eks.amazonaws.com/role-arn.

263

## Values may refer to other values as the _tpl_ function is implicitly applied. Mind the quotes when using this, e.g.

264

## serviceAccountAnnotations:

265

## eks.amazonaws.com/role-arn: "arn:aws:iam::{{ .Values.global.accountId }}:role/{{ .Values.global.iamRoleName }}"

266

267

## ref: https://docs.aws.amazon.com/eks/latest/userguide/associate-service-account-role.html

268

269

## DEPRECATED: Please use `serviceAccount.annotations` instead

270

271

serviceAccountAnnotations: {}

272

## Use podSecurity Policy

273

## ref: https://kubernetes.io/docs/concepts/policy/pod-security-policy/

274

podSecurityPolicy:

275

enabled: false

276

resourceNames:

277

- gitlab-runner

278

## Specify one or more imagePullSecrets used for pulling the runner image

279

280

## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#add-imagepullsecrets-to-a-service-account

281

282

## DEPRECATED: Please use `serviceAccount.imagePullSecrets` instead

283

284

imagePullSecrets: []

285

## Configure ServiceAccount

286

287

serviceAccount:

288

## Specifies whether a ServiceAccount should be created

289

290

## TODO: Set default to `false`

291

# create: false

292

## The name of the ServiceAccount to use.

293

## If not set and create is `true`, a name is generated using the `gitlab-runner.fullname`` template

294

295

name: ""

296

## Additional custom annotations for the ServiceAccount, useful for annotations such as eks.amazonaws.com/role-arn.

297

## Values may refer other values as the _tpl_ function is implicitly applied. Mind the quotes when using this, e.g.

298

## serviceAccountAnnotations:

299

## eks.amazonaws.com/role-arn: "arn:aws:iam::{{ .Values.global.accountId }}:role/{{ .Values.global.iamRoleName }}"

300

301

## ref: https://docs.aws.amazon.com/eks/latest/userguide/specify-service-account-role.html

302

303

annotations: {}

304

## Specify one or more imagePullSecrets used for pulling the runner image

305

306

## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#add-imagepullsecrets-to-a-service-account

307

308

imagePullSecrets: []

309

## Configure integrated Prometheus metrics exporter

310

311

## ref: https://docs.gitlab.com/runner/monitoring/#configuration-of-the-metrics-http-server

312

313

metrics:

314

enabled: false

315

## Define a name for the metrics port

316

317

portName: metrics

318

## Provide a port number for the integrated Prometheus metrics exporter

319

320

port: 9252

321

## Configure a prometheus-operator serviceMonitor to allow autodetection of

322

## the scraping target. Requires enabling the service resource below.

323

324

## DEPRECATED: Use podMonitor instead. ServiceMonitor requires a Service and

325

## cannot collect metrics during graceful shutdown when pods are marked NotReady.

326

327

serviceMonitor:

328

enabled: false

329

## Namespace where ServiceMonitor should be installed. Defaults to the

330

## same namespace where the release will be installed.

331

332

namespace: ""

333

## Provide additional labels to the service monitor resource

334

335

## labels: {}

336

## Provide annotations to the service monitor ressource

337

338

## annotations: {}

339

340

## Define a scrape interval (otherwise prometheus default is used)

341

342

## ref: https://prometheus.io/docs/prometheus/latest/configuration/configuration/#scrape_config

343

344

# interval: ""

345

346

## Specify the scrape protocol scheme e.g., https or http

347

348

# scheme: "http"

349

350

## Supply a tls configuration for the service monitor

351

352

## ref: https://github.com/prometheus-community/helm-charts/blob/main/charts/kube-prometheus-stack/charts/crds/crds/crd-servicemonitors.yaml

353

354

# tlsConfig: {}

355

356

## The URI path where prometheus metrics can be scraped from

357

358

# path: "/metrics"

359

360

## A list of MetricRelabelConfigs to apply to samples before ingestion

361

362

## ref: https://prometheus.io/docs/prometheus/latest/configuration/configuration/#metric_relabel_configs

363

364

# metricRelabelings: []

365

366

## A list of RelabelConfigs to apply to samples before scraping

367

368

## ref: https://prometheus.io/docs/prometheus/latest/configuration/configuration/#relabel_config

369

370

## relabelings: []

371

372

## Configure a prometheus-operator podMonitor to scrape metrics directly from pods.

373

374

## RECOMMENDED: PodMonitor is the preferred method for collecting metrics as it:

375

## - Scrapes metrics directly from pods without requiring a Service

376

## - Continues to collect metrics during graceful shutdown when pods are marked NotReady

377

## - Provides better visibility into shutdown metrics and termination behavior

378

379

podMonitor:

