riotpiao-poimen/homelab
2
0
Fork 0
Code Issues 23 Pull Requests 1 Actions Packages Projects 1 Releases Wiki Activity

fix: allow CI runner egress to K8s API server #48

Merged
rock merged 1 commits from feat/ci-k8s-api-egress into main 2026-09-13 13:54:32 +00:00
Conversation 0 Commits 1 Files Changed 1
+10
poimen commented 2026-09-13 13:51:53 +00:00
Member
Copy Link
Copy Source

CI runner needs kubectl access to create Tekton PipelineRuns for integration testing.

Root Cause

The runner egress NetworkPolicy blocks 192.168.1.0/24 (LAN). The K8s API server runs on control-plane nodes in that subnet (192.168.1.166:6443). kubectl from inside the DinD container times out.

Fix

Allow TCP port 6443 to 192.168.1.0/24 — scoped to control-plane API server only.

Required By

homelab-frontend PR #25 (Tekton integration testing) — CI creates PipelineRuns via kubectl.

CI runner needs kubectl access to create Tekton PipelineRuns for integration testing. ## Root Cause The runner egress NetworkPolicy blocks `192.168.1.0/24` (LAN). The K8s API server runs on control-plane nodes in that subnet (`192.168.1.166:6443`). kubectl from inside the DinD container times out. ## Fix Allow TCP port 6443 to `192.168.1.0/24` — scoped to control-plane API server only. ## Required By homelab-frontend PR #25 (Tekton integration testing) — CI creates PipelineRuns via kubectl.
poimen added 1 commit 2026-09-13 13:51:55 +00:00
fix: allow CI runner egress to K8s API server (port 6443) 9e17ca4d44 
CI needs kubectl access to create Tekton PipelineRuns for integration
testing. The API server runs on control-plane nodes in 192.168.1.0/24
which was blocked by the existing except rule.

Allow port 6443 to 192.168.1.0/24 (control-plane subnet only).
rock merged commit 4b5ecfcd49 into main 2026-09-13 13:54:32 +00:00
rock deleted branch feat/ci-k8s-api-egress 2026-09-13 13:54:37 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
area/auth
Authentication & authorization
 area/authentik
Authentik OIDC provider config
 area/downstream
Downstream service changes
 area/event-bus
Event routing and notification pipeline
 area/gateway
API gateway code (homelab-frontend)
 area/notifications
Gotify, SMTP, push notifications
 area/observer
Poimen goal-driven observation and pattern detection
 priority/high
Must have
 priority/medium
Should have
 status/blocked
Blocked by dependency
 status/done
Completed
 status/in-progress
Currently being worked on
 status/review
Ready for review
 status/todo
Not started
 type/docs
Documentation
 type/feature
New feature
 type/infra
Infrastructure change
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
poimen rock (Rock)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: riotpiao-poimen/homelab#48