From 593b2e6d2e198e9da18d0f49e49594f4c020739a Mon Sep 17 00:00:00 2001 From: jcardozo-eth <131674798+jcardozo-eth@users.noreply.github.com> Date: Fri, 24 Jul 2026 17:00:33 +0200 Subject: [PATCH 1/5] docs(readme): use the renamed runner_tokens key in prose --- README.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index 2bc09e3..a24d82d 100644 --- a/README.md +++ b/README.md @@ -595,11 +595,11 @@ Each runner in the Hiera node file refers to its secret by **`token_key`**, neve # puppet/data/nodes/.yaml rootless_gitlab_runner::runners: - name: 'docker-socket-runner' - token_key: 'runner_a' # resolved from tokens['runner_a'] at apply time + token_key: 'runner_a' # resolved from runner_tokens['runner_a'] at apply time # ... ``` -At apply time the module merges `tokens['runner_a']` into that runner and writes it into the +At apply time the module merges `runner_tokens['runner_a']` into that runner and writes it into the rendered runner config under `/etc` (`0600`). A checkout without a secret store renders blank tokens instead of failing, so dry-runs and CI validation work anywhere. With a secret store present, a `token_key` that resolves to nothing fails the apply with the key and runner From 29203dd80fcf6d5dbdf2151bd52131bc92e921f3 Mon Sep 17 00:00:00 2001 From: jcardozo-eth <131674798+jcardozo-eth@users.noreply.github.com> Date: Fri, 24 Jul 2026 18:01:36 +0200 Subject: [PATCH 2/5] docs(changelog): tighten the data-check advisory wording --- CHANGELOG.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index c4f5d5e..f0a03f7 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -10,7 +10,7 @@ module follows [Semantic Versioning](https://semver.org/spec/v2.0.0.html). ### Added - An externally provisioned runner account whose primary group is named differently from the account now converges on the first apply: the new optional `runner_account.group` names the account's primary group and feeds every group ownership the module manages. It defaults to the account name, so existing hosts are unchanged. -- A Hiera data check ships with the module: it fails on any data key that no deployed class declares, instead of Hiera silently ignoring it, and flags subkeys the module will not read under a disabled `manage` toggle with a non-failing advisory. The advisory resolves the toggle wherever it sits, including nested toggles and toggles left at their module default, and spares a subkey that merely restates the default. +- A Hiera data check ships with the module: it fails on any data key that no deployed class declares, instead of Hiera silently ignoring it, and gives a non-failing advisory for subkeys the module will not read because their `manage` toggle is off. ### Changed From 33ca6a7e26b9ebea53f665b2f7aef1672e4ec4bb Mon Sep 17 00:00:00 2001 From: jcardozo-eth <131674798+jcardozo-eth@users.noreply.github.com> Date: Fri, 24 Jul 2026 18:01:59 +0200 Subject: [PATCH 3/5] docs(changelog): reword the runner_tokens rename entry --- CHANGELOG.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index f0a03f7..66d7934 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -17,7 +17,7 @@ module follows [Semantic Versioning](https://semver.org/spec/v2.0.0.html). - Standalone operators get a self-contained runbook: installation, applying, systemd automation, and self-update now live in `docs/standalone.md`, and the README slims to the configuration, secrets, and security model shared by every consumer. - The parameter surface is regrouped: five flat keys plus six parameter groups replace the 49 flat parameters. Related settings now live together, one hash per concern: `runner_account`, `configuration_file`, `packages` with its apt `sources`, `rootless_docker`, `runner_service`, and `standalone` with the nested `self_update`. - Every subkey ships a module default and the groups merge deep across Hiera layers, so node data holds only its deviations, and a mistyped subkey now fails the compile instead of being silently ignored. -- The runner-token store reads as part of the runner family: `tokens` is now `runner_tokens`, alongside `runners` and `runner_defaults`. The automatic `Sensitive` wrap on lookup moves with the new key; the host's secret store file must follow the rename. +- `tokens` was renamed to `runner_tokens`, matching `runners` and `runner_defaults`. The automatic `Sensitive` wrap on lookup moves with the new key; the host's secret store file must follow the rename. - The apply script now installs on any declared-standalone host (`standalone.manage: true`), not only with the self-update loop, so manual applies and the loop share the same single apply command; enabling the loop on a host not declared standalone fails at compile time. - The liveness healthcheck now installs on any declared-standalone host (`standalone.manage: true`), not only with the self-update loop, so a standalone host without the loop still has its manager service and rootless Docker daemon monitored (cadence `standalone.healthcheck_interval`); the loop's own supervision checks (apply-timer state, checkout staleness, bootstrap-gem presence) layer on only when the loop is enabled. - Freshly provisioned hosts get a 165536-wide subordinate-ID range out of the box, so nested rootless BuildKit builds work without tuning. From 0eab8b1bd34112808fa5c76f12566a7e5163bf04 Mon Sep 17 00:00:00 2001 From: jcardozo-eth <131674798+jcardozo-eth@users.noreply.github.com> Date: Fri, 24 Jul 2026 18:02:27 +0200 Subject: [PATCH 4/5] docs(changelog): move the ownership fix to its own Fixed entry --- CHANGELOG.