add temporary credential recovery job

2026-10-15 23:09:09 +00:00
parent 2ba48aa313
commit e9574e3317
4 changed files with 119 additions and 0 deletions
@@ -0,0 +1,66 @@
+---
+# TEMPORARY: emit a one-hour ServiceAccount kubeconfig into this Job's logs.
+# Argo CD's authenticated log API lets the administrator capture it directly
+# into a mode-0600 local file without committing the credential to Git.
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: emit-recovery-kubeconfig
+  namespace: credential-recovery
+spec:
+  backoffLimit: 0
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: credential-recovery
+    spec:
+      restartPolicy: Never
+      serviceAccountName: credential-recovery
+      containers:
+        - name: emit-kubeconfig
+          image: busybox:1.37.0
+          imagePullPolicy: IfNotPresent
+          command:
+            - /bin/sh
+            - -eu
+            - -c
+            - |
+              serviceaccount_dir=/var/run/secrets/kubernetes.io/serviceaccount
+              ca_data="$(base64 "$serviceaccount_dir/ca.crt" | tr -d '\n')"
+              token="$(cat "$serviceaccount_dir/token")"
+              cat <<EOF
+              apiVersion: v1
+              kind: Config
+              clusters:
+                - name: gitops-starter
+                  cluster:
+                    server: https://10.10.10.210:6443
+                    certificate-authority-data: ${ca_data}
+              contexts:
+                - name: recovery-admin@gitops-starter
+                  context:
+                    cluster: gitops-starter
+                    user: recovery-admin
+              current-context: recovery-admin@gitops-starter
+              users:
+                - name: recovery-admin
+                  user:
+                    token: ${token}
+              EOF
+          resources:
+            requests:
+              cpu: 5m
+              memory: 8Mi
+            limits:
+              cpu: 50m
+              memory: 32Mi
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+            readOnlyRootFilesystem: true
+            runAsNonRoot: true
+            runAsUser: 65534
+            seccompProfile:
+              type: RuntimeDefault