From d75d3098ed9b21839b2cfa6eb4541d64b88de6e9 Mon Sep 17 00:00:00 2001 From: John Xie Date: Mon, 10 Aug 2026 21:57:01 -0700 Subject: [PATCH] fix: Restore a buildable, digest-pinned base image v1.24.12 (406449b) swapped the base from a digest-pinned gcr.io image to `bitnami/kubectl:1.24.12`. That tag is broken twice over, and both were reproduced with `docker build` before this revert: 1. The image does not exist. Bitnami retired their free Docker Hub catalog and moved the images to bitnamilegacy: bitnami/kubectl:1.24.12 -> 404 tag not found bitnamilegacy/kubectl:1.24.12 -> 200 2. Resolving it to bitnamilegacy does not help. The build then fails at the aws-iam-authenticator RUN step with `curl: command not found` - the bitnami base ships no curl. So v1.24.12 has never been able to build. Container actions build at job runtime, which is why nothing surfaced it until Dependabot proposed the bump to taskade/taskcade (taskade/taskcade#27963). That action runs on the production deploy path, at "Create AWS credentials secret" and "Register Temporal taskade Namespace", and nothing in PR CI exercises those workflows - so the bump would have merged green and failed at the next release. This restores the digest that v1.0.3 used and that taskade/taskcade runs in production today. Verified locally: builds clean, kubectl v1.23.15, aws-iam-authenticator 0.6.2, sh + base64 present for entrypoint.sh. The resulting image digest is byte-identical to a build of the v1.0.3 Dockerfile. Digest pinning is kept deliberately and commented, since a floating tag on this action means a third party can change what runs with our kubeconfig and AWS credentials. --- Dockerfile | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-) diff --git a/Dockerfile b/Dockerfile index 14cc8b5..44bee35 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,4 +1,19 @@ -FROM bitnami/kubectl:1.24.12 +# Digest-pinned on purpose. This action runs on taskade/taskcade's production +# deploy path (production.yml: "Create AWS credentials secret" and "Register +# Temporal taskade Namespace"), so the base image must be immutable - a floating +# tag lets a third party change what runs with our kubeconfig and AWS creds. +# +# Do NOT move this to bitnami/kubectl. The 1.24.12 attempt broke twice over: +# 1. `bitnami/kubectl:1.24.12` 404s. Bitnami retired their free Docker Hub +# catalog; the image only survives at `bitnamilegacy/kubectl:1.24.12`. +# 2. Even resolved to bitnamilegacy, the build still fails at the RUN below +# with `curl: command not found` - the bitnami base ships no curl. +# Both were reproduced with `docker build` before this revert. +# +# Upgrading kubectl past the 1.23.15 in this image is a real want, but it needs +# a base that has curl (or a different way to fetch aws-iam-authenticator) and +# a version chosen against the live EKS control plane. Track it separately. +FROM gcr.io/cloud-builders/kubectl@sha256:2be508c9ef153be3d3d2e986acd430821d99c1bcbdccda2e426222338f034762 LABEL version="1.0.0" LABEL name="kubectl"