chore: prefer in-cluster serviceaccount for kubectl

2026-07-22 14:23:23 +00:00
parent e9e4479ba3
commit 34e7fc53ee
1 changed files with 13 additions and 1 deletions
@@ -35,7 +35,19 @@ jobs:
      - name: Configure kubectl
        run: |
          mkdir -p ~/.kube
-          printf '%s' '${{ secrets.KUBECONFIG_B64 }}' | base64 -d > ~/.kube/config
+          if [ -f /var/run/secrets/kubernetes.io/serviceaccount/token ] && [ -n "${KUBERNETES_SERVICE_HOST:-}" ]; then
+            NS=$(cat /var/run/secrets/kubernetes.io/serviceaccount/namespace)
+            TOKEN=$(cat /var/run/secrets/kubernetes.io/serviceaccount/token)
+            API_SERVER="https://${KUBERNETES_SERVICE_HOST}:${KUBERNETES_SERVICE_PORT_HTTPS:-443}"
+            kubectl config set-cluster in-cluster --server="$API_SERVER" --certificate-authority=/var/run/secrets/kubernetes.io/serviceaccount/ca.crt --embed-certs=true
+            kubectl config set-credentials ci-deployer --token="$TOKEN"
+            kubectl config set-context ci-deployer --cluster=in-cluster --user=ci-deployer --namespace="$NS"
+            kubectl config use-context ci-deployer
+          elif [ -n '${{ secrets.KUBECONFIG }}' ]; then
+            printf '%s' '${{ secrets.KUBECONFIG }}' > ~/.kube/config
+          else
+            printf '%s' '${{ secrets.KUBECONFIG_B64 }}' | base64 -d > ~/.kube/config
+          fi

      - name: Rollout
        run: |