feat(bird): swap jq for a pinned kubectl

The init container assembled its config with curl, a hand-managed bearer token and CA path, and jq string interpolation. That is not rendering, it is string building, and it carried the self-exclusion logic as well. kubectl replaces all three: go-template-file renders from real template files, in-cluster auth needs no token handling, and --field-selector metadata.name!=$NODE_NAME drops the node itself server-side. Pinned to v1.36.3 with the published checksum, the same shape as ci/images/k8s. Alpine ships 1.33.1, and this API server reports minCompatibilityMinor 35, so the packaged one is out of skew. curl stays for the build download; jq is gone. Refs #576 Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-09-16 10:23:41 +02:00
1 changed files with 17 additions and 7 deletions
@@ -1,5 +1,9 @@
 FROM alpine:3.22@sha256:14358309a308569c32bdc37e2e0e9694be33a9d99e68afb0f5ff33cc1f695dce

+# Matches the cluster: the API server reports minCompatibilityMinor 35, and
+# Alpine's kubectl is 1.33. Same pin-and-verify shape as ci/images/k8s.
+ARG KUBECTL_VERSION=v1.36.3
+
 # bird: BGP daemon for the pod-network mesh over pod0. Distro package, no build
 # step — the image is the binary plus its runtime.
 #
@@ -8,15 +12,21 @@ FROM alpine:3.22@sha256:14358309a308569c32bdc37e2e0e9694be33a9d99e68afb0f5ff33cc
 #
 # Config is read from /etc/bird/bird.conf, not the package default
 # /etc/bird.conf, so the mount cannot shadow what the package ships.
-#
-# curl and jq are for the init container, which renders the per-node peer list
-# from the Kubernetes API. busybox wget cannot verify against the API server's
-# CA bundle, and the query must not run unverified.
-RUN apk add --no-cache bird2 curl jq
+RUN apk add --no-cache bird2 curl
+
+# kubectl renders the init container's per-node config with go-template and
+# excludes the node itself with a field selector, so nothing has to parse JSON
+# or assemble config text by hand.
+RUN curl -sfL -o /usr/local/bin/kubectl \
+      "https://dl.k8s.io/release/${KUBECTL_VERSION}/bin/linux/amd64/kubectl" \
+ && curl -sfL -o /tmp/kubectl.sha256 \
+      "https://dl.k8s.io/release/${KUBECTL_VERSION}/bin/linux/amd64/kubectl.sha256" \
+ && echo "$(cat /tmp/kubectl.sha256)  /usr/local/bin/kubectl" | sha256sum -c - \
+ && rm -f /tmp/kubectl.sha256 \
+ && chmod +x /usr/local/bin/kubectl

 # Fails the build rather than the first pod if a binary or its path is wrong.
 RUN /usr/sbin/bird --version \
- && curl --version > /dev/null \
- && jq --version > /dev/null
+ && kubectl version --client > /dev/null

 ENTRYPOINT ["/usr/sbin/bird", "-f", "-c", "/etc/bird/bird.conf"]