Bitnami kubectl image change – migration plan for Velero helm chart

[a-pallari]

Describe the problem/challenge you have
The Velero Helm chart pulls the bitnami/kubectl image https://github.com/vmware-tanzu/helm-charts/blob/main/charts/velero/values.yaml#L316-318. Bitnami has announced that its public container catalog will no longer be maintained bitnami/charts#35164.

Describe the solution you'd like
Is there a migration plan to an actively maintained kubectl image?

Anything else you would like to add:
This deprecation might turn out to be a non-issue, but I wanted to flag it early in case action is needed.

[mjnagel]

Commented this on the linked PR, but to note here:

Due to the k8s registry kubectl image not having a shell (and the same is true with most other kubectl images) this work might also require fixing #571 unless there's a viable alternative kubectl image with which, sh, and kubectl. The last time I looked at that issue it seemed like we might need to make Velero CLI changes since writing the CRDs to an output file (in a shared volume) was not possible without a shell.

[andrea-gelati]

As workarond tried to change repository for kubectl image using bitnamisecure/kubectl for kubectl.image.repository.

For the job upgrade-crds it seems to have worked.

[rajivml]

bitnamisecure

bitnamisecure images doesn't it require a subscription ? this article says so https://news.broadcom.com/app-dev/broadcom-introduces-bitnami-secure-images-for-production-ready-containerized-applications

[SheryarButt]

@rajivml yes they require subscription, that's the whole reason for this shift 💵

[nemobis]

unless there's a viable alternative kubectl image with which, sh, and kubectl

The image eclipsefdn/kubectl should do.

[piotrs-grapeup]

@nemobis

unless there's a viable alternative kubectl image with which, sh, and kubectl

The image eclipsefdn/kubectl should do.

This and most of the kubectl images ends with similar error:

exec /tmp/sh: no such file or directory

[kaovilai]

How about https://github.com/alpine-docker/k8s

[SheryarButt]

@kaovilai alpine images are based on busybox. They don't have a sh either, just a symlink that can't be copied over.

[kaovilai]

From my reading bitnamisecure is free on the latest tag, why can't we use it?

[kaovilai]

Do we require non latest? Or does anyone expect to create a support ticket for kubectl image?

[kaovilai]

For production workloads and long-term support, users are encouraged to adopt Bitnami Secure Images

I don't think we'd need long term support as latest kubectl in general are IMO stable towards older versions.

[kaovilai]

cgr.dev/chainguard/kubectl:latest-dev
Think this might work. Haven't test