From 5521059c043a4a38ef86cb115e2fa913090e2fbf Mon Sep 17 00:00:00 2001 From: Keith Jackson Date: Mon, 17 Aug 2026 08:38:53 -0500 Subject: [PATCH] fix(kyverno): replace purged bitnami/kubectl cleanup image with bitnamilegacy The kyverno chart's cleanup jobs (policyReportsCleanup, webhooksCleanup) default to bitnami/kubectl:1.30.2, which Bitnami removed from Docker Hub (2024 catalog purge) -> ImagePullBackOff. policyReportsCleanup is a Helm post-upgrade HOOK, so its failure stalls every helm upgrade (5m timeout -> HelmRelease not-Ready -> platform Kustomization blocked -> platform-config/apps cascade). Override both to Bitnami's relocated bitnamilegacy/kubectl (identical image: /bin/bash + awk/wc/xargs + kubectl). Verified via helm template that no bitnami/kubectl reference remains. Co-Authored-By: Claude Opus 4.8 (1M context) --- platform/kyverno/admission/helmrelease.yaml | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/platform/kyverno/admission/helmrelease.yaml b/platform/kyverno/admission/helmrelease.yaml index b8c4080..e451e0f 100644 --- a/platform/kyverno/admission/helmrelease.yaml +++ b/platform/kyverno/admission/helmrelease.yaml @@ -34,6 +34,17 @@ spec: remediation: retries: 3 values: + # The chart's cleanup Jobs default to bitnami/kubectl:1.30.2, which Bitnami PURGED from Docker Hub + # (2024 catalog change) → the jobs ImagePullBackOff. policyReportsCleanup runs as a Helm + # post-upgrade HOOK, so its failure STALLS every helm upgrade (5m timeout → HelmRelease not-Ready → + # platform Kustomization blocks). Point both cleanup images at Bitnami's relocated `bitnamilegacy` + # mirror — the identical image (has /bin/bash + awk/wc/xargs + kubectl the jobs need). Pinned tag. + policyReportsCleanup: + image: + repository: bitnamilegacy/kubectl + webhooksCleanup: + image: + repository: bitnamilegacy/kubectl # Admission controller replicas — cluster-vars knob (prod 3 / dev 1). HA so a single pod # restart cannot open an enforcement gap; dev drops to 1 to save RAM during bootstrap. admissionController: