CI runner (Forgejo DinD) runs jobs as Docker containers — no in-cluster
SA token available. Industry standard: dedicated SA with minimal RBAC,
long-lived token as KUBECONFIG_B64 secret in Forgejo.
SA: ci-tekton-trigger (namespace: api)
Permissions: create/get/watch/delete PipelineRuns, get TaskRuns, get pod logs
Token: kubernetes.io/service-account-token secret
FIXES:
- Remove stale files: k8s/argocd-apps/, k8s/tekton/base/, overlays/
(Tekton infra is in homelab repo, not here)
- Fix step.resources → step.computeResources (Tekton v1 API)
- Fix Task: use curl sidecar pattern instead of distroless image
(distroless has no shell/curl/go)
- Fix routing: use X-Service + X-Resource headers, not path-based
- Extract test script to scripts/integration-test.sh (ConfigMap mount)
- Install kubectl in CI runner (was missing)
- Prune README to essentials
TASK ARCHITECTURE:
sidecar: gateway image (mounts config secret, runs on localhost)
step: curlimages/curl (runs integration-test.sh from ConfigMap)
TEST COVERAGE:
health, header validation, memory, s3, sqs, workflow, iam
BREAKING CHANGE: CI now requires kubeconfig to run integration tests
Changes:
- Build image with commit SHA tag (NOT latest yet)
- Deploy dedicated test pod from new image
- Run full integration test suite against test pod
- Only promote to latest tag AFTER tests pass
- Cleanup test pod after run
CI/CD Flow:
1. go vet + go test (unit tests)
2. Build image: api-gateway:<sha>
3. Push to registry
4. Deploy test pod with <sha> image
5. Run integration tests (memory, S3, SQS, workflow, IAM, health)
6. If tests pass: tag as latest and push
7. If tests fail: keep <sha> tag, don't promote to latest
8. Cleanup test pod
This ensures:
- New code is tested in cluster before production deployment
- ArgoCD only pulls latest after tests pass
- Failed builds don't get promoted to production
- Full test coverage of all adapters
Requires: KUBECONFIG_B64 secret in Gitea for cluster access
Admin Bot