From a8e8d33a2854dc3540bd63a61bdc6e80d3927c96 Mon Sep 17 00:00:00 2001
From: Admin Bot <admin@riotpiao.com>
Date: Sun, 13 Sep 2026 21:58:51 +0900
Subject: [PATCH] feat: add CI ServiceAccount + RBAC for Tekton PipelineRun
 access
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

CI runner (Forgejo DinD) runs jobs as Docker containers — no in-cluster
SA token available. Industry standard: dedicated SA with minimal RBAC,
long-lived token as KUBECONFIG_B64 secret in Forgejo.

SA: ci-tekton-trigger (namespace: api)
Permissions: create/get/watch/delete PipelineRuns, get TaskRuns, get pod logs
Token: kubernetes.io/service-account-token secret
---
 k8s/tekton/ci-rbac.yaml       | 51 +++++++++++++++++++++++++++++++++++
 k8s/tekton/kustomization.yaml |  1 +
 2 files changed, 52 insertions(+)
 create mode 100644 k8s/tekton/ci-rbac.yaml

diff --git a/k8s/tekton/ci-rbac.yaml b/k8s/tekton/ci-rbac.yaml
new file mode 100644
index 0000000..81ca0de
--- /dev/null
+++ b/k8s/tekton/ci-rbac.yaml
@@ -0,0 +1,51 @@
+# ServiceAccount and RBAC for CI runner to create/watch Tekton PipelineRuns.
+# Applied to the `api` namespace where PipelineRuns execute.
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: ci-tekton-trigger
+  namespace: api
+  labels:
+    app: api-gateway
+    component: ci
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: ci-tekton-trigger
+  namespace: api
+rules:
+- apiGroups: ["tekton.dev"]
+  resources: ["pipelineruns"]
+  verbs: ["create", "get", "list", "watch", "delete"]
+- apiGroups: ["tekton.dev"]
+  resources: ["taskruns"]
+  verbs: ["get", "list"]
+- apiGroups: [""]
+  resources: ["pods", "pods/log"]
+  verbs: ["get", "list"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: ci-tekton-trigger
+  namespace: api
+subjects:
+- kind: ServiceAccount
+  name: ci-tekton-trigger
+  namespace: api
+roleRef:
+  kind: Role
+  name: ci-tekton-trigger
+  apiGroup: rbac.authorization.k8s.io
+---
+# Secret to generate a long-lived token for the CI runner.
+# The runner mounts this as KUBECONFIG_B64 or uses it directly.
+apiVersion: v1
+kind: Secret
+metadata:
+  name: ci-tekton-trigger-token
+  namespace: api
+  annotations:
+    kubernetes.io/service-account.name: ci-tekton-trigger
+type: kubernetes.io/service-account-token
diff --git a/k8s/tekton/kustomization.yaml b/k8s/tekton/kustomization.yaml
index fefd3fd..917e24c 100644
--- a/k8s/tekton/kustomization.yaml
+++ b/k8s/tekton/kustomization.yaml
@@ -4,6 +4,7 @@ kind: Kustomization
 namespace: api
 
 resources:
+- ci-rbac.yaml
 - task-integration-test.yaml
 - pipeline-integration-test.yaml