# One-shot bootstrap: restart the control-plane apiservers ONCE so they pick up the
# OIDC authenticator (they last started before the Authentik provider existed, so
# OIDC tokens were never accepted). Delete this whole directory afterwards.
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: oidc-bootstrap
  namespace: kube-system
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: oidc-bootstrap
  namespace: kube-system
rules:
  - apiGroups: [""]
    resources: ["pods"]
    verbs: ["get", "list", "delete"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: oidc-bootstrap
  namespace: kube-system
subjects:
  - kind: ServiceAccount
    name: oidc-bootstrap
    namespace: kube-system
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: oidc-bootstrap
---
apiVersion: batch/v1
kind: Job
metadata:
  name: oidc-bootstrap-restart-apiserver
  namespace: kube-system
spec:
  backoffLimit: 4
  ttlSecondsAfterFinished: 7200
  template:
    spec:
      serviceAccountName: oidc-bootstrap
      restartPolicy: Never
      containers:
        - name: restart
          image: docker.io/bitnami/kubectl:1.31.0
          command: ["/bin/sh", "-c"]
          args:
            - |
              set -u
              echo "deleting the control-plane apiservers so OIDC initialises"
              for pod in kube-apiserver-talos-cp-1 kube-apiserver-talos-cp-2 kube-apiserver-talos-cp-3; do
                kubectl -n kube-system delete pod "$pod" --wait=false 2>&1 || true
              done
              echo "requested; kubelet recreates each static pod in ~20-40s"