380

enabled: false

381

## Namespace where PodMonitor should be installed. Defaults to the

382

## same namespace where the release will be installed.

383

384

namespace: ""

385

## Provide additional labels to the pod monitor resource

386

387

## labels: {}

388

## Provide annotations to the pod monitor resource

389

390

## annotations: {}

391

392

## Define a scrape interval (otherwise prometheus default is used)

393

394

## ref: https://prometheus.io/docs/prometheus/latest/configuration/configuration/#scrape_config

395

396

# interval: ""

397

398

## Specify the scrape protocol scheme e.g., https or http

399

400

# scheme: "http"

401

402

## Supply a tls configuration for the pod monitor

403

404

## ref: https://github.com/prometheus-community/helm-charts/blob/main/charts/kube-prometheus-stack/charts/crds/crds/crd-podmonitors.yaml

405

406

# tlsConfig: {}

407

408

## The URI path where prometheus metrics can be scraped from

409

410

# path: "/metrics"

411

412

## A list of MetricRelabelConfigs to apply to samples before ingestion

413

414

## ref: https://prometheus.io/docs/prometheus/latest/configuration/configuration/#metric_relabel_configs

415

416

# metricRelabelings: []

417

418

## A list of RelabelConfigs to apply to samples before scraping

419

420

## ref: https://prometheus.io/docs/prometheus/latest/configuration/configuration/#relabel_config

421

422

## relabelings: []

423

424

## Configure a service resource (optional, only needed if using the deprecated

425

## ServiceMonitor instead of the recommended PodMonitor)

426

service:

427

enabled: false

428

## Provide additonal labels for the service

429

430

# labels: {}

431

432

## Provide additonal annotations for the service

433

434

# annotations: {}

435

436

## Define a specific ClusterIP if you do not want a dynamic one

437

438

## ref: https://kubernetes.io/docs/concepts/services-networking/service/#choosing-your-own-ip-address

439

440

# clusterIP: ""

441

442

## Define a list of one or more external IPs for this service

443

444

## ref: https://kubernetes.io/docs/concepts/services-networking/service/#external-ips

445

446

# externalIPs: []

447

448

## Provide a specific loadbalancerIP e.g., of an external Loadbalancer

449

450

## ref: https://kubernetes.io/docs/concepts/services-networking/service/#loadbalancer

451

452

# loadBalancerIP: ""

453

454

## Provide a list of source IP ranges to have access to this service

455

456

## ref: https://kubernetes.io/docs/concepts/services-networking/service/#aws-nlb-support

457

458

# loadBalancerSourceRanges: []

459

460

## Specify the service type e.g., ClusterIP, NodePort, LoadBalancer or ExternalName

461

462

## ref: https://kubernetes.io/docs/concepts/services-networking/service/#publishing-services-service-types

463

464

type: ClusterIP

465

## Specify the services metrics nodeport if you use a service of type nodePort

466

467

# metrics:

468

## Specify the node port under which the prometheus metrics of the runner are made

469

## available.

470

471

## ref: https://kubernetes.io/docs/concepts/services-networking/service/#nodeport

472

473

# nodePort: ""

474

475

## Provide a list of additional ports to be exposed by this service

476

477

## ref: https://kubernetes.io/docs/concepts/services-networking/service/#defining-a-service

478

479

# additionalPorts: []

480

481

## Specify the services external traffic policy

482

483

## ref: https://kubernetes.io/docs/concepts/services-networking/service/#traffic-policies

484

485

# externalTrafficPolicy:

486

487

## Specify the services internal traffic policy

488

489

## ref: https://kubernetes.io/docs/concepts/services-networking/service/#traffic-policies

490

491

# internalTrafficPolicy:

492

493

## Configuration for the Pods that the runner launches for each new job

494

495

runners:

