chore(oidc): one-shot bootstrap - restart apiservers to initialise the OIDC authenticator

k8s/infra/oidc-bootstrap/bootstrap.yaml

k8s/infra/oidc-bootstrap/bootstrap.yaml

@@ -0,0 +1,58 @@
+# One-shot bootstrap: restart the control-plane apiservers ONCE so they pick up the
+# OIDC authenticator (they last started before the Authentik provider existed, so
+# OIDC tokens were never accepted). Delete this whole directory afterwards.
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: oidc-bootstrap
+  namespace: kube-system
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: oidc-bootstrap
+  namespace: kube-system
+rules:
+  - apiGroups: [""]
+    resources: ["pods"]
+    verbs: ["get", "list", "delete"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: oidc-bootstrap
+  namespace: kube-system
+subjects:
+  - kind: ServiceAccount
+    name: oidc-bootstrap
+    namespace: kube-system
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: oidc-bootstrap
+---
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: oidc-bootstrap-restart-apiserver
+  namespace: kube-system
+spec:
+  backoffLimit: 4
+  ttlSecondsAfterFinished: 7200
+  template:
+    spec:
+      serviceAccountName: oidc-bootstrap
+      restartPolicy: Never
+      containers:
+        - name: restart
+          image: docker.io/bitnami/kubectl:1.31.0
+          command: ["/bin/sh", "-c"]
+          args:
+            - |
+              set -u
+              echo "deleting the control-plane apiservers so OIDC initialises"
+              for pod in kube-apiserver-talos-cp-1 kube-apiserver-talos-cp-2 kube-apiserver-talos-cp-3; do
+                kubectl -n kube-system delete pod "$pod" --wait=false 2>&1 || true
+              done
+              echo "requested; kubelet recreates each static pod in ~20-40s"