96e1825629
- .gitea/workflows/deploy.yaml: PRs run a server-side dry-run; pushes to main apply the kustomization and wait for all rollouts. Modeled on socktop-webterm's pipeline; uses the same KUBECONFIG secret convention and gitea-deployer ServiceAccount. - rbac/gitea-deployer.yaml: ClusterRole/Binding (admin bootstrap, outside the root kustomization) — repo resource kinds only, no secrets access, no delete verbs, no RBAC escalation. Applied to the cluster 2026-07-26. - One-time env->secretKeyRef migration executed against the cluster; README updated. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
52 lines
1.6 KiB
YAML
52 lines
1.6 KiB
YAML
# RBAC for the Gitea Actions deploy pipeline.
|
|
#
|
|
# ADMIN BOOTSTRAP — applied once by a human with cluster-admin
|
|
# (NOT part of the root kustomization: the pipeline's own token must not be
|
|
# able to escalate its privileges):
|
|
# kubectl apply -f rbac/gitea-deployer.yaml
|
|
#
|
|
# Binds to the existing `gitea-deployer` ServiceAccount in `default`
|
|
# (token secret: default/gitea-deployer-token — the same identity the
|
|
# socktop-webterm pipeline uses).
|
|
#
|
|
# Deliberately granted: the resource kinds this repo contains, cluster-wide.
|
|
# Deliberately NOT granted: secrets (app secrets are created out-of-band),
|
|
# RBAC objects, nodes, or delete on anything.
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRole
|
|
metadata:
|
|
name: homelab-k3s-deployer
|
|
rules:
|
|
- apiGroups: [""]
|
|
resources:
|
|
- namespaces
|
|
- persistentvolumes
|
|
- persistentvolumeclaims
|
|
- services
|
|
verbs: [get, list, watch, create, update, patch]
|
|
- apiGroups: [apps]
|
|
resources: [deployments]
|
|
verbs: [get, list, watch, create, update, patch]
|
|
- apiGroups: [networking.k8s.io]
|
|
resources: [ingresses]
|
|
verbs: [get, list, watch, create, update, patch]
|
|
- apiGroups: [apps]
|
|
resources: [replicasets]
|
|
verbs: [get, list, watch]
|
|
- apiGroups: [""]
|
|
resources: [pods, events]
|
|
verbs: [get, list, watch]
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRoleBinding
|
|
metadata:
|
|
name: homelab-k3s-deployer
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: ClusterRole
|
|
name: homelab-k3s-deployer
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: gitea-deployer
|
|
namespace: default
|