496

## Configure namespace where GitLab Runner job pods will be created

497

## By default, job pods use the Release namespace (.Release.Namespace)

498

## Set this value to run jobs in a different namespace than the runner deployment

499

## This enables separation between runner management and job execution

500

501

## Example: Runner in "ops" namespace, jobs in "gitlab" namespace

502

# jobNamespace: ""

503

504

# runner configuration, where the multi line string is evaluated as a

505

# template so you can specify helm values inside of it.

506

507

# tpl: https://helm.sh/docs/howto/charts_tips_and_tricks/#using-the-tpl-function

508

# runner configuration: https://docs.gitlab.com/runner/configuration/advanced-configuration.html

509

config: |

510

[[runners]]

511

[runners.kubernetes]

512

namespace = "{{ default .Release.Namespace .Values.runners.jobNamespace }}"

513

image = "alpine"

514

## Absolute path for an existing runner configuration file

515

## Can be used alongside "volumes" and "volumeMounts" to use an external config file

516

## Active if runners.config is empty or null

517

configPath: ""

518

## When set, written verbatim as the runner's config.toml and `gitlab-runner

519

## register` is skipped on boot. The supplied TOML is passed through `tpl`,

520

## so Helm values can be interpolated as usual.

521

522

## configOverride must be a COMPLETE config.toml: it replaces the rendered

523

## config in its entirety, so the following chart values have NO effect and

524

## must be expressed directly in the TOML (or omitted):

525

526

## - concurrent, checkInterval, shutdown_timeout, logLevel, logFormat,

527

## sentryDsn, connectionMaxAge

528

## - metrics.enabled / metrics.port (set `listen_address = ":<port>"`)

529

## - sessionServer.* (write [session_server] directly; placeholder

530

## substitution is also skipped)

531

## - runners.config, runners.configPath

532

## - runners.name, runners.tags, runners.locked, runners.protected,

533

## runners.runUntagged, runners.maximumTimeout, runners.executor,

534

## runners.jobNamespace

535

## - gitlabUrl (set `url = "..."` under [[runners]])

536

## - runnerRegistrationToken / runnerToken (the token lives in the TOML or

537

## is injected via extraEnv / extraEnvFromRefs / secrets)

538

539

## Pod-level values (extraEnv, secrets, certsSecretName, volumes, RBAC,

540

## metrics Service/PodMonitor, ...) are unaffected.

541

542

## On boot the entrypoint runs `gitlab-runner verify --url=` so an invalid

543

## token fails loudly instead of producing a runner that never picks up jobs.

544

545

# configOverride: |

546

# concurrent = 10

547

# check_interval = 3

548

# log_level = "info"

549

550

# [[runners]]

551

# name = "my-runner"

552

# url = "https://gitlab.example.com/"

553

# token = "glrt-xxxxxxxxxxxxxxxxxxxx"

554

# executor = "kubernetes"

555

# [runners.kubernetes]

556

# namespace = "gitlab-runner"

557

# image = "alpine"

558

559

## Which executor should be used

560

561

# executor: kubernetes

562

563

## Specify the name for the runner.

564

565

# name: ""

566

567

## The name of the secret containing runner-token and runner-registration-token

568

# secret: gitlab-runner

569

570

## Distributed runners caching

571

## ref: https://docs.gitlab.com/runner/configuration/autoscale.html#distributed-runners-caching

572

573

## If you want to use s3 based distributing caching:

574

## First of all you need to uncomment General settings and S3 settings sections.

575

576

## Create a secret 's3access' containing 'accesskey' & 'secretkey'

577

## ref: https://aws.amazon.com/blogs/security/wheres-my-secret-access-key/

578

579

## $ kubectl create secret generic s3access \

580

## --from-literal=accesskey="YourAccessKey" \

581

## --from-literal=secretkey="YourSecretKey"

582

## ref: https://kubernetes.io/docs/concepts/configuration/secret/

583

584

## If you want to use gcs based distributing caching:

585

## First of all you need to uncomment General settings and GCS settings sections.

586

587

## Access using credentials file:

588

## Create a secret 'google-application-credentials' containing your application credentials file.

589

## ref: https://docs.gitlab.com/runner/configuration/advanced-configuration.html#the-runnerscachegcs-section

590

## You could configure

591

## $ kubectl create secret generic google-application-credentials \

592

## --from-file=gcs-application-credentials-file=./path-to-your-google-application-credentials-file.json

593

## ref: https://kubernetes.io/docs/concepts/configuration/secret/

594

595

## Access using access-id and private-key:

596

