From af573c647fe64520861aa30171ec6f69930ed874 Mon Sep 17 00:00:00 2001
From: Scooby Husky <garrettstone499@gmail.com>
Date: Tue, 10 Mar 2026 18:08:22 -0500
Subject: [PATCH] Switch hook jobs from bitnami/kubectl to alpine/k8s:1.32.13

bitnami/kubectl has removed all version tags from Docker Hub,
leaving only :latest which is blocked by Kyverno disallow-latest-tag
policy. Switch to alpine/k8s:1.32.13 which has kubectl, bash, jq,
and uses proper version tags.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---
 infrastructure/authentik/manifests/oauth-sync-job.yaml          | 2 +-
 infrastructure/authentik/manifests/presync-job.yaml             | 2 +-
 infrastructure/crowdsec/manifests/postsync-job.yaml             | 2 +-
 infrastructure/crowdsec/manifests/presync-job.yaml              | 2 +-
 .../istio/manifests/apps/namespace-enrollment-job.yaml          | 2 +-
 .../istio/manifests/mesh/namespace-enrollment-job.yaml          | 2 +-
 infrastructure/netbird/manifests/presync-job.yaml               | 2 +-
 infrastructure/vault/manifests/eso-bootstrap-job.yaml           | 2 +-
 infrastructure/vault/manifests/vault-init-job.yaml              | 2 +-
 9 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/infrastructure/authentik/manifests/oauth-sync-job.yaml b/infrastructure/authentik/manifests/oauth-sync-job.yaml
index b278817..a8b7fee 100644
--- a/infrastructure/authentik/manifests/oauth-sync-job.yaml
+++ b/infrastructure/authentik/manifests/oauth-sync-job.yaml
@@ -14,7 +14,7 @@ spec:
       serviceAccountName: argocd-hook-sa
       containers:
         - name: oauth-sync
-          image: bitnami/kubectl:1.29
+          image: alpine/k8s:1.32.13
           command:
             - /bin/bash
             - -c
diff --git a/infrastructure/authentik/manifests/presync-job.yaml b/infrastructure/authentik/manifests/presync-job.yaml
index be1d8fd..644a317 100644
--- a/infrastructure/authentik/manifests/presync-job.yaml
+++ b/infrastructure/authentik/manifests/presync-job.yaml
@@ -13,7 +13,7 @@ spec:
       serviceAccountName: argocd-hook-sa
       containers:
         - name: presync
-          image: bitnami/kubectl:1.29
+          image: alpine/k8s:1.32.13
           command:
             - /bin/bash
             - -c
diff --git a/infrastructure/crowdsec/manifests/postsync-job.yaml b/infrastructure/crowdsec/manifests/postsync-job.yaml
index b3fd9be..b1ab669 100644
--- a/infrastructure/crowdsec/manifests/postsync-job.yaml
+++ b/infrastructure/crowdsec/manifests/postsync-job.yaml
@@ -13,7 +13,7 @@ spec:
       serviceAccountName: argocd-hook-sa
       containers:
         - name: postsync
-          image: bitnami/kubectl:1.29
+          image: alpine/k8s:1.32.13
           command:
             - /bin/bash
             - -c
diff --git a/infrastructure/crowdsec/manifests/presync-job.yaml b/infrastructure/crowdsec/manifests/presync-job.yaml
index ed542ce..684c135 100644
--- a/infrastructure/crowdsec/manifests/presync-job.yaml
+++ b/infrastructure/crowdsec/manifests/presync-job.yaml
@@ -13,7 +13,7 @@ spec:
       serviceAccountName: argocd-hook-sa
       containers:
         - name: presync
-          image: bitnami/kubectl:1.29
+          image: alpine/k8s:1.32.13
           command:
             - /bin/bash
             - -c
diff --git a/infrastructure/istio/manifests/apps/namespace-enrollment-job.yaml b/infrastructure/istio/manifests/apps/namespace-enrollment-job.yaml
index 5e89c9f..18c3570 100644
--- a/infrastructure/istio/manifests/apps/namespace-enrollment-job.yaml
+++ b/infrastructure/istio/manifests/apps/namespace-enrollment-job.yaml
@@ -16,7 +16,7 @@ spec:
       restartPolicy: Never
       containers:
         - name: enroll
-          image: bitnami/kubectl:1.29
+          image: alpine/k8s:1.32.13
           command:
             - /bin/bash
             - -c
diff --git a/infrastructure/istio/manifests/mesh/namespace-enrollment-job.yaml b/infrastructure/istio/manifests/mesh/namespace-enrollment-job.yaml
index 0cefc4a..7716a07 100644
--- a/infrastructure/istio/manifests/mesh/namespace-enrollment-job.yaml
+++ b/infrastructure/istio/manifests/mesh/namespace-enrollment-job.yaml
@@ -16,7 +16,7 @@ spec:
       restartPolicy: Never
       containers:
         - name: enroll
-          image: bitnami/kubectl:1.29
+          image: alpine/k8s:1.32.13
           command:
             - /bin/bash
             - -c
diff --git a/infrastructure/netbird/manifests/presync-job.yaml b/infrastructure/netbird/manifests/presync-job.yaml
index 1f78689..f440c6a 100644
--- a/infrastructure/netbird/manifests/presync-job.yaml
+++ b/infrastructure/netbird/manifests/presync-job.yaml
@@ -13,7 +13,7 @@ spec:
       serviceAccountName: argocd-hook-sa
       containers:
         - name: presync
-          image: bitnami/kubectl:1.29
+          image: alpine/k8s:1.32.13
           command:
             - /bin/bash
             - -c
diff --git a/infrastructure/vault/manifests/eso-bootstrap-job.yaml b/infrastructure/vault/manifests/eso-bootstrap-job.yaml
index cc32994..133ad6b 100644
--- a/infrastructure/vault/manifests/eso-bootstrap-job.yaml
+++ b/infrastructure/vault/manifests/eso-bootstrap-job.yaml
@@ -14,7 +14,7 @@ spec:
       serviceAccountName: argocd-hook-sa
       containers:
         - name: eso-bootstrap
-          image: bitnami/kubectl:1.29
+          image: alpine/k8s:1.32.13
           command:
             - /bin/bash
             - -c
diff --git a/infrastructure/vault/manifests/vault-init-job.yaml b/infrastructure/vault/manifests/vault-init-job.yaml
index aea1d09..28aff2e 100644
--- a/infrastructure/vault/manifests/vault-init-job.yaml
+++ b/infrastructure/vault/manifests/vault-init-job.yaml
@@ -14,7 +14,7 @@ spec:
       serviceAccountName: argocd-hook-sa
       containers:
         - name: vault-init
-          image: bitnami/kubectl:1.29
+          image: alpine/k8s:1.32.13
           command: ["/bin/bash", "/scripts/vault-init-and-store.sh"]
           volumeMounts:
             - name: scripts