From b863b6974e67ad28160e4e6bd36c197274cc1c61 Mon Sep 17 00:00:00 2001
From: Story Crater Bot <19826264+Riotpiaole@users.noreply.github.com>
Date: Wed, 12 Aug 2026 16:25:18 -0700
Subject: [PATCH] =?UTF-8?q?fix(forgejo-runner):=20cicd=20ns=20PSS=20privil?=
 =?UTF-8?q?eged=20(dind=20needs=20it)=20+=20mount=20homelab-ca=20as=20Conf?=
 =?UTF-8?q?igMap=20not=20Secret=20=E2=80=94=20runner=20RS=20created=200=20?=
 =?UTF-8?q?pods=20under=20baseline=20PSS,=20then=20FailedMount=20because?=
 =?UTF-8?q?=20homelab-ca=20is=20a=20ConfigMap=20trust=20bundle,=20not=20a?=
 =?UTF-8?q?=20Secret?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 k8s/bootstrap/phase3-forgejo/namespace.yaml        | 12 +++++++-----
 k8s/infra/forgejo-runner/templates/deployment.yaml |  6 ++++--
 2 files changed, 11 insertions(+), 7 deletions(-)

diff --git a/k8s/bootstrap/phase3-forgejo/namespace.yaml b/k8s/bootstrap/phase3-forgejo/namespace.yaml
index bff8401..12eba5c 100644
--- a/k8s/bootstrap/phase3-forgejo/namespace.yaml
+++ b/k8s/bootstrap/phase3-forgejo/namespace.yaml
@@ -3,8 +3,10 @@ kind: Namespace
 metadata:
   name: cicd
   labels:
-    # Baseline allows most workloads while blocking clearly dangerous configurations
-    # Redis needs some relaxed settings but doesn't need full privileged access
-    pod-security.kubernetes.io/enforce: baseline
-    pod-security.kubernetes.io/audit: baseline
-    pod-security.kubernetes.io/warn: baseline
+    # privileged: the forgejo-runner's dind (docker-in-docker) sidecar requires
+    # securityContext.privileged=true, which baseline/restricted PSS reject
+    # (the ReplicaSet silently creates 0 pods). gitea, redis and CNPG here are
+    # already privileged-tolerant.
+    pod-security.kubernetes.io/enforce: privileged
+    pod-security.kubernetes.io/audit: privileged
+    pod-security.kubernetes.io/warn: privileged
diff --git a/k8s/infra/forgejo-runner/templates/deployment.yaml b/k8s/infra/forgejo-runner/templates/deployment.yaml
index de33f29..bd5ff27 100644
--- a/k8s/infra/forgejo-runner/templates/deployment.yaml
+++ b/k8s/infra/forgejo-runner/templates/deployment.yaml
@@ -104,5 +104,7 @@ spec:
         - name: docker-certs
           emptyDir: {}    # DinD regenerates mTLS certs on each start
         - name: homelab-ca
-          secret:
-            secretName: homelab-ca
+          # homelab-ca is a ConfigMap (public CA trust bundle), not a Secret.
+          # The volumeMounts use subPath: ca.crt to project the single cert file.
+          configMap:
+            name: homelab-ca