From 9ec08e1dc262f08d8d00e13c4298da952bccd606 Mon Sep 17 00:00:00 2001
From: Brad Stein <Brad.Stein@gmail.com>
Date: Wed, 14 Jan 2026 05:41:01 -0300
Subject: [PATCH] jobs: drop apk in kubectl image

---
 services/comms/comms-secrets-ensure-job.yaml           | 1 -
 services/comms/mas-admin-client-secret-ensure-job.yaml | 2 --
 services/comms/mas-db-ensure-job.yaml                  | 2 --
 services/comms/synapse-signingkey-ensure-job.yaml      | 2 --
 services/keycloak/mas-secrets-ensure-job.yaml          | 2 --
 5 files changed, 9 deletions(-)

diff --git a/services/comms/comms-secrets-ensure-job.yaml b/services/comms/comms-secrets-ensure-job.yaml
index 674f1fd..62e945e 100644
--- a/services/comms/comms-secrets-ensure-job.yaml
+++ b/services/comms/comms-secrets-ensure-job.yaml
@@ -20,7 +20,6 @@ spec:
               set -eu
               trap 'echo "comms-secrets-ensure failed"; sleep 300' ERR
               umask 077
-              apk add --no-cache curl jq >/dev/null
 
               safe_pass() {
                 head -c 32 /dev/urandom | base64 | tr -d '\n' | tr '+/' '-_' | tr -d '='
diff --git a/services/comms/mas-admin-client-secret-ensure-job.yaml b/services/comms/mas-admin-client-secret-ensure-job.yaml
index 5d47c7d..d9f0e94 100644
--- a/services/comms/mas-admin-client-secret-ensure-job.yaml
+++ b/services/comms/mas-admin-client-secret-ensure-job.yaml
@@ -67,8 +67,6 @@ spec:
           args:
             - |
               set -euo pipefail
-              apk add --no-cache curl jq >/dev/null
-
               vault_addr="${VAULT_ADDR:-http://vault.vault.svc.cluster.local:8200}"
               vault_role="${VAULT_ROLE:-comms-secrets}"
               jwt="$(cat /var/run/secrets/kubernetes.io/serviceaccount/token)"
diff --git a/services/comms/mas-db-ensure-job.yaml b/services/comms/mas-db-ensure-job.yaml
index b843646..030c73a 100644
--- a/services/comms/mas-db-ensure-job.yaml
+++ b/services/comms/mas-db-ensure-job.yaml
@@ -24,8 +24,6 @@ spec:
                 head -c 32 /dev/urandom | base64 | tr -d '\n' | tr '+/' '-_' | tr -d '='
               }
 
-              apk add --no-cache curl jq >/dev/null
-
               vault_addr="${VAULT_ADDR:-http://vault.vault.svc.cluster.local:8200}"
               vault_role="${VAULT_ROLE:-comms-secrets}"
               jwt="$(cat /var/run/secrets/kubernetes.io/serviceaccount/token)"
diff --git a/services/comms/synapse-signingkey-ensure-job.yaml b/services/comms/synapse-signingkey-ensure-job.yaml
index 9439f22..ae30561 100644
--- a/services/comms/synapse-signingkey-ensure-job.yaml
+++ b/services/comms/synapse-signingkey-ensure-job.yaml
@@ -37,8 +37,6 @@ spec:
           args:
             - |
               set -euo pipefail
-              apk add --no-cache curl jq >/dev/null
-
               vault_addr="${VAULT_ADDR:-http://vault.vault.svc.cluster.local:8200}"
               vault_role="${VAULT_ROLE:-comms-secrets}"
               jwt="$(cat /var/run/secrets/kubernetes.io/serviceaccount/token)"
diff --git a/services/keycloak/mas-secrets-ensure-job.yaml b/services/keycloak/mas-secrets-ensure-job.yaml
index 9d59479..1ae1c9d 100644
--- a/services/keycloak/mas-secrets-ensure-job.yaml
+++ b/services/keycloak/mas-secrets-ensure-job.yaml
@@ -95,8 +95,6 @@ spec:
           args:
             - |
               set -euo pipefail
-              apk add --no-cache curl jq >/dev/null
-
               vault_addr="${VAULT_ADDR:-http://vault.vault.svc.cluster.local:8200}"
               vault_role="${VAULT_ROLE:-sso-secrets}"
               jwt="$(cat /var/run/secrets/kubernetes.io/serviceaccount/token)"