From 36db843a79c779bc32064d365ab4296742fa49cb Mon Sep 17 00:00:00 2001
From: Story Crater Bot <19826264+Riotpiaole@users.noreply.github.com>
Date: Tue, 21 Jul 2026 16:50:22 -0700
Subject: [PATCH] fix(iam): authentik-provision Job failing on apk permission
 denied

Job was crash-looping: 'apk add --no-cache curl' failed with Permission
denied - the container runs as non-root UID 1000 (securityContext.
runAsNonRoot: true), and both apk's working directories and /usr/local/bin
(where curl-downloaded kubectl was being written) are root-owned in the
python:3.12-alpine base image.

Replaced with a pure-Python download via urllib (stdlib, already a
dependency of this Job) writing to /tmp (world-writable) instead - no apk
install needed at all. PATH is extended to include /tmp before invoking the
provisioning script so authentik-provision.py's existing
subprocess.run(['kubectl', ...]) calls resolve it via normal PATH lookup,
no changes needed to the script itself.
---
 k8s/security/iam/authentik-provision-job.yaml | 18 +++++++++++++-----
 1 file changed, 13 insertions(+), 5 deletions(-)

diff --git a/k8s/security/iam/authentik-provision-job.yaml b/k8s/security/iam/authentik-provision-job.yaml
index a1a2969..5caa541 100644
--- a/k8s/security/iam/authentik-provision-job.yaml
+++ b/k8s/security/iam/authentik-provision-job.yaml
@@ -479,11 +479,19 @@ spec:
               until wget -q -O /dev/null http://authentik-server.iam.svc.cluster.local/-/health/ready/ 2>/dev/null; do
                 sleep 5
               done
-              echo "installing kubectl..."
-              apk add --no-cache curl >/dev/null
-              KVER=$(curl -sL https://dl.k8s.io/release/stable.txt)
-              curl -sLo /usr/local/bin/kubectl "https://dl.k8s.io/release/${KVER}/bin/linux/amd64/kubectl"
-              chmod +x /usr/local/bin/kubectl
+              echo "installing kubectl (via python urllib - no apk/curl: this"
+              echo "container runs as non-root UID 1000 and can't write to"
+              echo "apk's directories or /usr/local/bin, both root-owned in"
+              echo "the python:3.12-alpine image; /tmp is world-writable)..."
+              python3 -c "
+              import urllib.request, os, stat
+              kver = urllib.request.urlopen('https://dl.k8s.io/release/stable.txt').read().decode().strip()
+              url = f'https://dl.k8s.io/release/{kver}/bin/linux/amd64/kubectl'
+              urllib.request.urlretrieve(url, '/tmp/kubectl')
+              st = os.stat('/tmp/kubectl')
+              os.chmod('/tmp/kubectl', st.st_mode | stat.S_IEXEC)
+              "
+              export PATH="/tmp:$PATH"
               echo "running provisioning script..."
               python3 /script/authentik-provision.py
       volumes: