add temporary credential recovery job

apps/recovery.yaml

@@ -0,0 +1,31 @@
+# TEMPORARY disaster-recovery application. This creates a short-lived
+# administrative ServiceAccount so a lost kubeconfig can be replaced through
+# the still-working Argo CD control plane. Remove this file and apps/recovery/
+# immediately after access is restored; the finalizer then deletes everything.
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: credential-recovery
+  namespace: argocd
+  finalizers:
+    # Cascading deletion is essential here: it removes the temporary
+    # cluster-admin binding rather than leaving privileged access behind.
+    - resources-finalizer.argocd.argoproj.io
+spec:
+  project: default
+
+  source:
+    repoURL: https://tea.ahmza.com/ahmza.com/k8s-starter-pack.git
+    targetRevision: main
+    path: apps/recovery
+
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: credential-recovery
+
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true

apps/recovery/clusterrolebinding.yaml

@@ -0,0 +1,16 @@
+---
+# TEMPORARY: this binding exists only long enough to replace the lost
+# administrator kubeconfig. The recovery Application's cascading finalizer
+# removes it when apps/recovery.yaml is deleted from Git.
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: credential-recovery-admin
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: cluster-admin
+subjects:
+  - kind: ServiceAccount
+    name: credential-recovery
+    namespace: credential-recovery

apps/recovery/job.yaml

@@ -0,0 +1,66 @@
+---
+# TEMPORARY: emit a one-hour ServiceAccount kubeconfig into this Job's logs.
+# Argo CD's authenticated log API lets the administrator capture it directly
+# into a mode-0600 local file without committing the credential to Git.
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: emit-recovery-kubeconfig
+  namespace: credential-recovery
+spec:
+  backoffLimit: 0
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: credential-recovery
+    spec:
+      restartPolicy: Never
+      serviceAccountName: credential-recovery
+      containers:
+        - name: emit-kubeconfig
+          image: busybox:1.37.0
+          imagePullPolicy: IfNotPresent
+          command:
+            - /bin/sh
+            - -eu
+            - -c
+            - |
+              serviceaccount_dir=/var/run/secrets/kubernetes.io/serviceaccount
+              ca_data="$(base64 "$serviceaccount_dir/ca.crt" | tr -d '\n')"
+              token="$(cat "$serviceaccount_dir/token")"
+              cat <<EOF
+              apiVersion: v1
+              kind: Config
+              clusters:
+                - name: gitops-starter
+                  cluster:
+                    server: https://10.10.10.210:6443
+                    certificate-authority-data: ${ca_data}
+              contexts:
+                - name: recovery-admin@gitops-starter
+                  context:
+                    cluster: gitops-starter
+                    user: recovery-admin
+              current-context: recovery-admin@gitops-starter
+              users:
+                - name: recovery-admin
+                  user:
+                    token: ${token}
+              EOF
+          resources:
+            requests:
+              cpu: 5m
+              memory: 8Mi
+            limits:
+              cpu: 50m
+              memory: 32Mi
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+            readOnlyRootFilesystem: true
+            runAsNonRoot: true
+            runAsUser: 65534
+            seccompProfile:
+              type: RuntimeDefault

apps/recovery/serviceaccount.yaml

@@ -0,0 +1,6 @@
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: credential-recovery
+  namespace: credential-recovery