## Create a secret 'gcsaccess' containing 'gcs-access-id' & 'gcs-private-key'.

597

## ref: https://docs.gitlab.com/runner/configuration/advanced-configuration.html#the-runnerscachegcs-section

598

## You could configure

599

## $ kubectl create secret generic gcsaccess \

600

## --from-literal=gcs-access-id="YourAccessID" \

601

## --from-literal=gcs-private-key="YourPrivateKey"

602

## ref: https://kubernetes.io/docs/concepts/configuration/secret/

603

604

## If you want to use Azure-based distributed caching:

605

## First, uncomment General settings.

606

607

## Create a secret 'azureaccess' containing 'azure-account-name' & 'azure-account-key'

608

## ref: https://docs.microsoft.com/en-us/azure/storage/blobs/storage-blobs-introduction

609

610

## $ kubectl create secret generic azureaccess \

611

## --from-literal=azure-account-name="YourAccountName" \

612

## --from-literal=azure-account-key="YourAccountKey"

613

## ref: https://kubernetes.io/docs/concepts/configuration/secret/

614

cache: {}

615

## S3 the name of the secret.

616

# secretName: s3access

617

## Use this line for access using gcs-access-id and gcs-private-key

618

# secretName: gcsaccess

619

## Use this line for access using google-application-credentials file

620

# secretName: google-application-credentials

621

## Use this line for access using Azure with azure-account-name and azure-account-key

622

# secretName: azureaccess

623

624

## When using cloud-native auth (e.g. Workload Identity) with the docker+machine

625

## executor, set this to true to prevent the chart's entrypoint from globally

626

## exporting cache credential env vars (CACHE_S3_*, GOOGLE_APPLICATION_CREDENTIALS,

627

## CACHE_GCS_*, CACHE_AZURE_*). This allows subprocesses (e.g. docker-machine)

628

## to use their own identity instead of inheriting the cache credentials.

629

630

## When this flag is set to true, you MUST configure cache credentials explicitly

631

## in runners.config under [runners.cache.*], for example:

632

## [runners.cache.gcs]

633

## CredentialsFile = "/secrets/gcs-application-credentials-file"

634

## BucketName = "my-cache-bucket"

635

## Otherwise the runner will not be able to access the cache.

636

637

## ref: https://gitlab.com/gitlab-com/gl-infra/production-engineering/-/work_items/28874

638

# disableGlobalCredentialsExport: false

639

## Specify the name of the scheduler which is used to schedule runner pods.

640

## Kubernetes supports multiple scheduler configurations.

641

## ref: https://kubernetes.io/docs/reference/scheduling

642

# schedulerName: "my-custom-scheduler"

643

644

## Configure securitycontext for the main container

645

## ref: https://kubernetes.io/docs/concepts/security/pod-security-standards/

646

647

securityContext:

648

allowPrivilegeEscalation: false

649

readOnlyRootFilesystem: false

650

runAsNonRoot: true

651

privileged: false

652

capabilities:

653

drop: ["ALL"]

654

## Configure update strategy for multi-replica deployments

655

## Kubernetes supports types Recreate, and RollingUpdate

656

## ref: https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#strategy

657

658

strategy: {}

659

# rollingUpdate:

660

# maxSurge: 1

661

# maxUnavailable: 0

662

# type: RollingUpdate

663

664

## Configure securitycontext valid for the whole pod

665

## ref: https://kubernetes.io/docs/concepts/security/pod-security-standards/

666

667

podSecurityContext:

668

runAsUser: 100

669

# runAsGroup: 65533

670

fsGroup: 65533

671

# supplementalGroups: [65533]

672

## Note: values for the ubuntu image:

673

# runAsUser: 999

674

# fsGroup: 999

675

676

## Configure resource requests and limits

677

## ref: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/

678

679

resources: {}

680

# limits:

681

# memory: 256Mi

682

# cpu: 200m

683

# ephemeral-storage: 512Mi

684

# requests:

685

# memory: 128Mi

686

# cpu: 100m

687

# ephemeral-storage: 256Mi

688

689

## Affinity for pod assignment

690

## ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity

691

692

affinity: {}

693

## TopologySpreadConstraints for pod assignment

694

## Ref: https://kubernetes.io/docs/concepts/scheduling-eviction/topology-spread-constraints/

695

696

topologySpreadConstraints: {}

697

# Example: The gitlab runner should be evenly spread across zones

698

# - maxSkew: 1

699

# topologyKey: zone

700

# whenUnsatisfiable: DoNotSchedule

701

# labelSelector:

702

# matchLabels:

703

# foo: bar

704

705

## RuntimeClass name for pod assignment

706

## ref: https://kubernetes.io/docs/concepts/containers/runtime-class/

707

708

runtimeClassName: ""

