will it actually work now ?

.gitea/workflows/build-docker-images.yml

@@ -105,82 +105,128 @@ jobs:
 
       - name: Configure Kubernetes access
         env:
-          KUBE_CONFIG_B64: ${{ secrets.TALOS_PROD_KUBE_CONFIG }}
+          KUBE_TOKEN: ${{ secrets.KUBE_TOKEN }}
+          KUBE_CA_B64: ${{ secrets.KUBE_CA_B64 }}
         run: |
           set -euo pipefail
 
-          if [ -z "${KUBE_CONFIG_B64:-}" ]; then
+          if [ -z "${KUBE_TOKEN:-}" ]; then
-            echo "::error::KUBE_CONFIG secret is empty or unavailable"
+            echo "::error::KUBE_TOKEN is empty"
             exit 1
           fi
 
-          KUBECONFIG_PATH="${RUNNER_TEMP}/gitea-blog-kubeconfig"
+          if [ -z "${KUBE_CA_B64:-}" ]; then
+            echo "::error::KUBE_CA_B64 is empty"
+            exit 1
+          fi
 
-          printf '%s' "$KUBE_CONFIG_B64" \
+          KUBECONFIG_PATH="${RUNNER_TEMP}/blog-kubeconfig"
+          CA_PATH="${RUNNER_TEMP}/kubernetes-ca.crt"
+
+          printf '%s' "$KUBE_CA_B64" \
             | base64 -d \
-            > "$KUBECONFIG_PATH"
+            > "$CA_PATH"
 
-          chmod 600 "$KUBECONFIG_PATH"
-
-          echo "Available contexts:"
           kubectl config \
             --kubeconfig="$KUBECONFIG_PATH" \
-            get-contexts
+            set-cluster talos-prod \
+            --server=https://10.10.10.210:6443 \
+            --tls-server-name=k8s-api.ahmza.com \
+            --certificate-authority="$CA_PATH" \
+            --embed-certs=true
+
+          kubectl config \
+            --kubeconfig="$KUBECONFIG_PATH" \
+            set-credentials gitea-blog-deployer \
+            --token="$KUBE_TOKEN"
+
+          kubectl config \
+            --kubeconfig="$KUBECONFIG_PATH" \
+            set-context blog-deployer@talos-prod \
+            --cluster=talos-prod \
+            --user=gitea-blog-deployer \
+            --namespace=blog-ahmza-com
 
           kubectl config \
             --kubeconfig="$KUBECONFIG_PATH" \
             use-context blog-deployer@talos-prod
 
-          # Make this kubeconfig explicit for every later workflow step.
+          chmod 600 "$KUBECONFIG_PATH"
+
           echo "KUBECONFIG=$KUBECONFIG_PATH" >> "$GITHUB_ENV"
 
-          echo "Kubeconfig decoded successfully."
+          echo
-
+          echo "Kubernetes configuration:"
-          # Safe diagnostics: these do NOT print the bearer token.
+          echo -n "  API server: "
-          echo -n "Context: "
+          kubectl config \
-          KUBECONFIG="$KUBECONFIG_PATH" kubectl config current-context
+            --kubeconfig="$KUBECONFIG_PATH" \
-
+            view --minify \
-          echo -n "API server: "
-          KUBECONFIG="$KUBECONFIG_PATH" \
-            kubectl config view --minify \
             -o jsonpath='{.clusters[0].cluster.server}'
           echo
 
+          echo -n "  Context:    "
+          kubectl config \
+            --kubeconfig="$KUBECONFIG_PATH" \
+            current-context
+
+          echo
+
+          # Check that a bearer token really made it into the generated config
+          # without printing the token itself.
+          TOKEN_LENGTH="$(
+            kubectl config \
+              --kubeconfig="$KUBECONFIG_PATH" \
+              view --raw --minify \
+              -o jsonpath='{.users[0].user.token}' \
+            | wc -c
+          )"
+
+          echo "  Token length: $TOKEN_LENGTH"
+
+          if [ "$TOKEN_LENGTH" -lt 100 ]; then
+            echo "::error::Generated kubeconfig does not contain a valid-looking token"
+            exit 1
+          fi
+
       - name: Verify Kubernetes access
         run: |
           set -euo pipefail
 
-          echo "Using kubeconfig: $KUBECONFIG"
+          echo "Testing authenticated API access..."
-
-          echo -n "API server: "
-          kubectl config view --minify \
-            -o jsonpath='{.clusters[0].cluster.server}'
-          echo
-
-          echo -n "Context: "
-          kubectl config current-context
-
-          echo
-          echo "RBAC checks:"
-
-          printf 'patch deployment: '
-          kubectl auth can-i patch deployments \
-            -n blog-ahmza-com
-
-          printf 'read secrets:     '
-          kubectl auth can-i get secrets \
-            -n blog-ahmza-com
-
-          echo
           kubectl -n blog-ahmza-com get deployment blog
 
+          echo
+          echo "Testing intended permissions..."
+
+          if kubectl auth can-i patch deployments \
+            -n blog-ahmza-com
+          then
+            echo "OK: deployment patch permitted"
+          else
+            echo "::error::Deployment patch unexpectedly denied"
+            exit 1
+          fi
+
+          echo
+          echo "Testing privilege boundary..."
+
+          if kubectl auth can-i get secrets \
+            -n blog-ahmza-com
+          then
+            echo "::error::CI account unexpectedly has Secret read access"
+            exit 1
+          else
+            echo "OK: Secret read correctly denied"
+          fi
+
       - name: Deploy to Kubernetes
         env:
           IMAGE: tea.ahmza.com/ahmza/blog-ahmza-com:${{ gitea.event.head_commit.id }}
         run: |
           set -euo pipefail
 
-          echo "Deploying $IMAGE"
+          echo "Deploying image:"
+          echo "  $IMAGE"
 
           kubectl -n blog-ahmza-com \
             set image deployment/blog \
@@ -190,7 +236,7 @@ jobs:
             rollout status deployment/blog \
             --timeout=5m
           then
-            echo "::error::Deployment failed; rolling back"
+            echo "::error::New deployment failed. Rolling back."
 
             kubectl -n blog-ahmza-com \
               rollout undo deployment/blog
@@ -202,8 +248,17 @@ jobs:
             exit 1
           fi
 
+          echo
+          echo "Deployment complete:"
           kubectl -n blog-ahmza-com get pods -o wide
 
+          echo
+          echo "Running image:"
+          kubectl -n blog-ahmza-com \
+            get deployment blog \
+            -o jsonpath='{.spec.template.spec.containers[?(@.name=="blog")].image}'
+          echo
+
       - name: NetBird diagnostics & disconnect
         # Runs even on failure: captures final state for debugging and tears the
         # peer down so stale 'gitea-actions-blog' peers don't pile up.