From 753e6c7bd4674b2e7e8f8cc45b9e3b2cdd107686 Mon Sep 17 00:00:00 2001
From: 0xFEEDC0DE64 <daniel@brunner.ninja>
Date: Mon, 19 Oct 2026 08:50:18 +0200
Subject: [PATCH] Remove legacy Kubernetes CD bootstrap

---
 ci-deployer.yaml        | 84 -----------------------------------------
 create-ci-kubeconfig.sh | 51 -------------------------
 2 files changed, 135 deletions(-)
 delete mode 100644 ci-deployer.yaml
 delete mode 100755 create-ci-kubeconfig.sh

diff --git a/ci-deployer.yaml b/ci-deployer.yaml
deleted file mode 100644
index cb4284c..0000000
--- a/ci-deployer.yaml
+++ /dev/null
@@ -1,84 +0,0 @@
-# Bootstrap this file once with an administrator identity. CI can update only
-# the already-existing error-page resources named below; it cannot create or
-# delete workloads and it cannot read Kubernetes Secrets.
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: traefik-error-pages-deployer
-  namespace: default
-automountServiceAccountToken: false
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: traefik-error-pages-deployer
-  namespace: default
-rules:
-  - apiGroups:
-      - ""
-    resources:
-      - configmaps
-    resourceNames:
-      - traefik-error-pages
-    verbs:
-      - get
-      - patch
-      - update
-  - apiGroups:
-      - ""
-    resources:
-      - services
-    resourceNames:
-      - traefik-error-pages
-    verbs:
-      - get
-      - patch
-      - update
-  - apiGroups:
-      - apps
-    resources:
-      - deployments
-    resourceNames:
-      - traefik-error-pages
-    verbs:
-      - get
-      - patch
-      - update
-  - apiGroups:
-      - traefik.io
-    resources:
-      - middlewares
-    resourceNames:
-      - upstream-errors
-      - authentik-error-context
-      - authentik-forward
-      - authentik-error-checked
-      - authentik
-    verbs:
-      - get
-      - patch
-      - update
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: traefik-error-pages-deployer
-  namespace: default
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: traefik-error-pages-deployer
-subjects:
-  - kind: ServiceAccount
-    name: traefik-error-pages-deployer
-    namespace: default
----
-apiVersion: v1
-kind: Secret
-metadata:
-  name: traefik-error-pages-deployer-token
-  namespace: default
-  annotations:
-    kubernetes.io/service-account.name: traefik-error-pages-deployer
-type: kubernetes.io/service-account-token
-
diff --git a/create-ci-kubeconfig.sh b/create-ci-kubeconfig.sh
deleted file mode 100755
index 2a410bc..0000000
--- a/create-ci-kubeconfig.sh
+++ /dev/null
@@ -1,51 +0,0 @@
-#!/usr/bin/env bash
-
-set -euo pipefail
-
-project_dir=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)
-namespace=${NAMESPACE:-default}
-service_account=${SERVICE_ACCOUNT:-traefik-error-pages-deployer}
-secret=${TOKEN_SECRET:-traefik-error-pages-deployer-token}
-
-[[ $(kubectl config current-context) == kubernetes-admin@kubernetes ]] || { echo "Wrong Kubernetes context" >&2; exit 1; }
-kubectl apply --dry-run=server --filename "${project_dir}/ci-deployer.yaml" >&2
-kubectl apply --filename "${project_dir}/ci-deployer.yaml" >&2
-
-for attempt in {1..30}; do
-  if kubectl --namespace "${namespace}" get secret "${secret}" \
-      --output=jsonpath='{.data.token}' 2>/dev/null | grep -q .; then
-    break
-  fi
-  if [[ "${attempt}" == 30 ]]; then
-    echo "Timed out waiting for the service-account token" >&2
-    exit 1
-  fi
-  sleep 1
-done
-
-workdir=$(mktemp --directory)
-trap 'rm -rf "${workdir}"' EXIT
-
-server=$(kubectl config view --minify --output=jsonpath='{.clusters[0].cluster.server}')
-kubectl --namespace "${namespace}" get secret "${secret}" \
-  --output=jsonpath='{.data.ca\.crt}' | base64 --decode > "${workdir}/ca.crt"
-token=$(kubectl --namespace "${namespace}" get secret "${secret}" \
-  --output=jsonpath='{.data.token}' | base64 --decode)
-
-export KUBECONFIG="${workdir}/config"
-kubectl config set-cluster cluster \
-  --server="${server}" \
-  --certificate-authority="${workdir}/ca.crt" \
-  --embed-certs=true >/dev/null
-kubectl config set-credentials "${service_account}" --token="${token}" >/dev/null
-kubectl config set-context traefik-error-pages \
-  --cluster=cluster \
-  --user="${service_account}" \
-  --namespace="${namespace}" >/dev/null
-kubectl config use-context traefik-error-pages >/dev/null
-
-echo "Store the following single line as the Gitea Actions secret KUBE_CONFIG_BASE64." >&2
-echo "Treat it as a password; do not commit it." >&2
-base64 --wrap=0 "${KUBECONFIG}"
-printf '\n'
-