Admin Bot a8e8d33a28 feat: add CI ServiceAccount + RBAC for Tekton PipelineRun access ...

CI runner (Forgejo DinD) runs jobs as Docker containers — no in-cluster
SA token available. Industry standard: dedicated SA with minimal RBAC,
long-lived token as KUBECONFIG_B64 secret in Forgejo.

SA: ci-tekton-trigger (namespace: api)
Permissions: create/get/watch/delete PipelineRuns, get TaskRuns, get pod logs
Token: kubernetes.io/service-account-token secret

2026-09-13 21:58:51 +09:00

..

tekton

feat: add CI ServiceAccount + RBAC for Tekton PipelineRun access

2026-09-13 21:58:51 +09:00

configmap.yaml

security: restore old public key in .sops.yaml for cluster decryption

2026-09-13 11:10:34 +09:00

deployment.yaml

feat(config): add tokenUrl, clientId, clientSecret to auth config (#17)

2026-09-08 23:43:29 +00:00

gateway-config-secret.yaml

fix: use decrypted gateway config secret for reliable pod startup

2026-09-13 11:24:12 +09:00

integration-test-job.yaml

feat: add comprehensive integration tests and CI pipeline

2026-09-13 11:42:55 +09:00

kustomization.yaml

fix: use decrypted gateway config secret for reliable pod startup

2026-09-13 11:24:12 +09:00

network-policy.yaml

fix: allow paperless namespace ingress to api-gateway

2026-09-13 13:53:24 +09:00

service.yaml

chore: initial commit of Go API gateway

2026-08-19 20:54:34 -07:00

serviceaccount.yaml

fix: add serviceaccount manifest (was in deleted rbac.yaml)

2026-08-26 19:49:11 -07:00