From c12d88ac7ce650ad8c5f0e1e310c0adcddbf95a7 Mon Sep 17 00:00:00 2001
From: xnoto <steven@makeitwork.cloud>
Date: Tue, 25 Aug 2026 12:11:54 -0600
Subject: [PATCH] chore: drop unused serviceaccount issuer config for removed
 www oidc endpoint

---
 cloud-init/k3s/cloud_init.cfg | 16 ----------------
 1 file changed, 16 deletions(-)

diff --git a/cloud-init/k3s/cloud_init.cfg b/cloud-init/k3s/cloud_init.cfg
index e66d6d0..fd27efe 100644
--- a/cloud-init/k3s/cloud_init.cfg
+++ b/cloud-init/k3s/cloud_init.cfg
@@ -19,22 +19,6 @@ write_files:
         - oidc-client-id=kubectl
         - oidc-username-claim=email
         - oidc-groups-claim=groups
-  # Kubernetes ServiceAccount issuer for projected pod tokens. This is separate
-  # from the Dex OIDC config above, which validates human/user login tokens.
-  # AWS STS will use the public static discovery/JWKS documents served by www
-  # at https://makeitwork.cloud/oidc to validate sops-secrets-operator tokens.
-  - path: /etc/rancher/k3s/config.yaml.d/service-account-issuer.yaml
-    permissions: '0644'
-    content: |
-      # This file loads after oidc.yaml. The + suffix appends to its
-      # kube-apiserver-arg list instead of replacing the OIDC arguments.
-      kube-apiserver-arg+:
-        # First issuer signs new ServiceAccount tokens.
-        - service-account-issuer=https://makeitwork.cloud/oidc
-        # Keep the k3s default issuer accepted during transition.
-        - service-account-issuer=https://kubernetes.default.svc.cluster.local
-        - service-account-jwks-uri=https://makeitwork.cloud/oidc/openid/v1/jwks
-        - api-audiences=https://makeitwork.cloud/oidc,https://kubernetes.default.svc.cluster.local
 
 groups:
   - default