709

# Example: Once RuntimeClasses are configured for the cluster, you can specify it.

710

# runtimeClassName: myclass

711

712

## Node labels for pod assignment

713

## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/

714

715

nodeSelector: {}

716

# Example: The gitlab runner manager should not run on spot instances so you can assign

717

# them to the regular worker nodes only.

718

# node-role.kubernetes.io/worker: "true"

719

720

## List of node taints to tolerate (requires Kubernetes >= 1.6)

721

## ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/

722

723

tolerations: []

724

# Example: Regular worker nodes may have a taint, thus you need to tolerate the taint

725

# when you assign the gitlab runner manager with nodeSelector or affinity to the nodes.

726

# - key: "node-role.kubernetes.io/worker"

727

# operator: "Exists"

728

729

## Configure environment variables that will be present when the registration command runs

730

## This provides further control over the registration process and the config.toml file

731

## ref: `gitlab-runner register --help`

732

## ref: https://docs.gitlab.com/runner/configuration/advanced-configuration.html

733

734

# envVars:

735

# - name: RUNNER_EXECUTOR

736

# value: kubernetes

737

738

## Additional environment variables from key-value pairs.

739

extraEnv: {}

740

# CACHE_S3_SERVER_ADDRESS: s3.amazonaws.com

741

# CACHE_S3_BUCKET_NAME: runners-cache

742

# CACHE_S3_BUCKET_LOCATION: us-east-1

743

# CACHE_SHARED: true

744

745

## Additional environment variables from other data sources

746

extraEnvFrom: {}

747

# CACHE_S3_ACCESS_KEY:

748

# secretKeyRef:

749

# name: s3access

750

# key: accesskey

751

# CACHE_S3_SECRET_KEY:

752

# secretKeyRef:

753

# name: s3access

754

# key: secretkey

755

756

## Additional environment variables refs

757

extraEnvFromRefs: []

758

# - secretRef:

759

# name: gitlab-runner-cache-config

760

761

## list of hosts and IPs that will be injected into the pod's hosts file

762

hostAliases: []

763

# Example:

764

# - ip: "127.0.0.1"

765

# hostnames:

766

# - "foo.local"

767

# - "bar.local"

768

# - ip: "10.1.2.3"

769

# hostnames:

770

# - "foo.remote"

771

# - "bar.remote"

772

773

## Annotations to be added to deployment

774

775

deploymentAnnotations: {}

776

# Example:

777

# downscaler/uptime: <my_uptime_period>

778

779

## Labels to be added to deployment

780

781

deploymentLabels: {}

782

# Example:

783

# owner.team: <my_cool_team>

784

# owner.team: "{{ .Values.team }}"

785

# tags.{{ .Values.tag }}/env: "{{ .Values.environment }}"

786

787

## Init containers to be added to deployment

788

789

deploymentInitContainers: []

