#51 - Fix tf-state-backup CronJob — replace dead bitnami/kubectl image - forgejo_admin/pal-e-platform

forgejo_admin commented

2026-03-14 18:16:22 +00:00

Owner

Lineage

bug-tf-state-backup-image-dead — relates to plan-pal-e-platform → Phase 6.1 (state backup)

Repo

forgejo_admin/pal-e-platform

User Story

As a platform operator
I want the tf-state-backup CronJob to use a working container image
So that daily Terraform state backups resume and data loss risk is eliminated

Context

Bitnami removed all Docker Hub images (same pattern that broke Keycloak). The bitnami/kubectl:1.31 image used by the tf-state-backup CronJob no longer exists. Pods fail with ImagePullBackOff. No state backups have run since the CronJob was deployed.

The fix is to switch to alpine:3.20 and download the kubectl binary alongside the existing mc (MinIO client) download in the init script. This avoids future Bitnami disappearances and keeps the image small.

File Targets

Files the agent should modify:

terraform/main.tf (~line 1704) — CronJob container image + command/args

Files the agent should NOT touch:

.woodpecker.yaml — CI pipeline, no changes needed
salt/ — not relevant to this fix

Acceptance Criteria

CronJob image changed from bitnami/kubectl:1.31 to alpine:3.20
Shell changed from /bin/bash to /bin/sh (alpine uses ash, not bash)
kubectl binary downloaded via curl alongside existing mc download
All bare kubectl calls replaced with /tmp/kubectl
tofu validate passes
tofu fmt produces no changes

Test Expectations

tofu validate passes
tofu fmt check produces no diff
After apply: kubectl create job --from=cronjob/tf-state-backup test-backup -n tofu-state creates a pod that completes successfully
Backup files appear in MinIO tf-state-backups bucket

Constraints

Use alpine:3.20 (pinned version, not :latest)
Download kubectl v1.31.4 from official dl.k8s.io URL
Keep the existing mc download pattern (curl to /tmp)
set -euo pipefail works in BusyBox ash (alpine's shell)

Checklist

PR opened
tofu validate passes
tofu fmt clean
No unrelated changes
Closes this issue

bug-tf-state-backup-image-dead — pal-e-docs bug note
PR #39 — original state backup implementation
plan-pal-e-platform — Platform Hardening plan

### Lineage `bug-tf-state-backup-image-dead` — relates to `plan-pal-e-platform` → Phase 6.1 (state backup) ### Repo `forgejo_admin/pal-e-platform` ### User Story As a platform operator I want the tf-state-backup CronJob to use a working container image So that daily Terraform state backups resume and data loss risk is eliminated ### Context Bitnami removed all Docker Hub images (same pattern that broke Keycloak). The `bitnami/kubectl:1.31` image used by the tf-state-backup CronJob no longer exists. Pods fail with `ImagePullBackOff`. No state backups have run since the CronJob was deployed. The fix is to switch to `alpine:3.20` and download the kubectl binary alongside the existing mc (MinIO client) download in the init script. This avoids future Bitnami disappearances and keeps the image small. ### File Targets Files the agent should modify: - `terraform/main.tf` (~line 1704) — CronJob container image + command/args Files the agent should NOT touch: - `.woodpecker.yaml` — CI pipeline, no changes needed - `salt/` — not relevant to this fix ### Acceptance Criteria - [ ] CronJob image changed from `bitnami/kubectl:1.31` to `alpine:3.20` - [ ] Shell changed from `/bin/bash` to `/bin/sh` (alpine uses ash, not bash) - [ ] kubectl binary downloaded via curl alongside existing mc download - [ ] All bare `kubectl` calls replaced with `/tmp/kubectl` - [ ] `tofu validate` passes - [ ] `tofu fmt` produces no changes ### Test Expectations - [ ] `tofu validate` passes - [ ] `tofu fmt` check produces no diff - [ ] After apply: `kubectl create job --from=cronjob/tf-state-backup test-backup -n tofu-state` creates a pod that completes successfully - [ ] Backup files appear in MinIO `tf-state-backups` bucket ### Constraints - Use `alpine:3.20` (pinned version, not `:latest`) - Download kubectl v1.31.4 from official `dl.k8s.io` URL - Keep the existing mc download pattern (curl to /tmp) - `set -euo pipefail` works in BusyBox ash (alpine's shell) ### Checklist - [ ] PR opened - [ ] `tofu validate` passes - [ ] `tofu fmt` clean - [ ] No unrelated changes - [ ] Closes this issue ### Related - `bug-tf-state-backup-image-dead` — pal-e-docs bug note - PR #39 — original state backup implementation - `plan-pal-e-platform` — Platform Hardening plan