feat: add CI ServiceAccount + RBAC for Tekton PipelineRun access

CI runner (Forgejo DinD) runs jobs as Docker containers — no in-cluster SA token available. Industry standard: dedicated SA with minimal RBAC, long-lived token as KUBECONFIG_B64 secret in Forgejo. SA: ci-tekton-trigger (namespace: api) Permissions: create/get/watch/delete PipelineRuns, get TaskRuns, get pod logs Token: kubernetes.io/service-account-token secret
2026-09-13 21:58:51 +09:00
parent bdba5af5ef
commit a8e8d33a28
2 changed files with 52 additions and 0 deletions
@@ -4,6 +4,7 @@ kind: Kustomization
 namespace: api

 resources:
+- ci-rbac.yaml
 - task-integration-test.yaml
 - pipeline-integration-test.yaml