Fixed gitea runner k8s auth

k8s/apps/gitea/deployment.yaml

@@ -79,6 +79,7 @@ spec:
       labels:
         app: gitea-runner
     spec:
+      serviceAccountName: gitea-runner
       dnsConfig:
         options:
           - name: ndots

k8s/apps/gitea/kustomization.yaml

@@ -5,6 +5,7 @@ resources:
   - app.yaml
   - external-secrets.yaml
   - deployment.yaml
+  - runner-rbac.yaml
   - user-unban-cronjob.yaml
   - service.yaml
   - ingress.yaml

k8s/apps/gitea/runner-rbac.yaml

@@ -0,0 +1,52 @@
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: gitea-runner
+  namespace: gitea
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: gitea-runner-kubernetes-token
+  namespace: gitea
+  annotations:
+    kubernetes.io/service-account.name: gitea-runner
+type: kubernetes.io/service-account-token
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: auth-proxy-routes-manager
+  namespace: auth-proxy
+rules:
+  - apiGroups:
+      - ""
+    resources:
+      - configmaps
+    resourceNames:
+      - auth-proxy-routes
+    verbs:
+      - get
+      - update
+      - patch
+  - apiGroups:
+      - ""
+    resources:
+      - configmaps
+    verbs:
+      - create
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: gitea-runner-auth-proxy-routes
+  namespace: auth-proxy
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: auth-proxy-routes-manager
+subjects:
+  - kind: ServiceAccount
+    name: gitea-runner
+    namespace: gitea