58 lines
1.6 KiB
YAML
58 lines
1.6 KiB
YAML
# One-shot bootstrap: restart the control-plane apiservers ONCE so they pick up the
|
|
# OIDC authenticator (they last started before the Authentik provider existed, so
|
|
# OIDC tokens were never accepted). Delete this whole directory afterwards.
|
|
---
|
|
apiVersion: v1
|
|
kind: ServiceAccount
|
|
metadata:
|
|
name: oidc-bootstrap
|
|
namespace: kube-system
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: Role
|
|
metadata:
|
|
name: oidc-bootstrap
|
|
namespace: kube-system
|
|
rules:
|
|
- apiGroups: [""]
|
|
resources: ["pods"]
|
|
verbs: ["get", "list", "delete"]
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: RoleBinding
|
|
metadata:
|
|
name: oidc-bootstrap
|
|
namespace: kube-system
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: oidc-bootstrap
|
|
namespace: kube-system
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: Role
|
|
name: oidc-bootstrap
|
|
---
|
|
apiVersion: batch/v1
|
|
kind: Job
|
|
metadata:
|
|
name: oidc-bootstrap-restart-apiserver
|
|
namespace: kube-system
|
|
spec:
|
|
backoffLimit: 4
|
|
ttlSecondsAfterFinished: 7200
|
|
template:
|
|
spec:
|
|
serviceAccountName: oidc-bootstrap
|
|
restartPolicy: Never
|
|
containers:
|
|
- name: restart
|
|
image: docker.io/bitnami/kubectl:1.31.0
|
|
command: ["/bin/sh", "-c"]
|
|
args:
|
|
- |
|
|
set -u
|
|
echo "deleting the control-plane apiservers so OIDC initialises"
|
|
for pod in kube-apiserver-talos-cp-1 kube-apiserver-talos-cp-2 kube-apiserver-talos-cp-3; do
|
|
kubectl -n kube-system delete pod "$pod" --wait=false 2>&1 || true
|
|
done
|
|
echo "requested; kubelet recreates each static pod in ~20-40s" |