# One-shot bootstrap: restart the control-plane apiservers ONCE so they pick up the
# OIDC authenticator (they last started before the Authentik provider existed, so OIDC
# tokens were never accepted -> every login got 401). Delete this whole directory after.
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: oidc-bootstrap
  namespace: kube-system
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: oidc-bootstrap
  namespace: kube-system
rules:
  - apiGroups: [""]
    resources: ["pods"]
    verbs: ["get", "list", "delete"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: oidc-bootstrap
  namespace: kube-system
subjects:
  - kind: ServiceAccount
    name: oidc-bootstrap
    namespace: kube-system
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: oidc-bootstrap
---
apiVersion: batch/v1
kind: Job
metadata:
  name: oidc-bootstrap-restart-apiserver-v2
  namespace: kube-system
spec:
  backoffLimit: 4
  ttlSecondsAfterFinished: 7200
  template:
    spec:
      serviceAccountName: oidc-bootstrap
      restartPolicy: Never
      containers:
        - name: restart
          image: docker.io/curlimages/curl:8.22.0
          command: ["/bin/sh", "-c"]
          args:
            - |
              set -u
              TOKEN=$(cat /var/run/secrets/kubernetes.io/serviceaccount/token)
              CA=/var/run/secrets/kubernetes.io/serviceaccount/ca.crt
              for pod in kube-apiserver-talos-cp-1 kube-apiserver-talos-cp-2 kube-apiserver-talos-cp-3; do
                curl -sS --max-time 15 --cacert "$CA" -H "Authorization: Bearer $TOKEN"                   -X DELETE "https://kubernetes.default.svc/api/v1/namespaces/kube-system/pods/$pod?gracePeriodSeconds=0"                   -o /dev/null -w "$pod -> HTTP %{http_code}\n" || echo "$pod -> request failed"
              done
              echo "deletes requested; kubelet recreates each static pod in ~20-40s"