From c0a6c050b59b646ce989629a77415f8ad14de4fd Mon Sep 17 00:00:00 2001
From: swaphb <s@swaphb.com>
Date: Tue, 11 Aug 2026 17:00:44 -0400
Subject: [PATCH] fix k3d kubeconfig for Docker runner

---
 .github/workflows/kube-bench-scan.yml          | 9 +++++++++
 scripts/proxmox/create-flatcar-gitea-runner.sh | 1 +
 2 files changed, 10 insertions(+)

diff --git a/.github/workflows/kube-bench-scan.yml b/.github/workflows/kube-bench-scan.yml
index de43a4a..0e7f3ca 100644
--- a/.github/workflows/kube-bench-scan.yml
+++ b/.github/workflows/kube-bench-scan.yml
@@ -42,6 +42,15 @@ jobs:
         run: |
           k3d cluster delete security-baseline-ci >/dev/null 2>&1 || true
           k3d cluster create --config ci/k3d-ci-cluster-config.yaml
+          mkdir -p "$HOME/.kube"
+          k3d kubeconfig get security-baseline-ci > "$HOME/.kube/config"
+          api_host=127.0.0.1
+          if getent hosts host.docker.internal >/dev/null 2>&1; then
+            api_host=host.docker.internal
+          elif command -v ip >/dev/null 2>&1; then
+            api_host="$(ip route | awk '/default/ {print $3; exit}')"
+          fi
+          sed -i -E "s#https://0\.0\.0\.0:#https://${api_host}:#" "$HOME/.kube/config"
           kubectl wait --for=condition=Ready nodes --all --timeout=180s
           kubectl get nodes -o wide
 
diff --git a/scripts/proxmox/create-flatcar-gitea-runner.sh b/scripts/proxmox/create-flatcar-gitea-runner.sh
index eee58a6..975e077 100755
--- a/scripts/proxmox/create-flatcar-gitea-runner.sh
+++ b/scripts/proxmox/create-flatcar-gitea-runner.sh
@@ -141,6 +141,7 @@ ExecStart=/usr/bin/docker run --name gitea-runner --rm \\
   --env GITEA_RUNNER_NAME \\
   --env GITEA_RUNNER_LABELS \\
   --env-file /var/lib/gitea-runner/runner.env \\
+  --add-host host.docker.internal:host-gateway \\
   --volume /var/run/docker.sock:/var/run/docker.sock \\
   --volume /var/lib/gitea-runner:/data \\
   $GITEA_RUNNER_IMAGE