From 4eee161e0f1f68b4b271a2f211dff871dc86651f Mon Sep 17 00:00:00 2001
From: Rock <locartrock@gmail.com>
Date: Wed, 7 Oct 2026 03:45:56 +0000
Subject: [PATCH] chore(oidc): one-shot bootstrap - restart apiservers to
 initialise the OIDC authenticator

k8s/infra/oidc-bootstrap/bootstrap.yaml
---
 k8s/infra/oidc-bootstrap/bootstrap.yaml | 58 +++++++++++++++++++++++++
 1 file changed, 58 insertions(+)
 create mode 100644 k8s/infra/oidc-bootstrap/bootstrap.yaml

diff --git a/k8s/infra/oidc-bootstrap/bootstrap.yaml b/k8s/infra/oidc-bootstrap/bootstrap.yaml
new file mode 100644
index 0000000..4420957
--- /dev/null
+++ b/k8s/infra/oidc-bootstrap/bootstrap.yaml
@@ -0,0 +1,58 @@
+# One-shot bootstrap: restart the control-plane apiservers ONCE so they pick up the
+# OIDC authenticator (they last started before the Authentik provider existed, so
+# OIDC tokens were never accepted). Delete this whole directory afterwards.
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: oidc-bootstrap
+  namespace: kube-system
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: oidc-bootstrap
+  namespace: kube-system
+rules:
+  - apiGroups: [""]
+    resources: ["pods"]
+    verbs: ["get", "list", "delete"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: oidc-bootstrap
+  namespace: kube-system
+subjects:
+  - kind: ServiceAccount
+    name: oidc-bootstrap
+    namespace: kube-system
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: oidc-bootstrap
+---
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: oidc-bootstrap-restart-apiserver
+  namespace: kube-system
+spec:
+  backoffLimit: 4
+  ttlSecondsAfterFinished: 7200
+  template:
+    spec:
+      serviceAccountName: oidc-bootstrap
+      restartPolicy: Never
+      containers:
+        - name: restart
+          image: docker.io/bitnami/kubectl:1.31.0
+          command: ["/bin/sh", "-c"]
+          args:
+            - |
+              set -u
+              echo "deleting the control-plane apiservers so OIDC initialises"
+              for pod in kube-apiserver-talos-cp-1 kube-apiserver-talos-cp-2 kube-apiserver-talos-cp-3; do
+                kubectl -n kube-system delete pod "$pod" --wait=false 2>&1 || true
+              done
+              echo "requested; kubelet recreates each static pod in ~20-40s"
\ No newline at end of file