790

# Example

791

# - name: init-container

792

# image: busybox:latest

793

# command: ['sh', '-c', 'sleep 5']

794

795

## Lifecycle options to be added to deployment

796

797

deploymentLifecycle: {}

798

# Example

799

# preStop:

800

# exec:

801

# command: ["/bin/sh", "-c", "echo 'shutting down'"]

802

803

## Set hostname for runner pods

804

#hostname: my-gitlab-runner

805

806

## Annotations to be added to manager pod

807

808

podAnnotations: {}

809

# Example:

810

# iam.amazonaws.com/role: <my_role_arn>

811

812

## Labels to be added to manager pod

813

814

## Supports templating

815

podLabels: {}

816

# Example:

817

# owner.team: <my_cool_team>

818

# owner.team: "{{ .Values.team }}"

819

# tags.{{ .Values.tag }}/env: "{{ .Values.environment }}"

820

821

## PodDisruptionBudget for the runner manager Deployment. Only meaningful

822

## with multiple manager replicas.

823

## ref: https://kubernetes.io/docs/tasks/run-application/configure-pdb/

824

825

# podDisruptionBudget: {}

826

# maxUnavailable: 1

827

828

## HPA support for custom metrics:

829

## This section enables runners to autoscale based on defined custom metrics.

830

## In order to use this functionality, you need to enable a custom metrics API server by

831

## implementing "custom.metrics.k8s.io" using supported third party adapter

832

## Example: https://github.com/directxman12/k8s-prometheus-adapter

833

834

# hpa: {}

835

# minReplicas: 1

836

# maxReplicas: 10

837

# metrics:

838

# - type: Pods

839

# pods:

840

# metricName: gitlab_runner_jobs

841

# targetAverageValue: 400m

842

843

## Configure priorityClassName for manager pod. See k8s docs for more info on how pod priority works:

844

## https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/

845

priorityClassName: ""

846

## Secrets to be additionally mounted to the containers.

847

## All secrets are mounted through init-runner-secrets volume

848

## and placed as readonly at /init-secrets in the init container

849

## and finally copied to an in-memory volume runner-secrets that is

850

## mounted at /secrets.

851

secrets: []

852

# Example:

853

# - name: my-secret

854

# - name: myOtherSecret

855

# items:

856

# - key: key_one

857

# path: path_one

858

859

## Boolean to turn off the automountServiceAccountToken in the deployment

860

## ref: https://kubernetes.io/docs/reference/access-authn-authz/service-accounts-admin/#bound-service-account-token-volume

861

862

# automountServiceAccountToken: false

863

864

## Additional config files to mount in the containers in `/configmaps`.

865

866

## Please note that a number of keys are reserved by the runner.

867

## See https://gitlab.com/gitlab-org/charts/gitlab-runner/-/blob/main/templates/configmap.yaml

868

## for a current list.

869

configMaps: {}

870

## Labels to be added to configMaps

871

872

## Supports templating

873

configMapLabels: {}

874

# Example:

875

# owner.team: <my_cool_team>

876

# owner.team: "{{ .Values.team }}"

877

# tags.{{ .Values.tag }}/env: "{{ .Values.environment }}"

878

879

## Additional volumeMounts to add to the runner container

880

881

volumeMounts: []

882

# Example:

883

# - name: my-volume

884

# mountPath: /mount/path

885

886

## Additional volumes to add to the runner deployment

887

888

volumes: []

889

# Example:

890

# - name: my-volume

891

# persistentVolumeClaim:

892

# claimName: my-pvc

893

894

## Array of extra K8s manifests to deploy

895

896

extraObjects: []

897

# - apiVersion: external-secrets.io/v1

898

# kind: ExternalSecret

899

# metadata:

900

# name: '{{ include "gitlab-runner.secret" . }}'

901

# spec:

902

# refreshInterval: 1h

903

# secretStoreRef:

904

# kind: SecretStore

905

# name: my-secret-store

906

# target:

907

# template:

908

# data:

909

# runner-registration-token: "" # need to leave as an empty string for compatibility reasons

910

# runner-token: "{{`{{ .runnerToken }}`}}"

911

# dataFrom:

912

# - extract:

913

# key: my-secret-store-secret

914

915

## Add additional containers to the Pod, e.g. to run as sidecars.

916

917

## Example:

918

# - name: docker

919

# image: docker:20.10-dind

920

# securityContext:

921

# privileged: true

922

# volumeMounts:

923

# - mountPath: /var/run/

924

# name: dind-socket

925

# lifecycle:

926

# postStart:

927

# exec:

928

# command: [ "sh", "-c", "until docker info; do sleep 1; done;" ]

929

extraContainers: []

930

The trusted source for open source

Talk to an expert

Privacy

Terms

© 2026 Chainguard, Inc. All Rights Reserved.
Chainguard® and the Chainguard logo are registered trademarks of Chainguard, Inc. in the United States and/or other countries.
The other respective trademarks mentioned on this page are owned by the respective companies and use of them does not imply any affiliation or endorsement.

gitlab-runner

The trusted source for open source

Product

Solutions

Customers

Resources

Company