From 1d66a9c0d6a4e04a4cb06cffcbf27546523b6317 Mon Sep 17 00:00:00 2001 From: Diego Braga Date: Thu, 13 Aug 2026 23:15:42 +0200 Subject: [PATCH 1/2] chore(hooks): use lightweight alpine/kubectl for lifecycle hook Jobs MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The installer's own hook Jobs (self-bootstrap waves + pre/post-delete teardown reapers) ran on alpine/k8s:1.31.0 (~250MB compressed / 822MB unpacked). On fresh multi-node clusters that pull blew the self-register/self-instance activeDeadlineSeconds: 300 budget, failing the install (#66). Every one of these hooks only runs `kubectl` inside `/bin/sh` poll loops — no helm, jq, yq or kustomize (verified across all four hook files). So swap the fat all-tools image for alpine/kubectl:1.36.3 (~21MB compressed, busybox shell): a ~90% smaller pull that comfortably fits the deadline. Bumped kubectl 1.31 -> 1.36 to match the installer's k8s>=1.36 floor (the old 1.31 was already skewed 5 minors). DRY: the image is a pure template constant `inst.hookImage` in _helpers.tpl, NOT a values key — so it never has to be threaded through values.schema.json / the crdgen'd Installer CRD / the composition-mode CR (that class of coupling caused #68). Verified: `helm template` renders alpine/kubectl:1.36.3 for all hook Jobs in both bootstrap and composition mode; zero alpine/k8s references remain; image confirmed to carry /bin/sh + kubectl + sleep/grep. Co-Authored-By: Claude Opus 4.8 (1M context) Claude-Session: https://claude.ai/code/session_01LJsLqtryCgWwEt8FnPE1se --- chart/templates/_helpers.tpl | 11 +++++++++++ chart/templates/bootstrap-teardown.yaml | 2 +- chart/templates/ordered-teardown.yaml | 2 +- chart/templates/post-delete-cleanup.yaml | 2 +- chart/templates/self-bootstrap.yaml | 8 ++++---- 5 files changed, 18 insertions(+), 7 deletions(-) diff --git a/chart/templates/_helpers.tpl b/chart/templates/_helpers.tpl index 9e2fe7e..088bdf7 100644 --- a/chart/templates/_helpers.tpl +++ b/chart/templates/_helpers.tpl @@ -11,6 +11,17 @@ {{- printf "composition.krateo.io/v%s" ($ver | toString | replace "." "-") -}} {{- end -}} +{{/* Image for the installer's own lifecycle hook Jobs (self-bootstrap waves + the pre/post-delete + teardown/cleanup reapers). These hooks only ever run `kubectl` inside `/bin/sh` poll loops + (no helm/jq/yq/kustomize), so they use the minimal official-family alpine/kubectl (~21MB + compressed, busybox shell) instead of alpine/k8s (~250MB compressed / 822MB unpacked). The + smaller pull keeps every hook Job inside its activeDeadlineSeconds on fresh multi-node clusters + where the fat image previously blew the 300s self-register/self-instance budget (#66). Pinned to + kubectl 1.36.x to match the installer's k8s>=1.36 floor (was 1.31, already skewed). Single source + of truth: a pure template constant, NOT a values key, so it never has to be threaded through + values.schema.json / the crdgen'd Installer CRD / the composition-mode CR (cf. #68). */}} +{{- define "inst.hookImage" -}}alpine/kubectl:1.36.3{{- end -}} + {{/* Optional CompositionDefinition spec.chart extras (registry-level): insecureSkipVerifyTLS and credentials, rendered ONLY when set so the chart spec stays minimal on public registries. arg: (list $). passwordRef.namespace defaults to the krateo namespace. diff --git a/chart/templates/bootstrap-teardown.yaml