From 5e7936c811a5bca331b84e3220337dcc91298adb Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Tue, 16 Jun 2026 08:24:54 +0300
Subject: [PATCH] fix(tenant): replace bitnami/kubectl with maintained clastix
 image in cleanup hook
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The pre-delete cleanup Job ran kubectl from `bitnami/kubectl:latest`. The
bitnami Docker Hub catalog has moved to a legacy/sunset state, so that pull is
at risk of breaking — which would stop the cleanup hook from starting at all —
and the `:latest` tag leaves the kubectl version unpinned and non-reproducible.

Switch to `docker.io/clastix/kubectl:v1.32`, the version-pinned image already
used by every other first-party cleanup/delete hook in the repo (kubernetes,
keycloak-configure, dashboard, mariadb). That image is Alpine-based and ships
only `/bin/sh`, so the hook script (pure POSIX) now invokes `/bin/sh` instead
of `/bin/bash` — matching those sibling hooks.

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---
 .../apps/tenant/templates/cleanup-job.yaml    |  4 +--
 .../tenant/tests/cleanup_role_watch_test.yaml | 32 ++++++++++++++++++-
 2 files changed, 33 insertions(+), 3 deletions(-)

diff --git a/packages/apps/tenant/templates/cleanup-job.yaml b/packages/apps/tenant/templates/cleanup-job.yaml
index be5729b67..59cb0544f 100644
--- a/packages/apps/tenant/templates/cleanup-job.yaml
+++ b/packages/apps/tenant/templates/cleanup-job.yaml
@@ -62,9 +62,9 @@ spec:
       restartPolicy: OnFailure
       containers:
       - name: cleanup
-        image: bitnami/kubectl:latest
+        image: docker.io/clastix/kubectl:v1.32
         command:
-        - /bin/bash
+        - /bin/sh
         - -c
         - |
           set -e
diff --git a/packages/apps/tenant/tests/cleanup_role_watch_test.yaml b/packages/apps/tenant/tests/cleanup_role_watch_test.yaml
index 2c5d83094..53fcb5920 100644
--- a/packages/apps/tenant/tests/cleanup_role_watch_test.yaml
+++ b/packages/apps/tenant/tests/cleanup_role_watch_test.yaml
@@ -1,10 +1,16 @@
-suite: tenant cleanup Role can watch HelmReleases
+suite: tenant cleanup pre-delete hook
 
 # The pre-delete cleanup hook deletes the tenant's HelmReleases with
 # `kubectl delete --wait=true`, which sets up a watch on helmreleases to block
 # until finalization completes. Without the watch verb that watch is rejected
 # with HTTP 403, the delete call hangs, the Job never finishes, and tenant
 # deletion stalls on the hook. Pin the verb so it cannot regress.
+#
+# The Job runs kubectl from a maintained, version-pinned image. Pin the image
+# so it cannot drift back to an unpinned / sunset base (e.g. bitnami:latest),
+# and pin the command interpreter to a shell that image actually ships
+# (clastix/kubectl is Alpine — /bin/sh only, no /bin/bash) so the container
+# can exec at all.
 
 # Restrict rendering to the cleanup template so the chart's namespace.yaml
 # `lookup` (which errors under helm-unittest) is not evaluated.
@@ -27,3 +33,27 @@ tests:
         contains:
           path: rules[0].verbs
           content: watch
+
+  - it: cleanup Job uses the maintained clastix kubectl image
+    asserts:
+      - template: templates/cleanup-job.yaml
+        documentIndex: 3
+        isKind:
+          of: Job
+      - template: templates/cleanup-job.yaml
+        documentIndex: 3
+        equal:
+          path: spec.template.spec.containers[0].image
+          value: docker.io/clastix/kubectl:v1.32
+
+  - it: cleanup Job invokes a shell the image actually ships
+    asserts:
+      - template: templates/cleanup-job.yaml
+        documentIndex: 3
+        isKind:
+          of: Job
+      - template: templates/cleanup-job.yaml
+        documentIndex: 3
+        equal:
+          path: spec.template.spec.containers[0].command[0]
+          value: /bin/sh