chore: lighter alpine/kubectl hook image + bump authn to 0.27.1

chart/files/component-pins.yaml

@@ -2,7 +2,7 @@ components:
 - name: authn-crd
   kind: AuthnCrds
   chart: authn-crds
-  version: 0.27.0
+  version: 0.27.1
   tier: platform
   feature: portal
 - name: oasgen-provider-crd
@@ -26,7 +26,7 @@ components:
 - name: authn
   kind: Authn
   chart: authn
-  version: 0.27.0
+  version: 0.27.1
   deps:
   - authn-crd
   tier: platform

chart/templates/_helpers.tpl

@@ -11,6 +11,17 @@
 {{- printf "composition.krateo.io/v%s" ($ver | toString | replace "." "-") -}}
 {{- end -}}
 
+{{/* Image for the installer's own lifecycle hook Jobs (self-bootstrap waves + the pre/post-delete
+     teardown/cleanup reapers). These hooks only ever run `kubectl` inside `/bin/sh` poll loops
+     (no helm/jq/yq/kustomize), so they use the minimal official-family alpine/kubectl (~21MB
+     compressed, busybox shell) instead of alpine/k8s (~250MB compressed / 822MB unpacked). The
+     smaller pull keeps every hook Job inside its activeDeadlineSeconds on fresh multi-node clusters
+     where the fat image previously blew the 300s self-register/self-instance budget (#66). Pinned to
+     kubectl 1.36.x to match the installer's k8s>=1.36 floor (was 1.31, already skewed). Single source
+     of truth: a pure template constant, NOT a values key, so it never has to be threaded through
+     values.schema.json / the crdgen'd Installer CRD / the composition-mode CR (cf. #68). */}}
+{{- define "inst.hookImage" -}}alpine/kubectl:1.36.3{{- end -}}
+
 {{/* Optional CompositionDefinition spec.chart extras (registry-level): insecureSkipVerifyTLS
      and credentials, rendered ONLY when set so the chart spec stays minimal on public
      registries. arg: (list $). passwordRef.namespace defaults to the krateo namespace.

chart/templates/bootstrap-teardown.yaml

@@ -49,7 +49,7 @@ spec:
       restartPolicy: Never
       containers:
         - name: drain
-          image: alpine/k8s:1.31.0
+          image: {{ include "inst.hookImage" . }}
           command: ["/bin/sh", "-c"]
           args:
             - |

chart/templates/ordered-teardown.yaml

@@ -46,7 +46,7 @@ spec:
       restartPolicy: Never
       containers:
         - name: order
-          image: alpine/k8s:1.31.0
+          image: {{ include "inst.hookImage" . }}
           command: ["/bin/sh", "-c"]
           args:
             - |

chart/templates/post-delete-cleanup.yaml

@@ -77,7 +77,7 @@ spec:
       restartPolicy: Never
       containers:
         - name: sweep
-          image: alpine/k8s:1.31.0
+          image: {{ include "inst.hookImage" . }}
           command: ["/bin/sh", "-c"]
           args:
             - |

chart/templates/self-bootstrap.yaml

@@ -286,7 +286,7 @@ spec:
             name: installer-self-cr
       containers:
         - name: register
-          image: alpine/k8s:1.31.0
+          image: {{ include "inst.hookImage" . }}
           volumeMounts:
             - name: cr
               mountPath: /cr
@@ -320,7 +320,7 @@ spec:
       restartPolicy: Never
       containers:
         - name: await
-          image: alpine/k8s:1.31.0
+          image: {{ include "inst.hookImage" . }}
           command: ["/bin/sh", "-c"]
           args:
             - |
@@ -355,7 +355,7 @@ spec:
             name: installer-self-cr
       containers:
         - name: instance
-          image: alpine/k8s:1.31.0
+          image: {{ include "inst.hookImage" . }}
           volumeMounts:
             - name: cr
               mountPath: /cr
@@ -400,7 +400,7 @@ spec:
       restartPolicy: Never
       containers:
         - name: finalize
-          image: alpine/k8s:1.31.0
+          image: {{ include "inst.hookImage" . }}
           command: ["/bin/sh", "-c"]
           args:
             - |