2026-09-13 13:54:32 +00:00
1 changed files with 10 additions and 0 deletions
@@ -29,6 +29,16 @@ spec:
            except:
              - 192.168.1.0/24
              - 10.244.0.0/16
+    # Kubernetes API server — CI needs kubectl access to create
+    # Tekton PipelineRuns for integration testing.
+    # The API server runs on control-plane nodes (192.168.1.0/24);
+    # we allow port 6443 only to that subnet.
+    - to:
+        - ipBlock:
+            cidr: 192.168.1.0/24
+      ports:
+        - protocol: TCP
+          port: 6443
    # ingress-nginx, which is how forgejo.riotpiao.com resolves (CoreDNS
    # rewrites that name to ingress-nginx-controller.ingress-nginx.svc).
    # Image pushes go to that name so the tag matches what containerd pulls