fix(kernel-deploy): synthesize an explicit kubeconfig in every kubectl script

sean commented

2026-08-14 08:14:30 +00:00

Owner

roll-node run sndhx: kubectl discovery/RESTMapper resolves to localhost:8080 while typed reads reach the apiserver — create -f (mkagent), CRD gets and bare printers die. Reproduced and healed in a diag pod with the same SA+image via a synthesized kubeconfig from the mounted SA. Applied to all 8 kubectl-using scripts in pipeline-deploy-kernel.yaml. Unblocks the seanfarm31 worker roll.

sean added 1 commit

2026-08-14 08:14:31 +00:00

fix(kernel-deploy): synthesize an explicit kubeconfig in every kubectl script

pipeline/ci CI green @ 3de20803468f

Details

3de2080346

Run sndhx failed at roll-node with mkagent's create dying on
localhost:8080. Diagnosis in a plain pod with the same SA and image:
kubectl detects the in-cluster namespace but builds its discovery and
RESTMapper clients against the empty-config default, so 'create -f -',
CRD gets, bare printers and 'auth whoami' all dial localhost:8080 while
typed jsonpath reads still reach the real apiserver. That split is why
plan succeeded and mkagent failed in the same run, and why the 08-11
attempts read as agent hangs before mkagent failed loudly.

The trigger is not a template or image change: the pipeline-tools:v7
digest has been pinned since 2026-08-04 and creates worked on 2026-08-11.
Until the cause is pinned down, every kubectl-using script in this file
synthesizes an explicit kubeconfig from the mounted ServiceAccount; the
same synthesis was proven to heal create, CRD gets and discovery in the
diagnostic pod.

pipeline-bot merged commit 3de2080346 into trunk

2026-08-14 08:15:23 +00:00

Rows
Columns

fix(kernel-deploy): synthesize an explicit kubeconfig in every kubectl script #2042