pissing me off

.gitea/workflows/build-docker-images.yml

@@ -103,162 +103,95 @@ jobs:
         with:
           version: 'v1.36.2'
 
-      - name: Configure Kubernetes access
+      - name: Configure Kubernetes CA
         env:
-          KUBE_TOKEN: ${{ secrets.KUBE_TOKEN }}
           KUBE_CA_B64: ${{ secrets.KUBE_CA_B64 }}
         run: |
           set -euo pipefail
 
-          if [ -z "${KUBE_TOKEN:-}" ]; then
-            echo "::error::KUBE_TOKEN is empty"
-            exit 1
-          fi
-
-          if [ -z "${KUBE_CA_B64:-}" ]; then
-            echo "::error::KUBE_CA_B64 is empty"
-            exit 1
-          fi
-
-          KUBECONFIG_PATH="${RUNNER_TEMP}/blog-kubeconfig"
-          CA_PATH="${RUNNER_TEMP}/kubernetes-ca.crt"
-
           printf '%s' "$KUBE_CA_B64" \
             | base64 -d \
-            > "$CA_PATH"
+            > "${RUNNER_TEMP}/kubernetes-ca.crt"
 
-          kubectl config \
+          chmod 600 "${RUNNER_TEMP}/kubernetes-ca.crt"
-            --kubeconfig="$KUBECONFIG_PATH" \
-            set-cluster talos-prod \
-            --server=https://10.10.10.210:6443 \
-            --tls-server-name=k8s-api.ahmza.com \
-            --certificate-authority="$CA_PATH" \
-            --embed-certs=true
 
-          kubectl config \
+          echo "KUBE_CA=${RUNNER_TEMP}/kubernetes-ca.crt" >> "$GITHUB_ENV"
-            --kubeconfig="$KUBECONFIG_PATH" \
-            set-credentials gitea-blog-deployer \
-            --token="$KUBE_TOKEN"
 
-          kubectl config \
+          - name: Verify Kubernetes access
-            --kubeconfig="$KUBECONFIG_PATH" \
+        env:
-            set-context blog-deployer@talos-prod \
+          KUBE_TOKEN: ${{ secrets.KUBE_TOKEN }}
-            --cluster=talos-prod \
-            --user=gitea-blog-deployer \
-            --namespace=blog-ahmza-com
-
-          kubectl config \
-            --kubeconfig="$KUBECONFIG_PATH" \
-            use-context blog-deployer@talos-prod
-
-          chmod 600 "$KUBECONFIG_PATH"
-
-          echo "KUBECONFIG=$KUBECONFIG_PATH" >> "$GITHUB_ENV"
-
-          echo
-          echo "Kubernetes configuration:"
-          echo -n "  API server: "
-          kubectl config \
-            --kubeconfig="$KUBECONFIG_PATH" \
-            view --minify \
-            -o jsonpath='{.clusters[0].cluster.server}'
-          echo
-
-          echo -n "  Context:    "
-          kubectl config \
-            --kubeconfig="$KUBECONFIG_PATH" \
-            current-context
-
-          echo
-
-          # Check that a bearer token really made it into the generated config
-          # without printing the token itself.
-          TOKEN_LENGTH="$(
-            kubectl config \
-              --kubeconfig="$KUBECONFIG_PATH" \
-              view --raw --minify \
-              -o jsonpath='{.users[0].user.token}' \
-            | wc -c
-          )"
-
-          echo "  Token length: $TOKEN_LENGTH"
-
-          if [ "$TOKEN_LENGTH" -lt 100 ]; then
-            echo "::error::Generated kubeconfig does not contain a valid-looking token"
-            exit 1
-          fi
-
-      - name: Verify Kubernetes access
         run: |
           set -euo pipefail
 
-          echo "Testing authenticated API access..."
+          kubectl \
-          kubectl -n blog-ahmza-com get deployment blog
+            --server=https://10.10.10.210:6443 \
+            --tls-server-name=k8s-api.ahmza.com \
+            --certificate-authority="$KUBE_CA" \
+            --token="$KUBE_TOKEN" \
+            -n blog-ahmza-com \
+            get deployment blog
 
           echo
-          echo "Testing intended permissions..."
+          echo "RBAC checks:"
 
-          if kubectl auth can-i patch deployments \
+          kubectl \
+            --server=https://10.10.10.210:6443 \
+            --tls-server-name=k8s-api.ahmza.com \
+            --certificate-authority="$KUBE_CA" \
+            --token="$KUBE_TOKEN" \
+            auth can-i patch deployments \
             -n blog-ahmza-com
-          then
-            echo "OK: deployment patch permitted"
-          else
-            echo "::error::Deployment patch unexpectedly denied"
-            exit 1
-          fi
 
-          echo
+          kubectl \
-          echo "Testing privilege boundary..."
+            --server=https://10.10.10.210:6443 \
-
+            --tls-server-name=k8s-api.ahmza.com \
-          if kubectl auth can-i get secrets \
+            --certificate-authority="$KUBE_CA" \
+            --token="$KUBE_TOKEN" \
+            auth can-i get secrets \
             -n blog-ahmza-com
-          then
-            echo "::error::CI account unexpectedly has Secret read access"
-            exit 1
-          else
-            echo "OK: Secret read correctly denied"
-          fi
 
       - name: Deploy to Kubernetes
         env:
+          KUBE_TOKEN: ${{ secrets.KUBE_TOKEN }}
           IMAGE: tea.ahmza.com/ahmza/blog-ahmza-com:${{ gitea.event.head_commit.id }}
         run: |
           set -euo pipefail
 
-          echo "Deploying image:"
+          k() {
+            kubectl \
+              --server=https://10.10.10.210:6443 \
+              --tls-server-name=k8s-api.ahmza.com \
+              --certificate-authority="$KUBE_CA" \
+              --token="$KUBE_TOKEN" \
+              -n blog-ahmza-com \
+              "$@"
+          }
+
+          echo "Deploying:"
           echo "  $IMAGE"
 
-          kubectl -n blog-ahmza-com \
+          k set image deployment/blog \
-            set image deployment/blog \
             blog="$IMAGE"
 
-          if ! kubectl -n blog-ahmza-com \
+          if ! k rollout status deployment/blog --timeout=5m; then
-            rollout status deployment/blog \
+            echo "::error::Deployment failed; rolling back"
-            --timeout=5m
-          then
-            echo "::error::New deployment failed. Rolling back."
 
-            kubectl -n blog-ahmza-com \
+            k rollout undo deployment/blog
-              rollout undo deployment/blog
+            k rollout status deployment/blog --timeout=5m
-
-            kubectl -n blog-ahmza-com \
-              rollout status deployment/blog \
-              --timeout=5m
 
             exit 1
           fi
 
           echo
-          echo "Deployment complete:"
+          k get pods -o wide
-          kubectl -n blog-ahmza-com get pods -o wide
 
           echo
-          echo "Running image:"
+          echo -n "Running image: "
-          kubectl -n blog-ahmza-com \
+          k get deployment blog \
-            get deployment blog \
             -o jsonpath='{.spec.template.spec.containers[?(@.name=="blog")].image}'
           echo
 
+
       - name: NetBird diagnostics & disconnect
         # Runs even on failure: captures final state for debugging and tears the
         # peer down so stale 'gitea-actions-blog' peers don't pile up.