From 5a23514a307f874a4390ddf2eb43c5d62befb7fc Mon Sep 17 00:00:00 2001
From: Brad Stein <Brad.Stein@gmail.com>
Date: Thu, 8 Jan 2026 03:57:35 -0300
Subject: [PATCH] sso: install kubectl in synapse oidc job

---
 services/keycloak/synapse-oidc-secret-ensure-job.yaml | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/services/keycloak/synapse-oidc-secret-ensure-job.yaml b/services/keycloak/synapse-oidc-secret-ensure-job.yaml
index 69a6698..16a7283 100644
--- a/services/keycloak/synapse-oidc-secret-ensure-job.yaml
+++ b/services/keycloak/synapse-oidc-secret-ensure-job.yaml
@@ -2,7 +2,7 @@
 apiVersion: batch/v1
 kind: Job
 metadata:
-  name: synapse-oidc-secret-ensure-2
+  name: synapse-oidc-secret-ensure-3
   namespace: sso
 spec:
   backoffLimit: 0
@@ -13,13 +13,12 @@ spec:
       restartPolicy: Never
       containers:
         - name: apply
-          image: bitnami/kubectl:latest
+          image: alpine:3.20
           command: ["/bin/sh", "-c"]
           args:
             - |
               set -euo pipefail
-              apt-get update >/dev/null
-              apt-get install -y curl jq >/dev/null
+              apk add --no-cache curl jq kubectl >/dev/null
 
               KC_URL="http://keycloak.sso.svc.cluster.local"
               ACCESS_TOKEN=""