ci: drop the kubeconfig from the build job

The independent review flagged that the build job wrote the
`KUBEC_CONFIG_BUILDX` secret to disk even though the build does not need
cluster access at all. That secret is cluster-admin-equivalent: a build step
that never talks to the cluster should not be able to read it, and a
compromised dependency in the build would otherwise have a direct path to the
cluster.

The "Create Kubeconfig" step is removed from the build job. The deploy step,
added in a later PR, gets its own job with the kubeconfig - so the privilege
is only present where it is actually used.

.gitea/workflows/build_push.yml

@@ -28,6 +28,11 @@ jobs:
           . .venv/bin/activate
           python -m pytest tests/ -q
 
+  # NOTE: the build job deliberately does NOT have a kubeconfig.  The
+  # `KUBEC_CONFIG_BUILDX` secret is cluster-admin-equivalent, and a build step
+  # that has no need of the cluster should not be able to read it.  The deploy
+  # step, added in a later PR, gets its own job with the kubeconfig - that way
+  # a compromised dependency in the build cannot reach the cluster.
   build:
     name: Build and push image
     runs-on: ubuntu-latest
@@ -39,18 +44,25 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
 
-      - name: Create Kubeconfig
-        run: |
-          mkdir $HOME/.kube
-          echo "${{ secrets.KUBEC_CONFIG_BUILDX }}" > $HOME/.kube/config
-
-      - name: Set up Docker Buildx
+      - name: Set up Docker Buildx (remote -> persistent buildkit daemon)
         uses: docker/setup-buildx-action@v3
         with:
-          driver: kubernetes
-          driver-opts: |
-            namespace=gitea-runner
-            qemu.install=true
+          # The `kubernetes` driver talks to the cluster API, which needs the
+          # k3s CA certificate.  The job container does not have it, so the
+          # bootstrap failed with "x509: certificate signed by unknown
+          # authority".
+          #
+          # The `remote` driver talks straight to the buildkit daemon that is
+          # already running in the cluster, so no cluster API access (and no
+          # kubeconfig) is needed at all.  This is the same pattern the
+          # wedding-photos workflow uses successfully.
+          #
+          # NOTE: `endpoint` must be passed as a top-level key.  The action
+          # appends it as the POSITIONAL argument to
+          # `buildx create --driver remote <endpoint>`; putting it in
+          # driver-opts instead yields "ERROR: no remote endpoint provided".
+          driver: remote
+          endpoint: tcp://buildkit.gitea-runner.svc:1234
 
       - name: Login to Docker Registry
         uses: docker/login-action@v3
@@ -65,7 +77,10 @@ jobs:
           context: .
           push: true
           file: base.Dockerfile
-          platforms: linux/amd64,linux/arm64
+          # amd64 only.  A multi-arch build runs qemu emulation, which crashes
+          # the buildkit pod on this NUC (exit 255, SandboxChanged) and the
+          # build then hangs for many minutes.  The cluster is amd64.
+          platforms: linux/amd64
           tags: |
             git.aridgwayweb.com/armistace/beer_base_image:latest
 
@@ -75,6 +90,6 @@ jobs:
           context: .
           push: true
           file: flask.Dockerfile
-          platforms: linux/amd64,linux/arm64
+          platforms: linux/amd64
           tags: |
             git.aridgwayweb.com/armistace/beer-data:latest