From 0a323fc03957e628600a75d76588b735d9542fd0 Mon Sep 17 00:00:00 2001
From: Story Crater Bot <19826264+Riotpiaole@users.noreply.github.com>
Date: Tue, 21 Jul 2026 17:18:32 -0700
Subject: [PATCH] fix(temporal): db-secret-sync image bitnami/kubectl:1.30
 doesn't exist

Bitnami stopped publishing versioned image tags in 2025 - only 'latest' and
sha256-pinned digests remain for their free-tier images. Confirmed via
Docker Hub API before writing this fix: no '1.30' tag exists for
bitnami/kubectl, which caused an indefinite ImagePullBackOff (job stuck
'Running' with 0 pods able to start).

Switched to python:3.12-alpine + a stdlib urllib kubectl download, matching
the exact pattern already proven working in
k8s/security/iam/authentik-provision-job.yaml (which hit its own apk
permission problem on this same base image, now fixed the same way in
both places) - avoids depending on any third party's tagging policy.
---
 .../temporal/db-secret-sync/copy-job.yaml     | 21 ++++++++++++++++++-
 1 file changed, 20 insertions(+), 1 deletion(-)

diff --git a/k8s/applications/temporal/db-secret-sync/copy-job.yaml b/k8s/applications/temporal/db-secret-sync/copy-job.yaml
index 0d63cde..4c474be 100644
--- a/k8s/applications/temporal/db-secret-sync/copy-job.yaml
+++ b/k8s/applications/temporal/db-secret-sync/copy-job.yaml
@@ -91,7 +91,15 @@ spec:
           type: RuntimeDefault
       containers:
         - name: copy
-          image: bitnami/kubectl:1.30
+          # bitnami/kubectl:1.30 does NOT exist - Bitnami stopped publishing
+          # versioned tags in 2025 (only `latest` + sha256-pinned digests
+          # remain), confirmed live via Docker Hub API before this fix - the
+          # original tag caused an indefinite ImagePullBackOff. Using
+          # python:3.12-alpine + a stdlib urllib kubectl download instead,
+          # same pattern already proven working in
+          # k8s/security/iam/authentik-provision-job.yaml - avoids depending
+          # on any third party's tagging policy at all.
+          image: python:3.12-alpine
           securityContext:
             allowPrivilegeEscalation: false
             capabilities:
@@ -101,6 +109,17 @@ spec:
             - -c
             - |
               set -e
+              echo "installing kubectl (pure python urllib, no apk - see"
+              echo "authentik-provision-job.yaml for why apk fails as non-root)..."
+              python3 -c "
+              import urllib.request, os, stat
+              kver = urllib.request.urlopen('https://dl.k8s.io/release/stable.txt').read().decode().strip()
+              url = f'https://dl.k8s.io/release/{kver}/bin/linux/amd64/kubectl'
+              urllib.request.urlretrieve(url, '/tmp/kubectl')
+              st = os.stat('/tmp/kubectl')
+              os.chmod('/tmp/kubectl', st.st_mode | stat.S_IEXEC)
+              "
+              export PATH="/tmp:$PATH"
               echo "waiting for ddb/temporal-db-role..."
               until kubectl -n ddb get secret temporal-db-role >/dev/null 2>&1; do
                 echo "  not ready yet, retrying..."