b/chart/templates/bootstrap-teardown.yaml index dbceae2..6e0d09c 100644 --- a/chart/templates/bootstrap-teardown.yaml +++ b/chart/templates/bootstrap-teardown.yaml @@ -49,7 +49,7 @@ spec: restartPolicy: Never containers: - name: drain - image: alpine/k8s:1.31.0 + image: {{ include "inst.hookImage" . }} command: ["/bin/sh", "-c"] args: - | diff --git a/chart/templates/ordered-teardown.yaml b/chart/templates/ordered-teardown.yaml index 4a4df4a..090558f 100644 --- a/chart/templates/ordered-teardown.yaml +++ b/chart/templates/ordered-teardown.yaml @@ -46,7 +46,7 @@ spec: restartPolicy: Never containers: - name: order - image: alpine/k8s:1.31.0 + image: {{ include "inst.hookImage" . }} command: ["/bin/sh", "-c"] args: - | diff --git a/chart/templates/post-delete-cleanup.yaml b/chart/templates/post-delete-cleanup.yaml index 6fcf324..f07c061 100644 --- a/chart/templates/post-delete-cleanup.yaml +++ b/chart/templates/post-delete-cleanup.yaml @@ -77,7 +77,7 @@ spec: restartPolicy: Never containers: - name: sweep - image: alpine/k8s:1.31.0 + image: {{ include "inst.hookImage" . }} command: ["/bin/sh", "-c"] args: - | diff --git a/chart/templates/self-bootstrap.yaml b/chart/templates/self-bootstrap.yaml index b6cd4e0..0fc360e 100644 --- a/chart/templates/self-bootstrap.yaml +++ b/chart/templates/self-bootstrap.yaml @@ -286,7 +286,7 @@ spec: name: installer-self-cr containers: - name: register - image: alpine/k8s:1.31.0 + image: {{ include "inst.hookImage" . }} volumeMounts: - name: cr mountPath: /cr @@ -320,7 +320,7 @@ spec: restartPolicy: Never containers: - name: await - image: alpine/k8s:1.31.0 + image: {{ include "inst.hookImage" . }} command: ["/bin/sh", "-c"] args: - | @@ -355,7 +355,7 @@ spec: name: installer-self-cr containers: - name: instance - image: alpine/k8s:1.31.0 + image: {{ include "inst.hookImage" . }} volumeMounts: - name: cr mountPath: /cr @@ -400,7 +400,7 @@ spec: restartPolicy: Never containers: - name: finalize - image: alpine/k8s:1.31.0 + image: {{ include "inst.hookImage" . }} command: ["/bin/sh", "-c"] args: - | From b690a76268142bbc0d78fd0925d95063fd254680 Mon Sep 17 00:00:00 2001 From: Diego Braga Date: Thu, 13 Aug 2026 23:35:58 +0200 Subject: [PATCH 2/2] chore(pins): bump authn + authn-crd 0.27.0 -> 0.27.1 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Ship authn's hardened securityContext defaults (krateo-platformops/authn#21): pod + container run non-root, read-only rootfs, drop ALL caps, seccomp RuntimeDefault. crds-subchart tracks the same release tag (crd-publishing standard), so authn-crd moves with it. No CR/behaviour change — pod-security hardening only. Co-Authored-By: Claude Opus 4.8 (1M context) Claude-Session: https://claude.ai/code/session_01LJsLqtryCgWwEt8FnPE1se --- chart/files/component-pins.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/chart/files/component-pins.yaml b/chart/files/component-pins.yaml index 7406286..9e8489b 100644 --- a/chart/files/component-pins.yaml +++ b/chart/files/component-pins.yaml @@ -2,7 +2,7 @@ components: - name: authn-crd kind: AuthnCrds chart: authn-crds - version: 0.27.0 + version: 0.27.1 tier: platform feature: portal - name: oasgen-provider-crd @@ -26,7 +26,7 @@ components: - name: authn kind: Authn chart: authn - version: 0.27.0 + version: 0.27.1 deps: - authn-crd tier: platform