gitlab-system/gitlab-runner/gitlab-runner.yaml

---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: gitlab-runner
  namespace: mulk
  labels:
    name: gitlab-runner
    k8s-app: gitlab-runner

spec:
  replicas: 1

  strategy:
    rollingUpdate:
      maxSurge: 1
      maxUnavailable: 1

  selector:
    matchLabels:
      k8s-app: gitlab-runner
      name: gitlab-runner

  template:
    metadata:
      labels:
        name: gitlab-runner
        k8s-app: gitlab-runner

    spec:
      imagePullSecrets:
        - name: portus-token

      runtimeClassName: kata

      containers:
        - name: master
          image: docker.benkard.de/mulk/gitlab-runner:miyj7qdmgdbbqk7zkj3wdq0ld9zxdk2z

          securityContext:
            # In a Kata container, this only gives the container full
            # access to the guest VM rather than the host.  (To ensure
            # this, it is important to set privileged_without_host_devices
            # = true in the [plugins.cri.containerd.runtimes.kata] section
            # of containerd's config.toml.)
            privileged: true

          volumeMounts:
            # Configuration data.
            - name: config
              mountPath: /etc/gitlab-runner

            # State.
            - name: docker-data
              mountPath: /vol/docker-data
            - name: tmp
              mountPath: /tmp

          resources:
            limits:
              memory: 4G

      volumes:
        - name: config
          secret:
            secretName: gitlab-runner-config
        - name: docker-data
          persistentVolumeClaim:
            claimName: gitlab-runner-docker
        - name: tmp
          emptyDir: {}

---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: gitlab-runner-docker
  namespace: mulk
  annotations:
    volume.beta.kubernetes.io/storage-provisioner: rancher.io/local-path
    volume.kubernetes.io/selected-node: ifirn
spec:
  storageClassName: local-path
  accessModes:
    - ReadWriteOnce
  resources:
    requests:
      storage: 1Gi