githubConfigUrl: https://github.com/alexcodeplace/overdeck
githubConfigSecret: arc-github-config
runnerScaleSetName: arc-k3s
minRunners: 0
maxRunners: 1

listenerTemplate:
  spec:
    containers:
      - name: listener
        resources:
          requests:
            cpu: 50m
            memory: 128Mi
          limits:
            cpu: 500m
            memory: 512Mi
        securityContext:
          allowPrivilegeEscalation: false
          capabilities:
            drop: ["ALL"]

# One pod at a time owns the local-path RWO content cache. Workspaces remain
# per-pod emptyDir state and are never shared between jobs.
template:
  metadata:
    labels:
      app.kubernetes.io/name: arc-runner
  spec:
    serviceAccountName: arc-runner
    automountServiceAccountToken: false
    securityContext:
      runAsNonRoot: true
      runAsUser: 1001
      runAsGroup: 1001
      fsGroup: 1001
      seccompProfile:
        type: RuntimeDefault
    containers:
      - name: runner
        # Built by image/build.sh from a digest-pinned base and side-loaded into
        # every node's containerd by image/distribute.sh. The cluster has no
        # container registry, so this tag is an identifier, not a pullable
        # reference -- `Never` makes that explicit and fails fast on a node that
        # was never loaded instead of retrying a pull that can never succeed.
        image: localhost/overdeck-ci-runner:arc-pr-gate-v1
        imagePullPolicy: Never
        command: ["/home/runner/run.sh"]
        env:
          - name: PNPM_STORE_DIR
            value: /cache/pnpm/store
          - name: VENV_ARCHIVE_DIR
            value: /cache/venv-archives
        resources:
          requests:
            cpu: "1"
            memory: 2Gi
          limits:
            cpu: "4"
            memory: 8Gi
        securityContext:
          allowPrivilegeEscalation: false
          capabilities:
            drop: ["ALL"]
        volumeMounts:
          - name: content-cache
            mountPath: /cache
          - name: workspace
            mountPath: /home/runner/_work
    volumes:
      - name: content-cache
        persistentVolumeClaim:
          claimName: pnpm-store
      - name: workspace
        emptyDir: {}
