claude-botandClaude Opus 5
401d23ac48
Owner directive: tools belong in the image, not installed at container
start. This is the highest-blast-radius instance of the pattern left in the
repo — a DaemonSet, so it runs on every node.
No image was needed. `apk add --no-cache curl tar` turns out to have been
unnecessary from the start: verified in alpine:3.21 that `tar` is already
busybox (v1.37.0) and handles -xzf, and that busybox `wget` follows
GitHub's release redirect to objects.githubusercontent.com over TLS using
the base image's /etc/ssl/certs/ca-certificates.crt. Only `curl` is
genuinely absent, and wget covers what it was used for. So this replaces
the install with `wget -q -O` rather than introducing another layered
image.
Severity note for the record: the apk add sat inside the else branch, so
steady-state nodes never reached it. It ran when plugins were absent — i.e.
on a fresh node or after /opt/cni/bin was wiped, which is precisely the
moment you least want a dependency on package-index availability.
Verified by running the RENDERED init script in alpine:3.21 against the
real release URL, both paths:
empty dir -> Fetching ...; Installed: host-local, macvlan, static
macvlan executable, /opt/cni/bin owner 0:0, exit 0
already there -> "CNI plugins already installed (CNI macvlan plugin
v1.5.1)", exit 0, no fetch
The second line is worth noting: that version string comes from executing
the extracted binary, so the download and extraction are confirmed good,
not merely present. The chown 0:0 also still applies, which the existing
comment explains is required or Cilium's apply-sysctl-overwrites init
container fails with "Permission denied".
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>