simple-private-codecollection/docs/06-runner-integration.md

06 — Runner integration

What you'll do

Tell the airgap workspace-builder where to find this repository and have Flux reconcile the change.

The single edit

Open the airgap runner's HelmRelease values file:

apps/runwhen-env/airgap/runwhen-runner/helm.yaml

Under spec.values.workspaceBuilder.workspaceInfo.configMap.data.codeCollections, append one entry. Before:

codeCollections:
- repoURL: http://rw-airgap-cc-catalog-svc.runwhen-env-airgap:8080/git/rw-cli-codecollection.git
  ref: main

After:

codeCollections:
- repoURL: http://rw-airgap-cc-catalog-svc.runwhen-env-airgap:8080/git/rw-cli-codecollection.git
  ref: main
- repoURL: https://<gitea-token>@gitea.airgap.shared.runwhen.com/gitea-admin/simple-private-codecollection.git
  ref: main

The <gitea-token> value is a Gitea personal access token with at least read:repository scope on the simple-private-codecollection repo.

Screenshot placeholder: images/06-helm-yaml-diff.png — annotated diff of the two-line addition.

What we intentionally did NOT change

• runner.codeCollections — the list of code collections whose Robot code is executed by worker pods. Because our private CC ships no robots, it never needs a runner worker. The runtime lives in the already-registered rw-generic-codecollection.
• Any secret configuration — we are using the fastest working option: the token embedded directly in the repoURL. This trades tidiness for zero setup complexity. See "Trade-offs" below.

Trade-offs of token-in-URL (option B)

The token becomes visible to anyone with read access to the workspace-builder ConfigMap — via kubectl get cm workspace-builder -o yaml in the runner namespace, and to anyone reading the Flux repo. That is acceptable for a test token you can rotate, but not production hygiene.

Two better options once this example is working:

Option A — cc-catalog proxy (production path)

Turn on runtime git sync in the platform-side cc-catalog service and add a simple-private-codecollection slug there. The workspace-builder then clones from the internal proxy URL (no token in ConfigMap):

- repoURL: http://rw-airgap-cc-catalog-svc.runwhen-env-airgap:8080/git/simple-private-codecollection.git
  ref: main

That requires editing apps/runwhen-env/airgap/runwhen-platform/helmrelease.yaml to (a) add the slug under ccCatalog.config.sources[].codecollections and (b) enable git.runtime_sync: true with git.auth.token_env pointing at a Kubernetes secret storing the Gitea token. Track that as a follow-up.

Option C — fix upstream

Patch runwhen-local to actually apply authUser/authToken in code_collection.py update_repo(). Today those fields are parsed and stored on the CodeCollection object but never applied to Repo.clone_from(). A one-line fix to route through git_utils.get_repo_url_with_auth(). Then you can pass authUser/authToken in workspaceInfo.yaml and reference them as environment variables or literal values without leaking the token.

Trigger the change

The Flux HelmRelease for runwhen-local reconciles every 5 minutes, but you can force it:

flux reconcile hr runwhen-local -n runwhen-env-airgap-runner --with-source

Watch for the reconcile to complete:

kubectl -n runwhen-env-airgap-runner get pods -w

You should see the runwhen-local pod restart (because the ConfigMap changed). Its next start will use the new workspaceInfo.

Verify the workspace-builder can reach Gitea

kubectl -n runwhen-env-airgap-runner exec deploy/runwhen-local -c workspace-builder -- \
  curl -sSI --max-time 5 https://gitea.airgap.shared.runwhen.com/ | head -1

Expected: HTTP/2 200 or HTTP/1.1 200 OK. If the request hangs, check NetworkPolicy — the airgap deps namespace should already permit this traffic on 443.

Screenshot placeholder: images/06-curl-gitea.png.

Next

Continue to 07 — Validate and observe.