From 4b5ecfcd49f8f2c1250f469ada2fe67d571ca396 Mon Sep 17 00:00:00 2001 From: poimen Date: Sun, 13 Sep 2026 13:54:31 +0000 Subject: [PATCH] fix: allow CI runner egress to K8s API server (#48) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit CI runner needs kubectl access to create Tekton PipelineRuns for integration testing. ## Root Cause The runner egress NetworkPolicy blocks `192.168.1.0/24` (LAN). The K8s API server runs on control-plane nodes in that subnet (`192.168.1.166:6443`). kubectl from inside the DinD container times out. ## Fix Allow TCP port 6443 to `192.168.1.0/24` — scoped to control-plane API server only. ## Required By homelab-frontend PR #25 (Tekton integration testing) — CI creates PipelineRuns via kubectl. --------- Co-authored-by: rock Reviewed-on: https://forgejo.riotpiao.com/riotpiao-poimen/homelab/pulls/48 Co-authored-by: poimen --- k8s/infra/forgejo-runner/templates/networkpolicy.yaml | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/k8s/infra/forgejo-runner/templates/networkpolicy.yaml b/k8s/infra/forgejo-runner/templates/networkpolicy.yaml index 890de0a..2998562 100644 --- a/k8s/infra/forgejo-runner/templates/networkpolicy.yaml +++ b/k8s/infra/forgejo-runner/templates/networkpolicy.yaml @@ -29,6 +29,16 @@ spec: except: - 192.168.1.0/24 - 10.244.0.0/16 + # Kubernetes API server — CI needs kubectl access to create + # Tekton PipelineRuns for integration testing. + # The API server runs on control-plane nodes (192.168.1.0/24); + # we allow port 6443 only to that subnet. + - to: + - ipBlock: + cidr: 192.168.1.0/24 + ports: + - protocol: TCP + port: 6443 # ingress-nginx, which is how forgejo.riotpiao.com resolves (CoreDNS # rewrites that name to ingress-nginx-controller.ingress-nginx.svc). # Image pushes go to that name so the tag matches what containerd pulls