Merge kyverno image fix log

DECISIONS-LOG.md

@@ -342,6 +342,19 @@ postBuild substitution. **RECOMMEND: add a self-managing root Flux Kustomization
 so cluster-vars / graph changes auto-apply — otherwise every overlay change is a manual re-apply
 (and, transiently, ${DNS_ZONE} substituted empty → `--domain-filter=` = all-zones, before re-apply).
 
+### FINDING F-KY1 — kyverno chart's cleanup image (bitnami/kubectl) purged from Docker Hub (FIXED)
+Surfaced when a `platform` reconcile triggered a kyverno helm upgrade: the chart's cleanup jobs
+(`policyReportsCleanup`, `webhooksCleanup`) default to `bitnami/kubectl:1.30.2`, which Bitnami REMOVED
+from Docker Hub (2024 catalog purge) → ImagePullBackOff. `policyReportsCleanup` runs as a Helm
+**post-upgrade HOOK**, so its failure stalled the upgrade (5m timeout) → kyverno HR not-Ready → platform
+Unknown → platform-config/apps cascade to False. **Fixed:** override both cleanup images to Bitnami's
+relocated `bitnamilegacy/kubectl` mirror (identical image — has /bin/bash + awk/wc/xargs + kubectl the
+jobs need; verified via `helm template` that no `bitnami/kubectl` ref remains). After the fix the hook
+job Completed, kyverno HR → True, and the whole graph returned to green (platform/platform-config/apps
+all Ready, 5/5 HelmReleases Ready, no unhealthy pods). **NOTE:** `bitnamilegacy` is itself a temporary
+mirror — a durable follow-up is to pin a maintained kubectl image (shell-capable, e.g. rancher or
+alpine/k8s) once tested, or a newer kyverno chart that drops the bitnami dependency.
+
 ## KNOWN ISSUES to fix before Phase-2 un-suspend (logged, not yet fixed)
 | # | Issue | Impact | Fix |
 |---|---|---|---|