fix(ci): use direct in-cluster Kubernetes auth for CI runner — drop kubeconfig file dependency

.forgejo/workflows/terraform-apply.yml

@@ -40,30 +40,6 @@ jobs:
         run: terraform fmt -check -recursive terraform/
         continue-on-error: true
 
-      - name: Generate In-Cluster Kubeconfig
-        run: |
-          mkdir -p /tmp
-          cat > /tmp/kubeconfig << 'EOF'
-          apiVersion: v1
-          kind: Config
-          clusters:
-          - cluster:
-              certificate-authority: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
-              server: https://kubernetes.default:443
-            name: in-cluster
-          contexts:
-          - context:
-              cluster: in-cluster
-              user: terraform
-            name: in-cluster
-          current-context: in-cluster
-          users:
-          - name: terraform
-            user:
-              tokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
-          EOF
-          chmod 600 /tmp/kubeconfig
-
       - name: Configure AWS Credentials
         env:
           AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
@@ -82,7 +58,6 @@ jobs:
         env:
           AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
           AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
-          TF_VAR_kubeconfig_path: /tmp/kubeconfig
           TF_SKIP_CREDENTIALS_VALIDATION: "true"
           TF_SKIP_REGION_VALIDATION: "true"
           TF_SKIP_REQUESTING_ACCOUNT_ID: "true"
@@ -120,7 +95,6 @@ jobs:
         env:
           AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
           AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
-          TF_VAR_kubeconfig_path: /tmp/kubeconfig
           TF_SKIP_CREDENTIALS_VALIDATION: "true"
         run: |
           terraform plan -out=tfplan
@@ -130,7 +104,6 @@ jobs:
         env:
           AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
           AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
-          TF_VAR_kubeconfig_path: /tmp/kubeconfig
           TF_SKIP_CREDENTIALS_VALIDATION: "true"
         run: |
           terraform apply -auto-approve tfplan

terraform/main.tf

@@ -1,6 +1,5 @@
 locals {
-  kubeconfig_path = var.kubeconfig_path
-  cluster_domain  = var.cluster_domain
+  cluster_domain = var.cluster_domain
 }
 
 # Helm repositories will be created in helm-repositories.tf

terraform/providers.tf

@@ -29,12 +29,18 @@ terraform {
 }
 
 provider "kubernetes" {
-  config_path = var.kubeconfig_path
+  host                   = "https://kubernetes.default"
+  token                  = try(file("/var/run/secrets/kubernetes.io/serviceaccount/token"), "")
+  cluster_ca_certificate = try(file("/var/run/secrets/kubernetes.io/serviceaccount/ca.crt"), "")
+  insecure               = false
 }
 
 provider "helm" {
   kubernetes {
-    config_path = var.kubeconfig_path
+    host                   = "https://kubernetes.default"
+    token                  = try(file("/var/run/secrets/kubernetes.io/serviceaccount/token"), "")
+    cluster_ca_certificate = try(file("/var/run/secrets/kubernetes.io/serviceaccount/ca.crt"), "")
+    insecure               = false
   }
 }
 

terraform/variables.tf

@@ -1,9 +1,3 @@
-variable "kubeconfig_path" {
-  description = "Path to kubeconfig file"
-  type        = string
-  default     = "cluster-config/kubeconfig"
-}
-
 variable "cluster_domain" {
   description = "Cluster domain (e.g., riotpiao.homelab.com)"
   type        = string