Admin Bot
1dd71de97f
CI / CI (pull_request) Failing after 2m56s
RATIONALE: Gitea CI runner is running IN-CLUSTER, so we should use Kubernetes' built-in in-cluster authentication mechanism instead of storing kubeconfig secrets. IN-CLUSTER AUTHENTICATION: - Kubernetes automatically mounts service account token - Location: /var/run/secrets/kubernetes.io/serviceaccount/token - Location: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt - kubectl automatically detects and uses these - No need to pass credentials via secrets CHANGES: 1. Remove KUBECONFIG_B64 secret requirement 2. Add in-cluster auth detection step 3. Update Job to use actual built image (not golang base) 4. Job uses imagePullSecrets for registry auth (can be encrypted with SOPS) 5. Add regcred image pull secret reference CI FLOW: 1. Detect in-cluster authentication is available 2. kubectl commands automatically use mounted service account 3. No secrets needed in CI env vars 4. Job applies with RBAC service account 5. Registry credentials via imagePullSecrets (encrypted with SOPS) SECURITY: ✓ In-cluster auth is more secure (bound to service account) ✓ No kubeconfig stored in secrets ✓ Sensitive data encrypted with SOPS ✓ Principle of least privilege (service account RBAC)
78 lines
2.0 KiB
YAML
78 lines
2.0 KiB
YAML
apiVersion: batch/v1
|
|
kind: Job
|
|
metadata:
|
|
name: api-gateway-integration-test
|
|
namespace: api
|
|
spec:
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: api-gateway
|
|
managed-by: test
|
|
role: integration-test
|
|
spec:
|
|
serviceAccountName: api-gateway
|
|
restartPolicy: Never
|
|
containers:
|
|
- name: integration-tester
|
|
image: forgejo.riotpiao.com/rock/api-gateway:latest
|
|
imagePullPolicy: Always
|
|
workingDir: /app
|
|
command:
|
|
- /bin/sh
|
|
- -c
|
|
- |
|
|
set -e
|
|
echo "Starting integration tests..."
|
|
echo "Gateway URL: http://api-gateway:8080"
|
|
|
|
# Wait for gateway service to be ready
|
|
echo "Waiting for gateway service to be ready..."
|
|
for i in $(seq 1 30); do
|
|
if curl -s http://api-gateway:8080/healthz > /dev/null 2>&1; then
|
|
echo "✓ Gateway is ready"
|
|
break
|
|
fi
|
|
echo "Waiting for gateway... ($i/30)"
|
|
sleep 2
|
|
done
|
|
|
|
# Run integration tests
|
|
echo "Running integration tests..."
|
|
go test -v -tags=integration -timeout=5m ./internal/integration/...
|
|
|
|
echo "✓ Integration tests completed"
|
|
env:
|
|
- name: GATEWAY_URL
|
|
value: "http://api-gateway:8080"
|
|
- name: CI
|
|
value: "true"
|
|
resources:
|
|
requests:
|
|
cpu: 250m
|
|
memory: 512Mi
|
|
limits:
|
|
cpu: 500m
|
|
memory: 1Gi
|
|
securityContext:
|
|
runAsNonRoot: true
|
|
runAsUser: 65532
|
|
allowPrivilegeEscalation: false
|
|
capabilities:
|
|
drop:
|
|
- ALL
|
|
readOnlyRootFilesystem: true
|
|
volumeMounts:
|
|
- name: tmp
|
|
mountPath: /tmp
|
|
- name: home
|
|
mountPath: /home/nonroot
|
|
volumes:
|
|
- name: tmp
|
|
emptyDir: {}
|
|
- name: home
|
|
emptyDir: {}
|
|
imagePullSecrets:
|
|
- name: regcred
|
|
backoffLimit: 1
|