feat: Kaniko 기반 CI/CD 설정

- gitea-runner: DinD 제거, Host 모드 전환
- gitea-runner: ServiceAccount, RBAC 추가
- gitea ns: zot-registry-credentials ExternalSecret 추가
- argocd ns: zot-registry-credentials ExternalSecret 추가

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

argocd/image-updater-manifests/zot-creds.yaml

@@ -0,0 +1,27 @@
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: zot-registry-credentials
+  namespace: argocd
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: vault-backend
+  target:
+    name: zot-registry-credentials
+    creationPolicy: Owner
+    template:
+      type: kubernetes.io/dockerconfigjson
+      data:
+        .dockerconfigjson: |
+          {"auths":{"zot0213.kro.kr":{"username":"{{ .USERNAME }}","password":"{{ .PASSWORD }}","auth":"{{ printf "%s:%s" .USERNAME .PASSWORD | b64enc }}"}}}
+  data:
+    - secretKey: USERNAME
+      remoteRef:
+        key: zot
+        property: USERNAME
+    - secretKey: PASSWORD
+      remoteRef:
+        key: zot
+        property: PASSWORD

gitea-runner/manifests/deployment.yaml

@@ -15,40 +15,20 @@ spec:
       labels:
         app: gitea-runner
     spec:
+      serviceAccountName: gitea-runner
       containers:
-      # Docker-in-Docker sidecar
-      - name: dind
-        image: docker:dind
-        securityContext:
-          privileged: true
-        env:
-        - name: DOCKER_TLS_CERTDIR
-          value: ""
-        volumeMounts:
-        - name: docker-graph
-          mountPath: /var/lib/docker
-        resources:
-          requests:
-            cpu: 100m
-            memory: 512Mi
-          limits:
-            memory: 2Gi
-      # Gitea Actions Runner
       - name: runner
         image: gitea/act_runner:latest
         command:
         - sh
         - -c
         - |
-          # Wait for Docker to be ready
-          echo "Waiting for Docker daemon..."
-          while ! docker info > /dev/null 2>&1; do
-            sleep 2
-          done
-          echo "Docker is ready!"
+          # Install kubectl
+          wget -q -O /usr/local/bin/kubectl "https://dl.k8s.io/release/$(wget -q -O - https://dl.k8s.io/release/stable.txt)/bin/linux/arm64/kubectl"
+          chmod +x /usr/local/bin/kubectl
 
           # Wait for Gitea to be ready
-          while ! wget -q --spider http://gitea-http.gitea.svc:3000/api/v1/version; do
+          while ! wget -q --spider http://gitea-http.gitea.svc:3000/api/v1/version 2>/dev/null; do
             echo "Waiting for Gitea to be ready..."
             sleep 5
           done
@@ -60,15 +40,13 @@ spec:
               --instance https://github0213.com \
               --token $(cat /secrets/token) \
               --name k3s-runner \
-              --labels k3s-home:docker://node:20-alpine,ubuntu-latest:docker://ubuntu:latest,arm64:host
+              --labels k3s-home:host
           fi
 
           act_runner daemon
         env:
         - name: GITEA_INSTANCE_URL
           value: "https://github0213.com"
-        - name: DOCKER_HOST
-          value: "tcp://localhost:2375"
         volumeMounts:
         - name: runner-data
           mountPath: /data
@@ -77,13 +55,11 @@ spec:
           readOnly: true
         resources:
           requests:
-            cpu: 100m
-            memory: 256Mi
+            cpu: 50m
+            memory: 128Mi
           limits:
-            memory: 1Gi
+            memory: 512Mi
       volumes:
-      - name: docker-graph
-        emptyDir: {}
       - name: runner-data
         emptyDir: {}
       - name: runner-secret

gitea-runner/manifests/rbac.yaml

@@ -0,0 +1,33 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: gitea-runner
+  namespace: gitea
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: gitea-runner-kaniko
+rules:
+- apiGroups: ["batch"]
+  resources: ["jobs"]
+  verbs: ["create", "delete", "get", "watch"]
+- apiGroups: [""]
+  resources: ["pods", "pods/log"]
+  verbs: ["get", "list", "watch"]
+- apiGroups: [""]
+  resources: ["secrets"]
+  verbs: ["get"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: gitea-runner-kaniko
+subjects:
+- kind: ServiceAccount
+  name: gitea-runner
+  namespace: gitea
+roleRef:
+  kind: ClusterRole
+  name: gitea-runner-kaniko
+  apiGroup: rbac.authorization.k8s.io

gitea-runner/manifests/zot-secret.yaml

@@ -0,0 +1,27 @@
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: zot-registry-credentials
+  namespace: gitea
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: vault-backend
+  target:
+    name: zot-registry-credentials
+    creationPolicy: Owner
+    template:
+      type: kubernetes.io/dockerconfigjson
+      data:
+        .dockerconfigjson: |
+          {"auths":{"zot0213.kro.kr":{"username":"{{ .USERNAME }}","password":"{{ .PASSWORD }}","auth":"{{ printf "%s:%s" .USERNAME .PASSWORD | b64enc }}"}}}
+  data:
+    - secretKey: USERNAME
+      remoteRef:
+        key: zot
+        property: USERNAME
+    - secretKey: PASSWORD
+      remoteRef:
+        key: zot
+        property: PASSWORD