registry-live profile: prepull/pre-delete utility images use distroless kubectl (no shell) - latent crash

Context

The hardening work switched the prepull DaemonSet and pre-delete cleanup hook to use registry.k8s.io/kubectl:v1.34.9 as the utility image. That image is distroless — it has no /bin/sh — but both the prepull container and the pre-delete hook wrap their commands in /bin/sh -c wrappers.

Result: the live prepull DaemonSet on openstudio-server-03 entered CrashLoopBackOff (exec: "/bin/sh": stat /bin/sh: no such file or directory) immediately after the upgrade that introduced the image. The pre-delete hook has the same latent failure on uninstall.

Fix applied

Commit 3386a2f (openstudio-server-helm):

• Chart default (values.yaml) and AWS profile (values.aws.yaml): prepull.utilityImage and hooks.preDeleteCleanup.image → bitnami/kubectl:latest (ships kubectl and a shell).
• Verified the ECR mirror 554977624503.dkr.ecr.us-west-2.amazonaws.com/bitnami/kubectl:latest exists in the cluster account.
• Live prepull DaemonSet now Ready 1/1.

Remaining work

• values.registry-live.yaml still uses the distroless kubectl image in two places:

  • line 75: hooks.preDeleteCleanup.image = pulp-dev.hpc.nlr.gov/pulp-container-aurora-179d/registry.k8s.io/kubectl:v1.34.9
  • line 102: prepull.utilityImage = pulp-dev.hpc.nlr.gov/pulp-container-aurora-179d/registry.k8s.io/kubectl:v1.34.9

  Note prepull.gate.enabled: true in that profile, so the taint-node initContainer and bootstrapper containers need kubectl and a shell. Recommend pointing both at a pulp mirror of a shell-capable kubectl image (e.g., bitnami/kubectl) and verifying the mirror resolves before enabling prepull there.

• Consider pinning bitnami/kubectl to a tag matching the target cluster's Kubernetes version instead of :latest (kubectl/server skew). ECR currently only mirrors :latest.

• Deploy-time check: the pre-delete hook will now work on uninstall; worth a helm uninstall --dry-run/hook test in a scratch namespace before relying on it in production.

Start with values.registry-live.yaml at lines 75 and 102, comparing the image settings with values.yaml and values.aws.yaml. Verify that the chosen pulp mirror resolves to a shell-capable kubectl image and that the prepull and pre-delete configurations use it. Done means the profile no longer references the distroless image; test the hook with helm uninstall --dry-run or in a scratch namespace.