From 678f52622525abd521bb604ef34a9f627e716237 Mon Sep 17 00:00:00 2001
From: jgrusewski <jgrusewski@localhost>
Date: Tue, 24 Feb 2026 23:23:16 +0100
Subject: [PATCH] infra(gitlab): Runner Helm values with K8s executor for
 ci-build pool

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---
 infra/k8s/gitlab/runner-values.yaml | 70 +++++++++++++++++++++++++++++
 1 file changed, 70 insertions(+)
 create mode 100644 infra/k8s/gitlab/runner-values.yaml

diff --git a/infra/k8s/gitlab/runner-values.yaml b/infra/k8s/gitlab/runner-values.yaml
new file mode 100644
index 000000000..f87d46d76
--- /dev/null
+++ b/infra/k8s/gitlab/runner-values.yaml
@@ -0,0 +1,70 @@
+# GitLab Runner — Kubernetes executor targeting ci-build pool
+# Runner manager pod lives on gitlab node pool
+# Build pods spawn on ci-build pool (scale-to-zero)
+
+gitlabUrl: https://gitlab.fxhnt.ai
+# runnerToken set via --set at install time
+
+replicas: 1
+
+nodeSelector:
+  k8s.scaleway.com/pool-name: gitlab
+tolerations:
+  - key: gitlab
+    operator: Equal
+    value: "true"
+    effect: NoSchedule
+
+runners:
+  config: |
+    [[runners]]
+      [runners.kubernetes]
+        namespace = "foxhunt"
+        image = "rust:1.89-slim"
+        privileged = false
+
+        # Build pods on ci-build pool
+        [runners.kubernetes.node_selector]
+          "k8s.scaleway.com/pool-name" = "ci-build"
+        [[runners.kubernetes.node_tolerations]]
+          key = "ci-build"
+          operator = "Equal"
+          value = "true"
+          effect = "NoSchedule"
+
+        # Resource limits for build pods
+        cpu_request = "2000m"
+        cpu_limit = "6000m"
+        memory_request = "4Gi"
+        memory_limit = "12Gi"
+
+        # Helper container
+        helper_cpu_request = "100m"
+        helper_cpu_limit = "500m"
+        helper_memory_request = "128Mi"
+        helper_memory_limit = "512Mi"
+
+        # Service containers (for kaniko sidecar)
+        [runners.kubernetes.pod_labels]
+          "app.kubernetes.io/part-of" = "foxhunt-ci"
+
+  # Runner tags for job matching
+  tags: "kapsule,rust,docker"
+
+# Concurrency
+concurrent: 4
+
+# RBAC for runner to spawn pods
+rbac:
+  create: true
+  rules:
+    - apiGroups: [""]
+      resources: ["pods", "pods/exec", "pods/log", "secrets", "configmaps"]
+      verbs: ["get", "list", "watch", "create", "delete", "update", "patch"]
+    - apiGroups: [""]
+      resources: ["pods/attach"]
+      verbs: ["create", "get"]
+
+serviceAccount:
+  create: true
+  name: gitlab-runner