From 8d8c6dc86b955e813f41adfc84025ec17d12094f Mon Sep 17 00:00:00 2001
From: Oleksandr Berezovskyi <berezovskyi.oleksandr@gmail.com>
Date: Mon, 11 May 2026 21:11:42 +0300
Subject: [PATCH] fix(k8s/gitea): patch act_runner storageClassName around
 chart 0.1.0 bug

---
 kubernetes/app/gitea/namespace.yaml       |  3 +++
 kubernetes/app/gitea/release-actions.yaml | 14 ++++++++++++--
 2 files changed, 15 insertions(+), 2 deletions(-)

diff --git a/kubernetes/app/gitea/namespace.yaml b/kubernetes/app/gitea/namespace.yaml
index 09a988f..3db52a5 100644
--- a/kubernetes/app/gitea/namespace.yaml
+++ b/kubernetes/app/gitea/namespace.yaml
@@ -2,3 +2,6 @@ apiVersion: v1
 kind: Namespace
 metadata:
   name: gitea
+  labels:
+    # act_runner DinD sidecar requires privileged; relax PSA enforce for this ns
+    pod-security.kubernetes.io/enforce: privileged
diff --git a/kubernetes/app/gitea/release-actions.yaml b/kubernetes/app/gitea/release-actions.yaml
index e73c3de..d1ca167 100644
--- a/kubernetes/app/gitea/release-actions.yaml
+++ b/kubernetes/app/gitea/release-actions.yaml
@@ -23,13 +23,23 @@ spec:
       retries: 3
   dependsOn:
     - name: gitea
+  # chart 0.1.0 has a broken `global.storageClass` helper (extra newline breaks YAML),
+  # so we set storageClassName via a kustomize patch instead.
+  postRenderers:
+    - kustomize:
+        patches:
+          - target:
+              kind: StatefulSet
+              name: gitea-gitea-actions-act-runner
+            patch: |
+              - op: add
+                path: /spec/volumeClaimTemplates/0/spec/storageClassName
+                value: nfs-synology-ssd
   values:
     enabled: true
     giteaRootURL: http://gitea-http.gitea.svc.cluster.local:3000
     existingSecret: gitea-runner-token
     existingSecretKey: token
-    global:
-      storageClass: nfs-synology-ssd
     statefulset:
       replicas: 1
       timezone: Europe/Kyiv