From e40a4d0c7269c31ab479e815ea5a762f41171d98 Mon Sep 17 00:00:00 2001
From: Ultradesu <ultradesu@hexor.cy>
Date: Thu, 30 Jul 2026 16:48:37 +0100
Subject: [PATCH] Fixed gitea runner k8s auth

---
 k8s/apps/gitea/deployment.yaml    |  1 +
 k8s/apps/gitea/kustomization.yaml |  1 +
 k8s/apps/gitea/runner-rbac.yaml   | 52 +++++++++++++++++++++++++++++++
 3 files changed, 54 insertions(+)
 create mode 100644 k8s/apps/gitea/runner-rbac.yaml

diff --git a/k8s/apps/gitea/deployment.yaml b/k8s/apps/gitea/deployment.yaml
index 02f644c..76e6bee 100644
--- a/k8s/apps/gitea/deployment.yaml
+++ b/k8s/apps/gitea/deployment.yaml
@@ -79,6 +79,7 @@ spec:
       labels:
         app: gitea-runner
     spec:
+      serviceAccountName: gitea-runner
       dnsConfig:
         options:
           - name: ndots
diff --git a/k8s/apps/gitea/kustomization.yaml b/k8s/apps/gitea/kustomization.yaml
index 85144a4..cadf3bb 100644
--- a/k8s/apps/gitea/kustomization.yaml
+++ b/k8s/apps/gitea/kustomization.yaml
@@ -5,6 +5,7 @@ resources:
   - app.yaml
   - external-secrets.yaml
   - deployment.yaml
+  - runner-rbac.yaml
   - user-unban-cronjob.yaml
   - service.yaml
   - ingress.yaml
diff --git a/k8s/apps/gitea/runner-rbac.yaml b/k8s/apps/gitea/runner-rbac.yaml
new file mode 100644
index 0000000..3fb8ef1
--- /dev/null
+++ b/k8s/apps/gitea/runner-rbac.yaml
@@ -0,0 +1,52 @@
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: gitea-runner
+  namespace: gitea
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: gitea-runner-kubernetes-token
+  namespace: gitea
+  annotations:
+    kubernetes.io/service-account.name: gitea-runner
+type: kubernetes.io/service-account-token
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: auth-proxy-routes-manager
+  namespace: auth-proxy
+rules:
+  - apiGroups:
+      - ""
+    resources:
+      - configmaps
+    resourceNames:
+      - auth-proxy-routes
+    verbs:
+      - get
+      - update
+      - patch
+  - apiGroups:
+      - ""
+    resources:
+      - configmaps
+    verbs:
+      - create
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: gitea-runner-auth-proxy-routes
+  namespace: auth-proxy
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: auth-proxy-routes-manager
+subjects:
+  - kind: ServiceAccount
+    name: gitea-runner
+    namespace: gitea