Skip to content

openshift-refresh-kubeconfig

Rewrite /root/cluster/auth/kubeconfig from the openshift/kubeconfig param

Refreshes the on-disk kubeconfig at /root/cluster/auth/kubeconfig by reading the current value of openshift/kubeconfig and writing it atomically with 0600 permissions. Idempotent and safe to run repeatedly.

When to use

Designed to be declared as a Prerequisite of any task that needs a fresh on-disk kubeconfig. DRP runs prerequisites before the dependent task, so the consumer always operates against a current kubeconfig with no cron, timer, or polling infrastructure.

Common scenarios:

  • The kubeconfig has been rotated by an OpenShift operator on the cluster and the on-disk copy is stale.
  • openshift/kubeconfig is backed by a Vault LookupUri and the value in Vault has changed since the previous render.
  • Recovering from a stale kubeconfig without re-running install.

Behavior

  • Reads openshift/kubeconfig via .ParamExpand. The render path auto-resolves Vault-backed LookupUri values through the registered plugin, so this task works for both inline-encrypted and Vault-backed storage shapes.
  • Refuses to overwrite the on-disk file when the rendered value is empty or null (e.g., a Vault read returned no value). Surfaces a clear error rather than corrupting the on-disk kubeconfig.
  • Writes atomically: tempfile in the target directory, then rename(2) over /root/cluster/auth/kubeconfig.
  • Sets 0700 on the parent directory and 0600 on the kubeconfig itself.

Container restarts

/root/cluster is a tmpfs in the openshift-client-runner context, so a container restart empties it. Declaring this task as a Prerequisite is therefore required for any task that reads the on-disk kubeconfig: it rematerializes the file from the param on the fresh tmpfs. The file this task writes is removed again when the task's own job ends; its durable effects are the validation gate and the param it verified, and consumers rebuild the file at the start of their own runs.

Objects that Reference openshift-refresh-kubeconfig

Objects used by openshift-refresh-kubeconfig