fix(kubernetes): fail the OIDC bootstrap Job when the tenant CA is missing

In mode=System the post-install hook Job patches the chart-owned
<release>-oidc-kubeconfig Secret with a real kubeconfig built from the
tenant admin kubeconfig's CA data. When that CA data was empty the
script only warned and exited 0, so the hook was satisfied, the
HelmRelease reported Ready, and the Secret kept the install-time
placeholder kubeconfig, which cannot authenticate. The failure only
showed up when a user tried to use the downloaded kubeconfig.

Exit 1 instead, so the install fails visibly and is retried. The Job
already has backoffLimit: 6 and restartPolicy: OnFailure, and a failed
ClusterRoleBinding apply in the same script already fails the Job the
same way.

Assisted-by: LLM
Signed-off-by: Pujitha Paladugu <10557236+pujitha24@users.noreply.github.com>

packages/apps/kubernetes/templates/oidc-rbac-job.yaml

@@ -300,10 +300,11 @@ spec:
                 CA_DATA=$(kubectl --kubeconfig "$KUBECONFIG_TENANT" config view --raw \
                   --output=jsonpath='{.clusters[0].cluster.certificate-authority-data}')
                 if [ -z "$CA_DATA" ]; then
-                  echo "WARNING: tenant admin kubeconfig has no certificate-authority-data; leaving OIDC kubeconfig Secret as the install-time placeholder" >&2
-                else
-                  KUBECONFIG_FILE=$(mktemp)
-                  cat > "$KUBECONFIG_FILE" <<EOF
+                  echo "tenant admin kubeconfig has no certificate-authority-data; refusing to leave the OIDC kubeconfig Secret as the install-time placeholder" >&2
+                  exit 1
+                fi
+                KUBECONFIG_FILE=$(mktemp)
+                cat > "$KUBECONFIG_FILE" <<EOF
               apiVersion: v1
               kind: Config
               current-context: $RELEASE
@@ -334,14 +335,13 @@ spec:
                   cluster: $RELEASE
                   user: $RELEASE-oidc
               EOF
-                  KUBECONFIG_B64=$(base64 < "$KUBECONFIG_FILE" | tr -d '\n')
-                  PATCH=$(printf '{"data":{"kubeconfig":"%s"},"stringData":null}' "$KUBECONFIG_B64")
-                  kubectl --namespace "$RELEASE_NAMESPACE" patch secret \
-                    "$RELEASE-oidc-kubeconfig" \
-                    --type=merge \
-                    --patch "$PATCH"
-                  rm -f "$KUBECONFIG_FILE"
-                fi
+                KUBECONFIG_B64=$(base64 < "$KUBECONFIG_FILE" | tr -d '\n')
+                PATCH=$(printf '{"data":{"kubeconfig":"%s"},"stringData":null}' "$KUBECONFIG_B64")
+                kubectl --namespace "$RELEASE_NAMESPACE" patch secret \
+                  "$RELEASE-oidc-kubeconfig" \
+                  --type=merge \
+                  --patch "$PATCH"
+                rm -f "$KUBECONFIG_FILE"
               fi
 
               echo "Done."

packages/apps/kubernetes/tests/oidc_test.yaml

@@ -2593,6 +2593,29 @@ tests:
           pattern: 'name: view'
         documentIndex: 3
 
+  - it: mode=System aborts the Job instead of leaving the OIDC kubeconfig Secret as the install-time placeholder when the tenant CA is missing
+    # A placeholder kubeconfig cannot authenticate, so the release must not go Ready with it.
+    release:
+      name: kubernetes-app
+      namespace: tenant-foo
+    template: templates/oidc-rbac-job.yaml
+    set:
+      _cluster.oidc-enabled: "true"
+      _cluster.root-host: example.org
+      oidc.mode: System
+      oidc.users:
+        - email: alice@example.org
+          role: admin
+    asserts:
+      - notMatchRegex:
+          path: spec.template.spec.containers[0].command[2]
+          pattern: 'WARNING:.*leaving OIDC kubeconfig Secret as the install-time placeholder'
+        documentIndex: 3
+      - matchRegex:
+          path: spec.template.spec.containers[0].command[2]
+          pattern: 'if \[ -z "\$CA_DATA" \]; then\n\s+echo "tenant admin kubeconfig has no certificate-authority-data; refusing to leave the OIDC kubeconfig Secret as the install-time placeholder" >&2\n\s+exit 1\n\s+fi'
+        documentIndex: 3
+
   ###############################################
   # mode: CustomConfig                          #
   ###############################################