Fix tf-state-backup CronJob — replace dead bitnami/kubectl image #52
No reviewers
Labels
No labels
domain:backend
domain:devops
domain:frontend
status:approved
status:in-progress
status:needs-fix
status:qa
type:bug
type:devops
type:feature
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
forgejo_admin/pal-e-platform!52
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "51-fix-tf-state-backup-cronjob-replace-dead"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Summary
Bitnami removed all Docker Hub images, breaking the nightly tf-state-backup CronJob. This PR switches to
alpine:3.20and downloads the kubectl binary at runtime, matching the existing pattern used for the MinIO client.Changes
bitnami/kubectl:1.31→alpine:3.20/bin/bash→/bin/shapk add --no-cache curl(alpine does not ship curl)/tmp/kubectl(same pattern as mc client)kubectlwith/tmp/kubectlin the backup loopTest Plan
tofu fmt— passed (no changes)tofu validate— passedkubectl create job --from=cronjob/tf-state-backup tf-state-backup-test -n tofu-statethen check logsReview Checklist
tofu fmtpassedtofu validatepassedterraform/main.tfmodifiedalpine:3.20(no :latest)Related
plan-pal-e-platformCloses #51
Self-Review
Result: No issues found.
Verified:
alpine:3.20pinned (no:latest)/bin/shreplaces/bin/bash(alpine uses busybox ash, no bash available)apk add --no-cache curlinstalls curl before any curl usage/tmp/kubectl— same pattern as the mc clientkubectlinvocation in the script updated to/tmp/kubectlset -euo pipefailworks under busybox ash on alpinetofu fmtandtofu validateboth passTofu Plan Output
PR #52 Review
Title: Fix tf-state-backup CronJob -- replace dead bitnami/kubectl image
Branch:
51-fix-tf-state-backup-cronjob-replace-deadChanged files: 1 (
terraform/main.tf), +10/-3BLOCKERS
None.
NITS
No checksum verification on downloaded binaries. Both
kubectlandmcare downloaded via curl without SHA256 verification. An MITM or CDN compromise could inject a malicious binary. This matches the existing pattern formc(pre-existing in PR #39), so it is not a regression, but worth noting for a future hardening pass. Consider addingsha256sumverification for both binaries in a follow-up.kubectl version pinning.
v1.31.4is hardcoded in the URL. When the cluster upgrades, this will need a manual bump. A minor maintenance note, not a blocker -- the oldbitnami/kubectl:1.31had the same coupling.SOP COMPLIANCE
51-fix-tf-state-backup-cronjob-replace-deadreferences #51)plan-pal-e-platform)Closes #51present in PR bodyterraform/main.tfmodified)tofu fmtandtofu validatereported as passedTECHNICAL REVIEW
bitnami/kubectl:1.31->alpine:3.20/bin/bash->/bin/shapk add --no-cache curladded/tmp/kubectlvia official URLhttps://dl.k8s.io/release/v1.31.4/bin/linux/amd64/kubectl)kubectlreplaced with/tmp/kubectlset -euo pipefailwith BusyBox ashThe change is minimal, targeted, and follows the existing mc download pattern already established in the CronJob. The root cause (Bitnami removing all Docker Hub images) is well-documented in MEMORY.md and the PR description.
VERDICT: APPROVED