rock
2e4fad3bf7
The first job could not pull its image; this one deletes the apiserver pods via the in-cluster API with the mounted service-account token instead of a kubectl image.
59 lines
1.9 KiB
YAML
59 lines
1.9 KiB
YAML
# One-shot bootstrap: restart the control-plane apiservers ONCE so they pick up the
|
|
# OIDC authenticator (they last started before the Authentik provider existed, so OIDC
|
|
# tokens were never accepted -> every login got 401). Delete this whole directory after.
|
|
---
|
|
apiVersion: v1
|
|
kind: ServiceAccount
|
|
metadata:
|
|
name: oidc-bootstrap
|
|
namespace: kube-system
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: Role
|
|
metadata:
|
|
name: oidc-bootstrap
|
|
namespace: kube-system
|
|
rules:
|
|
- apiGroups: [""]
|
|
resources: ["pods"]
|
|
verbs: ["get", "list", "delete"]
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: RoleBinding
|
|
metadata:
|
|
name: oidc-bootstrap
|
|
namespace: kube-system
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: oidc-bootstrap
|
|
namespace: kube-system
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: Role
|
|
name: oidc-bootstrap
|
|
---
|
|
apiVersion: batch/v1
|
|
kind: Job
|
|
metadata:
|
|
name: oidc-bootstrap-restart-apiserver-v2
|
|
namespace: kube-system
|
|
spec:
|
|
backoffLimit: 4
|
|
ttlSecondsAfterFinished: 7200
|
|
template:
|
|
spec:
|
|
serviceAccountName: oidc-bootstrap
|
|
restartPolicy: Never
|
|
containers:
|
|
- name: restart
|
|
image: docker.io/curlimages/curl:8.22.0
|
|
command: ["/bin/sh", "-c"]
|
|
args:
|
|
- |
|
|
set -u
|
|
TOKEN=$(cat /var/run/secrets/kubernetes.io/serviceaccount/token)
|
|
CA=/var/run/secrets/kubernetes.io/serviceaccount/ca.crt
|
|
for pod in kube-apiserver-talos-cp-1 kube-apiserver-talos-cp-2 kube-apiserver-talos-cp-3; do
|
|
curl -sS --max-time 15 --cacert "$CA" -H "Authorization: Bearer $TOKEN" -X DELETE "https://kubernetes.default.svc/api/v1/namespaces/kube-system/pods/$pod?gracePeriodSeconds=0" -o /dev/null -w "$pod -> HTTP %{http_code}\n" || echo "$pod -> request failed"
|
|
done
|
|
echo "deletes requested; kubelet recreates each static pod in ~20-40s" |