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 66d7934..2ed5691 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -27,7 +27,7 @@ module follows [Semantic Versioning](https://semver.org/spec/v2.0.0.html). ### Removed -- Every parameter the module can derive is now automatic: the rendered configuration's owner and group follow `runner_account.name` (which also fixes the file staying owned by the default account name when a different account is declared), the docker socket path follows `runner_account.uid`, the no-detach-netns drop-in location follows `runner_account.home`, and the apply's manifest, module directory and Hiera configuration follow the documented control-repository layout under `standalone.control_repository_path`. `service_user` goes with them: the runner manager service always runs privilege-dropped as the runner account. +- Every parameter the module can derive is now automatic: the rendered configuration's owner and group follow `runner_account.name`, the docker socket path follows `runner_account.uid`, the no-detach-netns drop-in location follows `runner_account.home`, and the apply's manifest, module directory and Hiera configuration follow the documented control-repository layout under `standalone.control_repository_path`. `service_user` goes with them: the runner manager service always runs privilege-dropped as the runner account. - Deliberate choices are no longer parameters: `runner_binary`, `service_name` and `setuptool_path` take the values their packages define, `service_kill_signal` is always `SIGQUIT` (the graceful drain), and `config_mode` and `dropin_mode` keep their former defaults. - `check_interval`, `connection_max_age` and `shutdown_timeout` are no longer rendered. The removed lines matched GitLab Runner's own defaults, so existing hosts behave the same. - `on_failure_unit` is removed; a push alert attaches as a host-side `OnFailure=` drop-in on the apply or healthcheck service. @@ -36,6 +36,7 @@ module follows [Semantic Versioning](https://semver.org/spec/v2.0.0.html). - Clearing `runner_service.environment` through data can no longer leave the runner manager without `DOCKER_HOST`; the derived socket is always present. - With `packages.sources.manage` on, repeated applies stop churning apt: an unchanged repository signing key is now a true no-op (no keyring rewrite, no needless `apt-get update`), while a genuine key rotation is still picked up from the vendor's rolling key endpoint and refreshes the apt index. +- Declaring a runner account name other than the default now gives the rendered configuration file correct ownership; it previously stayed owned by the default account name. ## [1.0.0] - 2026-07-09 From 898c678b95ac333f0eca40f003012bb992479bf5 Mon Sep 17 00:00:00 2001 From: jcardozo-eth <131674798+jcardozo-eth@users.noreply.github.com> Date: Fri, 24 Jul 2026 17:01:38 +0200 Subject: [PATCH 5/5] chore(release): cut 2.0.0 --- CHANGELOG.md | 7 ++++++- metadata.json | 2 +- 2 files changed, 7 insertions(+), 2 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 2ed5691..b7552d8 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -7,6 +7,10 @@ module follows [Semantic Versioning](https://semver.org/spec/v2.0.0.html). ## [Unreleased] +## [2.0.0] - 2026-07-24 + +A breaking rework of the configuration surface: settings group into per-concern structs, every default lives in the module and merges deep so node data holds only its deviations, and several values the module can derive (file ownership, socket paths, `DOCKER_HOST`) are no longer configurable parameters. A shipped Hiera data check validates consumer data against the declared parameter surface. Standalone hosts gain a self-contained runbook, a liveness healthcheck decoupled from the self-update loop, and enforced subordinate-ID widths sized for nested builds with rootless BuildKit. + ### Added - An externally provisioned runner account whose primary group is named differently from the account now converges on the first apply: the new optional `runner_account.group` names the account's primary group and feeds every group ownership the module manages. It defaults to the account name, so existing hosts are unchanged. @@ -78,5 +82,6 @@ The initial release: a rootless GitLab Runner host — runner config, the rootle - Runner tokens are handled as sensitive values end to end, so they stay out of compiled catalogs, Puppet reports, and configuration diffs. - Config inputs are escaped and type-checked where they are rendered, so a malformed value in host data is rejected up front instead of producing a broken or injected configuration. -[Unreleased]: https://github.com/eth-library/puppet-rootless_gitlab_runner/compare/v1.0.0...main +[Unreleased]: https://github.com/eth-library/puppet-rootless_gitlab_runner/compare/v2.0.0...main +[2.0.0]: https://github.com/eth-library/puppet-rootless_gitlab_runner/compare/v1.0.0...v2.0.0 [1.0.0]: https://github.com/eth-library/puppet-rootless_gitlab_runner/releases/tag/v1.0.0 diff --git a/metadata.json b/metadata.json index 94724e5..83bbf77 100644 --- a/metadata.json +++ b/metadata.json @@ -1,6 +1,6 @@ { "name": "ethlibrary-rootless_gitlab_runner", - "version": "1.0.1-rc", + "version": "2.0.0", "author": "ETH Zurich, Jaime Cardozo", "summary": "Installs, configures, and manages a rootless GitLab Runner.", "license": "Apache-2.0",