riotpiao-poimen/homelab
2
0
Fork 0
Code Issues 23 Pull Requests 2 Actions Packages Projects 1 Releases Wiki Activity

fix(oidc): use curlimages/curl for the bootstrap job (bitnami/kubectl tag did not exist)

Browse Source 
The first job could not pull its image; this one deletes the apiserver pods via the
in-cluster API with the mounted service-account token instead of a kubectl image.
This commit is contained in:
rock
2026-10-07 03:52:10 +00:00
parent 5d22691c3e
commit 2e4fad3bf7
1 changed files with 8 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
k8s/infra/oidc-bootstrap/bootstrap.yaml
+8 -7
View File
@@ -1,6 +1,6 @@
# One-shot bootstrap: restart the control-plane apiservers ONCE so they pick up the # One-shot bootstrap: restart the control-plane apiservers ONCE so they pick up the
# OIDC authenticator (they last started before the Authentik provider existed, so # OIDC authenticator (they last started before the Authentik provider existed, so OIDC
# OIDC tokens were never accepted). Delete this whole directory afterwards. # tokens were never accepted -> every login got 401). Delete this whole directory after.
--- ---
apiVersion: v1 apiVersion: v1
kind: ServiceAccount kind: ServiceAccount
@@ -35,7 +35,7 @@ roleRef:
apiVersion: batch/v1 apiVersion: batch/v1
kind: Job kind: Job
metadata: metadata:
name: oidc-bootstrap-restart-apiserver name: oidc-bootstrap-restart-apiserver-v2
namespace: kube-system namespace: kube-system
spec: spec:
backoffLimit: 4 backoffLimit: 4
@@ -46,13 +46,14 @@ spec:
restartPolicy: Never restartPolicy: Never
containers: containers:
- name: restart - name: restart
image: docker.io/bitnami/kubectl:1.31.0 image: docker.io/curlimages/curl:8.22.0
command: ["/bin/sh", "-c"] command: ["/bin/sh", "-c"]
args: args:
- | - |
set -u set -u
echo "deleting the control-plane apiservers so OIDC initialises" TOKEN=$(cat /var/run/secrets/kubernetes.io/serviceaccount/token)
CA=/var/run/secrets/kubernetes.io/serviceaccount/ca.crt
for pod in kube-apiserver-talos-cp-1 kube-apiserver-talos-cp-2 kube-apiserver-talos-cp-3; do for pod in kube-apiserver-talos-cp-1 kube-apiserver-talos-cp-2 kube-apiserver-talos-cp-3; do
kubectl -n kube-system delete pod "$pod" --wait=false 2>&1 || true curl -sS --max-time 15 --cacert "$CA" -H "Authorization: Bearer $TOKEN" -X DELETE "https://kubernetes.default.svc/api/v1/namespaces/kube-system/pods/$pod?gracePeriodSeconds=0" -o /dev/null -w "$pod -> HTTP %{http_code}\n" || echo "$pod -> request failed"
done done
echo "requested; kubelet recreates each static pod in ~20-40s" echo "deletes requested; kubelet recreates each static pod in ~20-40s"