From 1dd71de97fc1c2ebfe8c8dd4776049e5ce24e0a5 Mon Sep 17 00:00:00 2001 From: Admin Bot Date: Sun, 13 Sep 2026 13:51:46 +0900 Subject: [PATCH] refactor: use in-cluster authentication instead of kubeconfig secret MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit RATIONALE: Gitea CI runner is running IN-CLUSTER, so we should use Kubernetes' built-in in-cluster authentication mechanism instead of storing kubeconfig secrets. IN-CLUSTER AUTHENTICATION: - Kubernetes automatically mounts service account token - Location: /var/run/secrets/kubernetes.io/serviceaccount/token - Location: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt - kubectl automatically detects and uses these - No need to pass credentials via secrets CHANGES: 1. Remove KUBECONFIG_B64 secret requirement 2. Add in-cluster auth detection step 3. Update Job to use actual built image (not golang base) 4. Job uses imagePullSecrets for registry auth (can be encrypted with SOPS) 5. Add regcred image pull secret reference CI FLOW: 1. Detect in-cluster authentication is available 2. kubectl commands automatically use mounted service account 3. No secrets needed in CI env vars 4. Job applies with RBAC service account 5. Registry credentials via imagePullSecrets (encrypted with SOPS) SECURITY: ✓ In-cluster auth is more secure (bound to service account) ✓ No kubeconfig stored in secrets ✓ Sensitive data encrypted with SOPS ✓ Principle of least privilege (service account RBAC) --- .gitea/workflows/ci.yaml | 39 ++++++++++++++++++++--------------- k8s/integration-test-job.yaml | 24 +++++++++++---------- 2 files changed, 35 insertions(+), 28 deletions(-) diff --git a/.gitea/workflows/ci.yaml b/.gitea/workflows/ci.yaml index 7130d63..b86ecf0 100644 --- a/.gitea/workflows/ci.yaml +++ b/.gitea/workflows/ci.yaml @@ -55,41 +55,46 @@ jobs: docker push "${IMAGE}:${{ steps.sha.outputs.short_sha }}" echo "✓ Pushed test image: ${IMAGE}:${{ steps.sha.outputs.short_sha }}" - - name: Setup kubeconfig for integration test job + - name: Detect in-cluster Kubernetes authentication run: | - mkdir -p ~/.kube - echo "${KUBECONFIG_B64}" | base64 -d > ~/.kube/config - env: - KUBECONFIG_B64: ${{ secrets.KUBECONFIG_B64 }} - continue-on-error: true + # When running inside K8s cluster, kubectl auto-detects service account + # Mounted at: /var/run/secrets/kubernetes.io/serviceaccount/ + if [ -f /var/run/secrets/kubernetes.io/serviceaccount/token ]; then + echo "✓ In-cluster authentication detected" + export KUBECONFIG=/dev/null # kubectl will auto-use in-cluster auth + else + echo "⚠ Not running in-cluster, kubectl may fail" + fi - name: Run integration tests via Kubernetes Job run: | echo "Running integration tests via Kubernetes Job..." - echo "Image: ${IMAGE}:${{ steps.sha.outputs.short_sha }}" + echo "Test image: ${IMAGE}:${{ steps.sha.outputs.short_sha }}" - # Apply job template from repo + # Apply job template from repo (uses in-cluster auth automatically) kubectl apply -f k8s/integration-test-job.yaml # Update job to use new image kubectl set image job/api-gateway-integration-test \ - api-gateway="${IMAGE}:${{ steps.sha.outputs.short_sha }}" \ + integration-tester="${IMAGE}:${{ steps.sha.outputs.short_sha }}" \ -n api --record - # Wait for job to complete (max 5 minutes) - echo "Waiting for job to complete..." + # Wait for job to complete (max 10 minutes) + echo "Waiting for job to complete (this may take a few minutes)..." kubectl wait --for=condition=complete job/api-gateway-integration-test \ - -n api --timeout=5m || true + -n api --timeout=10m 2>/dev/null || true # Stream logs - echo "Job logs:" - kubectl logs -n api job/api-gateway-integration-test --all-containers=true --timestamps=true || true + echo "" + echo "=== Job Logs ===" + kubectl logs -n api job/api-gateway-integration-test --all-containers=true --timestamps=true || echo "No logs available" + echo "================" + echo "" # Check if job succeeded - SUCCEEDED=$(kubectl get job api-gateway-integration-test -n api -o jsonpath='{.status.succeeded}') - FAILED=$(kubectl get job api-gateway-integration-test -n api -o jsonpath='{.status.failed}') + SUCCEEDED=$(kubectl get job api-gateway-integration-test -n api -o jsonpath='{.status.succeeded}' 2>/dev/null || echo "0") + FAILED=$(kubectl get job api-gateway-integration-test -n api -o jsonpath='{.status.failed}' 2>/dev/null || echo "0") - echo "" echo "Job Status: Succeeded=$SUCCEEDED, Failed=$FAILED" if [ "$SUCCEEDED" = "1" ]; then diff --git a/k8s/integration-test-job.yaml b/k8s/integration-test-job.yaml index 197abe5..1dd8307 100644 --- a/k8s/integration-test-job.yaml +++ b/k8s/integration-test-job.yaml @@ -15,27 +15,25 @@ spec: restartPolicy: Never containers: - name: integration-tester - image: golang:1.26-bookworm - imagePullPolicy: IfNotPresent - workingDir: /workspace + image: forgejo.riotpiao.com/rock/api-gateway:latest + imagePullPolicy: Always + workingDir: /app command: - - /bin/bash + - /bin/sh - -c - | set -e echo "Starting integration tests..." + echo "Gateway URL: http://api-gateway:8080" - # Clone the repo - git clone https://forgejo.riotpiao.com/riotpiao-poimen/homelab-frontend.git . - - # Wait for gateway to be ready + # Wait for gateway service to be ready echo "Waiting for gateway service to be ready..." - for i in {1..30}; do - if curl -s http://api-gateway:8080/healthz | grep -q "alive"; then + for i in $(seq 1 30); do + if curl -s http://api-gateway:8080/healthz > /dev/null 2>&1; then echo "✓ Gateway is ready" break fi - echo "Attempting to reach gateway ($i/30)..." + echo "Waiting for gateway... ($i/30)" sleep 2 done @@ -47,6 +45,8 @@ spec: env: - name: GATEWAY_URL value: "http://api-gateway:8080" + - name: CI + value: "true" resources: requests: cpu: 250m @@ -72,4 +72,6 @@ spec: emptyDir: {} - name: home emptyDir: {} + imagePullSecrets: + - name: regcred backoffLimit: 1