Use bitnami/kubectl:1.29 for hook jobs

The :1.31 tag is gone from Docker Hub and :latest is blocked by Kyverno
disallow-latest-tag policy. The 1.29 image is cached on cluster nodes.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

infrastructure/authentik/manifests/oauth-sync-job.yaml

@@ -14,7 +14,7 @@ spec:
       serviceAccountName: argocd-hook-sa
       containers:
         - name: oauth-sync
-          image: bitnami/kubectl:latest
+          image: bitnami/kubectl:1.29
           command:
             - /bin/bash
             - -c

infrastructure/authentik/manifests/presync-job.yaml

@@ -13,7 +13,7 @@ spec:
       serviceAccountName: argocd-hook-sa
       containers:
         - name: presync
-          image: bitnami/kubectl:latest
+          image: bitnami/kubectl:1.29
           command:
             - /bin/bash
             - -c

infrastructure/crowdsec/manifests/postsync-job.yaml

@@ -13,7 +13,7 @@ spec:
       serviceAccountName: argocd-hook-sa
       containers:
         - name: postsync
-          image: bitnami/kubectl:latest
+          image: bitnami/kubectl:1.29
           command:
             - /bin/bash
             - -c

infrastructure/crowdsec/manifests/presync-job.yaml

@@ -13,7 +13,7 @@ spec:
       serviceAccountName: argocd-hook-sa
       containers:
         - name: presync
-          image: bitnami/kubectl:latest
+          image: bitnami/kubectl:1.29
           command:
             - /bin/bash
             - -c

infrastructure/istio/manifests/apps/namespace-enrollment-job.yaml

@@ -16,7 +16,7 @@ spec:
       restartPolicy: Never
       containers:
         - name: enroll
-          image: bitnami/kubectl:latest
+          image: bitnami/kubectl:1.29
           command:
             - /bin/bash
             - -c

infrastructure/istio/manifests/mesh/namespace-enrollment-job.yaml

@@ -16,7 +16,7 @@ spec:
       restartPolicy: Never
       containers:
         - name: enroll
-          image: bitnami/kubectl:latest
+          image: bitnami/kubectl:1.29
           command:
             - /bin/bash
             - -c

infrastructure/netbird/manifests/presync-job.yaml

@@ -13,7 +13,7 @@ spec:
       serviceAccountName: argocd-hook-sa
       containers:
         - name: presync
-          image: bitnami/kubectl:latest
+          image: bitnami/kubectl:1.29
           command:
             - /bin/bash
             - -c

infrastructure/vault/manifests/eso-bootstrap-job.yaml

@@ -14,7 +14,7 @@ spec:
       serviceAccountName: argocd-hook-sa
       containers:
         - name: eso-bootstrap
-          image: bitnami/kubectl:latest
+          image: bitnami/kubectl:1.29
           command:
             - /bin/bash
             - -c

infrastructure/vault/manifests/vault-init-job.yaml

@@ -14,7 +14,7 @@ spec:
       serviceAccountName: argocd-hook-sa
       containers:
         - name: vault-init
-          image: bitnami/kubectl:latest
+          image: bitnami/kubectl:1.29
           command: ["/bin/bash", "/scripts/vault-init-and-store.sh"]
           volumeMounts:
             - name: scripts