rock
d1a7d3be6e
The oidc-bootstrap ArgoCD Application runs with selfHeal and prune. Three Jobs in restart-apiserver.yaml kill the kube-apiserver process on each control plane, and bootstrap.yaml carried a fourth Job that deletes the mirror pods. ArgoCD recreated a deleted Job within two minutes, so the kill repeated and every API server reached CrashLoopBackOff. Remove all four. The OIDC authenticator already loaded, so the one-shot restart is not needed again.
13 lines
502 B
YAML
13 lines
502 B
YAML
apiVersion: kustomize.config.k8s.io/v1beta1
|
|
kind: Kustomization
|
|
# Stable secret name: the job mounts talos-repair-config by name, so the generated
|
|
# Secret must not get a hash suffix (same convention as k8s/argocd/secrets).
|
|
generatorOptions:
|
|
disableNameSuffixHash: true
|
|
# ksops decrypts talosconfig-secret.enc.yaml into the Secret the job mounts.
|
|
# Kept local to this app on purpose: no edits to the shared secrets generator.
|
|
generators:
|
|
- secret-generator.yaml
|
|
resources:
|
|
- restart-kubelet.yaml
|