From 4d4ca6e0b38aa7a42bd1377e3d4aa33b9ff31ce8 Mon Sep 17 00:00:00 2001 From: Renovate Bot Date: Wed, 24 Jun 2026 12:01:49 +0000 Subject: [PATCH 1/6] Update dependency helm/helm to v4 --- Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Dockerfile b/Dockerfile index e65f657..5c0d2dd 100644 --- a/Dockerfile +++ b/Dockerfile @@ -27,7 +27,7 @@ ARG LFK_VERSION=0.14.15 # renovate: datasource=github-releases depName=kubernetes/kubernetes ARG KUBECTL_VERSION=1.36.2 # renovate: datasource=github-releases depName=helm/helm -ARG HELM_VERSION=3.21.2 +ARG HELM_VERSION=4.2.2 # renovate: datasource=github-releases depName=derailed/k9s ARG K9S_VERSION=0.51.0 From 91e9afc3556f5b96314542a9be92eec79103d41c Mon Sep 17 00:00:00 2001 From: Michael Trip Date: Wed, 24 Jun 2026 14:59:41 +0200 Subject: [PATCH 2/6] Add apt-get clean to Dockerfile to reduce image size --- Dockerfile | 1 + 1 file changed, 1 insertion(+) diff --git a/Dockerfile b/Dockerfile index e65f657..314e38e 100644 --- a/Dockerfile +++ b/Dockerfile @@ -57,6 +57,7 @@ RUN apt-get update \ openssl \ sudo \ tini \ + && apt-get clean \ && rm -rf /var/lib/apt/lists/* \ && mkdir -p /var/run/sshd /var/lib/k8s-mgmt-pod /etc/ssh/sshd_config.d \ && useradd --create-home --shell /bin/bash admin \ From 0613ebca661185e73ba484360370ae3e8c78a602 Mon Sep 17 00:00:00 2001 From: Michael Trip Date: Wed, 24 Jun 2026 15:00:17 +0200 Subject: [PATCH 3/6] Add apt-get clean to Dockerfile to optimize image size --- Dockerfile | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/Dockerfile b/Dockerfile index 314e38e..8fd38ac 100644 --- a/Dockerfile +++ b/Dockerfile @@ -57,7 +57,6 @@ RUN apt-get update \ openssl \ sudo \ tini \ - && apt-get clean \ && rm -rf /var/lib/apt/lists/* \ && mkdir -p /var/run/sshd /var/lib/k8s-mgmt-pod /etc/ssh/sshd_config.d \ && useradd --create-home --shell /bin/bash admin \ @@ -95,7 +94,9 @@ RUN apt-get update \ /tmp/README.md \ /tmp/LICENSE \ /tmp/k9s_Linux_amd64.tar.gz \ - && rm -f /etc/ssh/ssh_host_* + && rm -f /etc/ssh/ssh_host_* \ + && apt-get clean + COPY docker/sshd/10-lfk-base.conf /etc/ssh/sshd_config.d/10-lfk-base.conf COPY docker/nginx/webssh.conf /etc/nginx/conf.d/webssh.conf From 68c6789ac4099a503b1ce2aca874427ac6555075 Mon Sep 17 00:00:00 2001 From: Michael Trip Date: Mon, 29 Jun 2026 08:52:08 +0200 Subject: [PATCH 4/6] Add OIDC login support and unzip utility to Dockerfile --- Dockerfile | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/Dockerfile b/Dockerfile index 8fd38ac..1ccdb90 100644 --- a/Dockerfile +++ b/Dockerfile @@ -30,6 +30,8 @@ ARG KUBECTL_VERSION=1.36.2 ARG HELM_VERSION=3.21.2 # renovate: datasource=github-releases depName=derailed/k9s ARG K9S_VERSION=0.51.0 +# renovate: datasource=github-releases depName=int128/kubelogin +ARG OIDC_LOGIN_VERSION=1.34.0 ENV DEBIAN_FRONTEND=noninteractive \ @@ -49,6 +51,7 @@ RUN apt-get update \ bash-completion \ ca-certificates \ curl \ + unzip \ tar \ nginx-light \ netcat-openbsd \ @@ -81,6 +84,11 @@ RUN apt-get update \ && curl -fsSLo "/tmp/k9s_Linux_amd64.tar.gz" "https://github.com/derailed/k9s/releases/download/v${K9S_VERSION}/k9s_Linux_amd64.tar.gz" \ && tar -xzf "/tmp/k9s_Linux_amd64.tar.gz" -C /tmp \ && install -m 0755 /tmp/k9s /usr/local/bin/k9s \ + && curl -fsSLo "/tmp/kubelogin_linux_amd64.zip" "https://github.com/int128/kubelogin/releases/download/v${OIDC_LOGIN_VERSION}/kubelogin_linux_amd64.zip" \ + && curl -fsSLo "/tmp/kubelogin_linux_amd64.zip.sha256" "https://github.com/int128/kubelogin/releases/download/v${OIDC_LOGIN_VERSION}/kubelogin_linux_amd64.zip.sha256" \ + && sed 's#\*kubelogin_linux_amd64.zip$#*/tmp/kubelogin_linux_amd64.zip#' /tmp/kubelogin_linux_amd64.zip.sha256 | sha256sum -c - \ + && unzip -p /tmp/kubelogin_linux_amd64.zip kubelogin > /usr/local/bin/kubectl-oidc_login \ + && chmod 0755 /usr/local/bin/kubectl-oidc_login \ && mkdir -p /etc/bash_completion.d \ && kubectl completion bash > /etc/bash_completion.d/kubectl \ && helm completion bash > /etc/bash_completion.d/helm \ @@ -93,6 +101,8 @@ RUN apt-get update \ /tmp/k9s \ /tmp/README.md \ /tmp/LICENSE \ + /tmp/kubelogin_linux_amd64.zip \ + /tmp/kubelogin_linux_amd64.zip.sha256 \ /tmp/k9s_Linux_amd64.tar.gz \ && rm -f /etc/ssh/ssh_host_* \ && apt-get clean From b6f7d1e1b7a6256d2668ab902f4bac33b3549200 Mon Sep 17 00:00:00 2001 From: Michael Trip Date: Mon, 29 Jun 2026 09:14:20 +0200 Subject: [PATCH 5/6] Update kubeconfig handling in entrypoint script for better clarity --- README.md | 2 ++ entrypoint.sh | 9 +++++++-- 2 files changed, 9 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index 62f3935..20446e9 100644 --- a/README.md +++ b/README.md @@ -71,6 +71,8 @@ The included [docker-compose.yaml](docker-compose.yaml) enables kubeconfig boots That bootstrap is explicitly opt-in and defaults to off in the container itself, so it does not run in Kubernetes unless you deliberately enable it. +When both are available, the bootstrap kubeconfig is applied after the service-account kubeconfig and therefore takes precedence. + Start it with: ```bash diff --git a/entrypoint.sh b/entrypoint.sh index eb5a055..0a2d319 100644 --- a/entrypoint.sh +++ b/entrypoint.sh @@ -291,8 +291,13 @@ EOF prepare_runtime() { mkdir -p /var/run/sshd ensure_host_keys - install_serviceaccount_kubeconfig - install_bootstrap_kubeconfig + if [[ "${ENABLE_BOOTSTRAP_KUBECONFIG}" == "true" ]]; then + log "Kubeconfig mode: bootstrap-only (serviceaccount kubeconfig generation disabled)." + install_bootstrap_kubeconfig + else + log "Kubeconfig mode: in-cluster serviceaccount." + install_serviceaccount_kubeconfig + fi persist_kubernetes_login_env configure_user_auth admin ADMIN_SSH_PUBKEY ADMIN_PASSWORD configure_user_auth user USER_SSH_PUBKEY USER_PASSWORD From 91f17a764deada0000b95486003523f6716a8a44 Mon Sep 17 00:00:00 2001 From: Renovate Bot Date: Mon, 29 Jun 2026 07:24:18 +0000 Subject: [PATCH 6/6] Update dependency helm/helm to v4 --- Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Dockerfile b/Dockerfile index 1ccdb90..ef22937 100644 --- a/Dockerfile +++ b/Dockerfile @@ -27,7 +27,7 @@ ARG LFK_VERSION=0.14.15 # renovate: datasource=github-releases depName=kubernetes/kubernetes ARG KUBECTL_VERSION=1.36.2 # renovate: datasource=github-releases depName=helm/helm -ARG HELM_VERSION=3.21.2 +ARG HELM_VERSION=4.2.2 # renovate: datasource=github-releases depName=derailed/k9s ARG K9S_VERSION=0.51.0 # renovate: datasource=github-releases depName=int128/kubelogin