From 68c6789ac4099a503b1ce2aca874427ac6555075 Mon Sep 17 00:00:00 2001
From: Michael Trip <michael@alcatrash.org>
Date: Mon, 29 Jun 2026 08:52:08 +0200
Subject: [PATCH 1/3] Add OIDC login support and unzip utility to Dockerfile

---
 Dockerfile | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/Dockerfile b/Dockerfile
index 8fd38ac..1ccdb90 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -30,6 +30,8 @@ ARG KUBECTL_VERSION=1.36.2
 ARG HELM_VERSION=3.21.2
 # renovate: datasource=github-releases depName=derailed/k9s
 ARG K9S_VERSION=0.51.0
+# renovate: datasource=github-releases depName=int128/kubelogin
+ARG OIDC_LOGIN_VERSION=1.34.0
 
 
 ENV DEBIAN_FRONTEND=noninteractive \
@@ -49,6 +51,7 @@ RUN apt-get update \
         bash-completion \
         ca-certificates \
         curl \
+        unzip \
         tar \
         nginx-light \
         netcat-openbsd \
@@ -81,6 +84,11 @@ RUN apt-get update \
     && curl -fsSLo "/tmp/k9s_Linux_amd64.tar.gz" "https://github.com/derailed/k9s/releases/download/v${K9S_VERSION}/k9s_Linux_amd64.tar.gz" \
     && tar -xzf "/tmp/k9s_Linux_amd64.tar.gz" -C /tmp \
     && install -m 0755 /tmp/k9s /usr/local/bin/k9s \
+    && curl -fsSLo "/tmp/kubelogin_linux_amd64.zip" "https://github.com/int128/kubelogin/releases/download/v${OIDC_LOGIN_VERSION}/kubelogin_linux_amd64.zip" \
+    && curl -fsSLo "/tmp/kubelogin_linux_amd64.zip.sha256" "https://github.com/int128/kubelogin/releases/download/v${OIDC_LOGIN_VERSION}/kubelogin_linux_amd64.zip.sha256" \
+    && sed 's#\*kubelogin_linux_amd64.zip$#*/tmp/kubelogin_linux_amd64.zip#' /tmp/kubelogin_linux_amd64.zip.sha256 | sha256sum -c - \
+    && unzip -p /tmp/kubelogin_linux_amd64.zip kubelogin > /usr/local/bin/kubectl-oidc_login \
+    && chmod 0755 /usr/local/bin/kubectl-oidc_login \
     && mkdir -p /etc/bash_completion.d \
     && kubectl completion bash > /etc/bash_completion.d/kubectl \
     && helm completion bash > /etc/bash_completion.d/helm \
@@ -93,6 +101,8 @@ RUN apt-get update \
         /tmp/k9s \
         /tmp/README.md \
         /tmp/LICENSE \
+        /tmp/kubelogin_linux_amd64.zip \
+        /tmp/kubelogin_linux_amd64.zip.sha256 \
         /tmp/k9s_Linux_amd64.tar.gz \
     && rm -f /etc/ssh/ssh_host_* \
     && apt-get clean

From b6f7d1e1b7a6256d2668ab902f4bac33b3549200 Mon Sep 17 00:00:00 2001
From: Michael Trip <michael@alcatrash.org>
Date: Mon, 29 Jun 2026 09:14:20 +0200
Subject: [PATCH 2/3] Update kubeconfig handling in entrypoint script for
 better clarity

---
 README.md     | 2 ++
 entrypoint.sh | 9 +++++++--
 2 files changed, 9 insertions(+), 2 deletions(-)

diff --git a/README.md b/README.md
index 62f3935..20446e9 100644
--- a/README.md
+++ b/README.md
@@ -71,6 +71,8 @@ The included [docker-compose.yaml](docker-compose.yaml) enables kubeconfig boots
 
 That bootstrap is explicitly opt-in and defaults to off in the container itself, so it does not run in Kubernetes unless you deliberately enable it.
 
+When both are available, the bootstrap kubeconfig is applied after the service-account kubeconfig and therefore takes precedence.
+
 Start it with:
 
 ```bash
diff --git a/entrypoint.sh b/entrypoint.sh
index eb5a055..0a2d319 100644
--- a/entrypoint.sh
+++ b/entrypoint.sh
@@ -291,8 +291,13 @@ EOF
 prepare_runtime() {
   mkdir -p /var/run/sshd
   ensure_host_keys
-  install_serviceaccount_kubeconfig
-  install_bootstrap_kubeconfig
+  if [[ "${ENABLE_BOOTSTRAP_KUBECONFIG}" == "true" ]]; then
+    log "Kubeconfig mode: bootstrap-only (serviceaccount kubeconfig generation disabled)."
+    install_bootstrap_kubeconfig
+  else
+    log "Kubeconfig mode: in-cluster serviceaccount."
+    install_serviceaccount_kubeconfig
+  fi
   persist_kubernetes_login_env
   configure_user_auth admin ADMIN_SSH_PUBKEY ADMIN_PASSWORD
   configure_user_auth user USER_SSH_PUBKEY USER_PASSWORD

From 62d68bea0ce890d1b01045d8126acc3f000210be Mon Sep 17 00:00:00 2001
From: Renovate Bot <renovate@alcatrash.org>
Date: Mon, 29 Jun 2026 07:24:07 +0000
Subject: [PATCH 3/3] Update dependency janosmiko/lfk to v0.14.18

---
 Dockerfile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Dockerfile b/Dockerfile
index 1ccdb90..f9793af 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -23,7 +23,7 @@ RUN apt-get update \
 FROM debian:trixie-slim
 
 # renovate: datasource=github-releases depName=janosmiko/lfk
-ARG LFK_VERSION=0.14.15
+ARG LFK_VERSION=0.14.18
 # renovate: datasource=github-releases depName=kubernetes/kubernetes
 ARG KUBECTL_VERSION=1.36.2
 # renovate: datasource=github-releases depName=helm/helm