3 Commits

Include renames

Author	SHA1	Message	Date
Admin Bot	1dd71de97f	refactor: use in-cluster authentication instead of kubeconfig secret ... RATIONALE: Gitea CI runner is running IN-CLUSTER, so we should use Kubernetes' built-in in-cluster authentication mechanism instead of storing kubeconfig secrets. IN-CLUSTER AUTHENTICATION: - Kubernetes automatically mounts service account token - Location: /var/run/secrets/kubernetes.io/serviceaccount/token - Location: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt - kubectl automatically detects and uses these - No need to pass credentials via secrets CHANGES: 1. Remove KUBECONFIG_B64 secret requirement 2. Add in-cluster auth detection step 3. Update Job to use actual built image (not golang base) 4. Job uses imagePullSecrets for registry auth (can be encrypted with SOPS) 5. Add regcred image pull secret reference CI FLOW: 1. Detect in-cluster authentication is available 2. kubectl commands automatically use mounted service account 3. No secrets needed in CI env vars 4. Job applies with RBAC service account 5. Registry credentials via imagePullSecrets (encrypted with SOPS) SECURITY: ✓ In-cluster auth is more secure (bound to service account) ✓ No kubeconfig stored in secrets ✓ Sensitive data encrypted with SOPS ✓ Principle of least privilege (service account RBAC)	2026-09-13 13:51:46 +09:00
Admin Bot	e0622449cc	fix: ensure test pod can reach all downstream services ... Add labels to test pod to match network policy selectors: - app=api-gateway (matches network policy pod selector) - managed-by=argocd (matches network policy pod selector) - role=test (identify as test pod) - test-run=<sha> (track which test run spawned it) Network policy 'api-gateway' in api namespace already allows egress to: ✅ kube-system (DNS resolution) ✅ poimen (port 8080 - Memory service) ✅ temporal (port 7233 - Workflow service) ✅ storage (ports 80, 9000 - S3/MinIO) ✅ sqs (port 9090 - SQS service) ✅ iam (ports 9000, 9443 - Authentik/IAM) Test pod inherits same network access as production pods via labels. No additional network policies needed.	2026-09-13 11:48:04 +09:00
Admin Bot	0943df8a42	feat: add comprehensive integration tests and CI pipeline ... Add integration test suite that tests against production cluster: - Memory service (ingest, query) - S3 adapter (list, put objects) - SQS adapter (list queues with auth enforcement) - Workflow adapter (gRPC ListWorkflowExecutions) - IAM adapter (list users) - Health endpoints (liveness, readiness) Update CI/CD pipeline: - Build new docker image from commit - Push to registry with commit SHA and latest tags - Deploy test job to cluster to run integration tests - Tests run against actual production services - Cleanup test resources after completion Add Kubernetes Job manifest: - Runs integration tests in dedicated pod - Waits for gateway to be ready before testing - Tests all adapters and downstream services - Can be run manually: kubectl apply -f k8s/integration-test-job.yaml	2026-09-13 11:42:55 +09:00