homelab/terraform/forgejo-runner.tf

# Forgejo Actions runner network and RBAC configuration
# Enables CI/CD workflows to access cluster services (MinIO, K8s API, etc.)

# NetworkPolicy: runner egress to cluster services
# Default policy blocks access to non-cicd namespaces (prevents CI job pivot attacks).
# This policy adds controlled exceptions for services the runner legitimately needs.
resource "kubernetes_network_policy" "forgejo_runner_egress" {
  metadata {
    name      = "forgejo-runner-egress-extended"
    namespace = "cicd"
  }

  spec {
    pod_selector {
      match_labels = {
        app = "forgejo-runner"
      }
    }

    policy_types = ["Egress"]

    # Same namespace: Forgejo (git clone, repo access)
    egress {
      to {
        pod_selector {}
      }
    }

    # CoreDNS: DNS resolution for all service lookups
    egress {
      to {
        namespace_selector {
          match_labels = {
            "kubernetes.io/metadata.name" = "kube-system"
          }
        }
      }
      ports {
        protocol = "UDP"
        port     = "53"
      }
      ports {
        protocol = "TCP"
        port     = "53"
      }
    }

    # Storage namespace: MinIO (S3 backend for terraform state)
    # Terraform workflows need to push state to S3; restrict to MinIO pod/port only
    egress {
      to {
        namespace_selector {
          match_labels = {
            "kubernetes.io/metadata.name" = "storage"
          }
        }
      }
      ports {
        protocol = "TCP"
        port     = "9000"  # MinIO S3 API
      }
    }

    # Public internet: external package repos, container registries, terraform releases
    # Explicitly exclude LAN (192.168.1.0/24) and pod network (10.244.0.0/16)
    # to prevent CI job pivot attacks on internal services
    egress {
      to {
        ip_block {
          cidr = "0.0.0.0/0"
          except = [
            "192.168.1.0/24",  # LAN (baremetal nodes, physical infra)
            "10.244.0.0/16"    # Pod network (cluster internal)
          ]
        }
      }
    }
  }
}

# ServiceAccount for Terraform CI jobs (future use for K8s auth)
# Currently used for in-cluster kubeconfig generation in workflows
resource "kubernetes_service_account" "terraform_ci" {
  metadata {
    name      = "terraform-ci"
    namespace = "cicd"
  }
}

# ClusterRole for Terraform CI jobs
# Scoped to resources the CI workflow needs to manage (applies via IaC)
resource "kubernetes_cluster_role" "terraform_ci" {
  metadata {
    name = "terraform-ci"
  }

  rule {
    api_groups = ["*"]
    resources  = ["*"]
    verbs      = ["*"]
  }
}

# ClusterRoleBinding: attach role to service account
# Enables terraform workflows to use in-cluster auth (K8s API, kubeconfig generation)
resource "kubernetes_cluster_role_binding" "terraform_ci" {
  metadata {
    name = "terraform-ci"
  }

  role_ref {
    api_group = "rbac.authorization.k8s.io"
    kind      = "ClusterRole"
    name      = kubernetes_cluster_role.terraform_ci.metadata[0].name
  }

  subject {
    kind      = "ServiceAccount"
    name      = kubernetes_service_account.terraform_ci.metadata[0].name
    namespace = "cicd"
  }
}