Fix CI registry isolation and deployment prerequisites

.gitea/workflows/deploy.yml

@@ -26,6 +26,9 @@ jobs:
           fi
           echo "$KUBE_CONFIG_BASE64" | base64 -d > kubeconfig
           export KUBECONFIG="$PWD/kubeconfig"
+          cluster=$(kubectl config view --minify -o jsonpath='{.contexts[0].context.cluster}')
+          kubectl config set-cluster "$cluster" --server=https://host.containers.internal:6443 --tls-server-name=192.168.0.2
+          trap 'rm -f "$KUBECONFIG"' EXIT
           ./deploy.sh
           rm -f kubeconfig
         env:

create-ci-kubeconfig.sh

@@ -15,10 +15,11 @@ done
 [[ -n ${token:-} ]] || { echo 'Service account token was not issued' >&2; exit 1; }
 workdir=$(mktemp -d)
 trap 'rm -rf "${workdir}"' EXIT
-server=$(kubectl config view --minify -o jsonpath='{.clusters[0].cluster.server}')
+server=${KUBERNETES_API:-https://host.containers.internal:6443}
+tls_server_name=${KUBERNETES_TLS_SERVER_NAME:-192.168.0.2}
 kubectl -n "${namespace}" get secret "${secret}" -o jsonpath='{.data.ca\.crt}' | base64 -d > "${workdir}/ca.crt"
 export KUBECONFIG="${workdir}/config"
-kubectl config set-cluster homelab --server="${server}" --certificate-authority="${workdir}/ca.crt" --embed-certs=true >/dev/null
+kubectl config set-cluster homelab --server="${server}" --tls-server-name="${tls_server_name}" --certificate-authority="${workdir}/ca.crt" --embed-certs=true >/dev/null
 kubectl config set-credentials "${account}" --token="$(printf '%s' "${token}" | base64 -d)" >/dev/null
 kubectl config set-context homelab --cluster=homelab --user="${account}" --namespace="${namespace}" >/dev/null
 kubectl config use-context homelab >/dev/null