chore: lighter alpine/kubectl hook image + bump authn to 0.27.1 - #69
Merged
Conversation
The installer's own hook Jobs (self-bootstrap waves + pre/post-delete teardown reapers) ran on alpine/k8s:1.31.0 (~250MB compressed / 822MB unpacked). On fresh multi-node clusters that pull blew the self-register/self-instance activeDeadlineSeconds: 300 budget, failing the install (#66). Every one of these hooks only runs `kubectl` inside `/bin/sh` poll loops — no helm, jq, yq or kustomize (verified across all four hook files). So swap the fat all-tools image for alpine/kubectl:1.36.3 (~21MB compressed, busybox shell): a ~90% smaller pull that comfortably fits the deadline. Bumped kubectl 1.31 -> 1.36 to match the installer's k8s>=1.36 floor (the old 1.31 was already skewed 5 minors). DRY: the image is a pure template constant `inst.hookImage` in _helpers.tpl, NOT a values key — so it never has to be threaded through values.schema.json / the crdgen'd Installer CRD / the composition-mode CR (that class of coupling caused #68). Verified: `helm template` renders alpine/kubectl:1.36.3 for all hook Jobs in both bootstrap and composition mode; zero alpine/k8s references remain; image confirmed to carry /bin/sh + kubectl + sleep/grep. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01LJsLqtryCgWwEt8FnPE1se
Ship authn's hardened securityContext defaults (krateo-platformops/authn#21): pod + container run non-root, read-only rootfs, drop ALL caps, seccomp RuntimeDefault. crds-subchart tracks the same release tag (crd-publishing standard), so authn-crd moves with it. No CR/behaviour change — pod-security hardening only. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01LJsLqtryCgWwEt8FnPE1se
braghettos
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Two related hardening changes, released together as installer 0.3.35.
1. Lightweight hook image (fixes #66)
The installer's own hook Jobs (self-bootstrap waves + pre/post-delete teardown reapers) ran on
alpine/k8s:1.31.0(~250MB compressed / 822MB unpacked). On fresh multi-node clusters that pull blew theself-register/self-instanceactiveDeadlineSeconds: 300budget and failed installs.Every hook only runs
kubectlin/bin/shpoll loops — no helm/jq/yq/kustomize (verified across all four files). Swapped toalpine/kubectl:1.36.3:/bin/sh+sleep/grep; kubectl 1.36 matches the k8s ≥ 1.36 floor (was skewed at 1.31)alpine/publisher family — unchanged trust boundary (the officialregistry.k8s.io/kubectlis distroless/no-shell, so it can't run the hooks'sleeploops)inst.hookImagetemplate constant — not a values key, so novalues.schema.json/ crdgen CRD / composition-CR coupling (fix(schema): allow components[].resources so the Installer CR validates (regression from #65) #68-safe)2. Bump authn + authn-crd 0.27.0 → 0.27.1
Ships authn's hardened
securityContextdefaults (krateo-platformops/authn#21): pod + container run non-root, read-only rootfs, drop ALL caps, seccomp RuntimeDefault. Pod-security hardening only — no CR/behaviour change.Verification
helm templaterendersalpine/kubectl:1.36.3for every hook Job in both bootstrap + composition mode; zeroalpine/k8sremain/bin/sh,kubectl v1.36.3,sleep,grep🤖 Generated with Claude Code
https://claude.ai/code/session_01LJsLqtryCgWwEt8FnPE1se