From 4fe45eba3255359e08f0b2a3394e4e40550477cb Mon Sep 17 00:00:00 2001
From: Pujitha Paladugu <10557236+pujitha24@users.noreply.github.com>
Date: Mon, 14 Sep 2026 01:04:12 -0700
Subject: [PATCH] fix(kubernetes): fail the OIDC bootstrap Job when the tenant
 CA is missing

In mode=System the post-install hook Job patches the chart-owned
<release>-oidc-kubeconfig Secret with a real kubeconfig built from the
tenant admin kubeconfig's CA data. When that CA data was empty the
script only warned and exited 0, so the hook was satisfied, the
HelmRelease reported Ready, and the Secret kept the install-time
placeholder kubeconfig, which cannot authenticate. The failure only
showed up when a user tried to use the downloaded kubeconfig.

Exit 1 instead, so the install fails visibly and is retried. The Job
already has backoffLimit: 6 and restartPolicy: OnFailure, and a failed
ClusterRoleBinding apply in the same script already fails the Job the
same way.

Assisted-by: LLM
Signed-off-by: Pujitha Paladugu <10557236+pujitha24@users.noreply.github.com>
---
 .../kubernetes/templates/oidc-rbac-job.yaml   | 24 +++++++++----------
 packages/apps/kubernetes/tests/oidc_test.yaml | 23 ++++++++++++++++++
 2 files changed, 35 insertions(+), 12 deletions(-)

diff --git a/packages/apps/kubernetes/templates/oidc-rbac-job.yaml b/packages/apps/kubernetes/templates/oidc-rbac-job.yaml
index 2b478dbaf..64b6792ce 100644
--- a/packages/apps/kubernetes/templates/oidc-rbac-job.yaml
+++ b/packages/apps/kubernetes/templates/oidc-rbac-job.yaml
@@ -300,10 +300,11 @@ spec:
                 CA_DATA=$(kubectl --kubeconfig "$KUBECONFIG_TENANT" config view --raw \
                   --output=jsonpath='{.clusters[0].cluster.certificate-authority-data}')
                 if [ -z "$CA_DATA" ]; then
-                  echo "WARNING: tenant admin kubeconfig has no certificate-authority-data; leaving OIDC kubeconfig Secret as the install-time placeholder" >&2
-                else
-                  KUBECONFIG_FILE=$(mktemp)
-                  cat > "$KUBECONFIG_FILE" <<EOF
+                  echo "tenant admin kubeconfig has no certificate-authority-data; refusing to leave the OIDC kubeconfig Secret as the install-time placeholder" >&2
+                  exit 1
+                fi
+                KUBECONFIG_FILE=$(mktemp)
+                cat > "$KUBECONFIG_FILE" <<EOF
               apiVersion: v1
               kind: Config
               current-context: $RELEASE
@@ -334,14 +335,13 @@ spec:
                   cluster: $RELEASE
                   user: $RELEASE-oidc
               EOF
-                  KUBECONFIG_B64=$(base64 < "$KUBECONFIG_FILE" | tr -d '\n')
-                  PATCH=$(printf '{"data":{"kubeconfig":"%s"},"stringData":null}' "$KUBECONFIG_B64")
-                  kubectl --namespace "$RELEASE_NAMESPACE" patch secret \
-                    "$RELEASE-oidc-kubeconfig" \
-                    --type=merge \
-                    --patch "$PATCH"
-                  rm -f "$KUBECONFIG_FILE"
-                fi
+                KUBECONFIG_B64=$(base64 < "$KUBECONFIG_FILE" | tr -d '\n')
+                PATCH=$(printf '{"data":{"kubeconfig":"%s"},"stringData":null}' "$KUBECONFIG_B64")
+                kubectl --namespace "$RELEASE_NAMESPACE" patch secret \
+                  "$RELEASE-oidc-kubeconfig" \
+                  --type=merge \
+                  --patch "$PATCH"
+                rm -f "$KUBECONFIG_FILE"
               fi
 
               echo "Done."
diff --git a/packages/apps/kubernetes/tests/oidc_test.yaml b/packages/apps/kubernetes/tests/oidc_test.yaml
index ebcd6bf1c..106b814b0 100644
--- a/packages/apps/kubernetes/tests/oidc_test.yaml
+++ b/packages/apps/kubernetes/tests/oidc_test.yaml
@@ -2593,6 +2593,29 @@ tests:
           pattern: 'name: view'
         documentIndex: 3
 
+  - it: mode=System aborts the Job instead of leaving the OIDC kubeconfig Secret as the install-time placeholder when the tenant CA is missing
+    # A placeholder kubeconfig cannot authenticate, so the release must not go Ready with it.
+    release:
+      name: kubernetes-app
+      namespace: tenant-foo
+    template: templates/oidc-rbac-job.yaml
+    set:
+      _cluster.oidc-enabled: "true"
+      _cluster.root-host: example.org
+      oidc.mode: System
+      oidc.users:
+        - email: alice@example.org
+          role: admin
+    asserts:
+      - notMatchRegex:
+          path: spec.template.spec.containers[0].command[2]
+          pattern: 'WARNING:.*leaving OIDC kubeconfig Secret as the install-time placeholder'
+        documentIndex: 3
+      - matchRegex:
+          path: spec.template.spec.containers[0].command[2]
+          pattern: 'if \[ -z "\$CA_DATA" \]; then\n\s+echo "tenant admin kubeconfig has no certificate-authority-data; refusing to leave the OIDC kubeconfig Secret as the install-time placeholder" >&2\n\s+exit 1\n\s+fi'
+        documentIndex: 3
+
   ###############################################
   # mode: CustomConfig                          #
   ###############################################