update kubectl image (#558)

[sanmesh-kakade]

(cherry picked from commit db35e33)

Description

Related issues

Type of change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• This change requires a documentation update

Checklist

• I have created feat/bugfix branch out of develop branch
• Code passes linting/formatting checks
• Changes to resources have been tested in our dev environments
• I have made corresponding changes to the documentation

Testing

Reviewer instructions

Summary by CodeRabbit

• Chores
  • Updated the scheduled Kubernetes job to use a newer kubectl container image.

[coderabbitai]

Walkthrough

The container image used by the kubectl container in the ECR token refresher Kubernetes cron job is changed from xynova/aws-kubectl to facetscloud/aws-kubectl:1.31.0.

Changes

ECR Token Refresher Image Update

Layer / File(s)	Summary
Update cron job container image modules/artifactories/default/0.1/ecr-token-refresher.tf	The kubectl container image for the ecr-token-refresher-cron job is changed from xynova/aws-kubectl to facetscloud/aws-kubectl:1.31.0.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The description is mostly a template skeleton and lacks the required summary, issues, testing, and reviewer guidance.	Fill in the summary, related issue link, type of change, checklist items, testing details, and reviewer instructions.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately summarizes the main change: updating the kubectl image.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch sync-master-image

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 Trivy (0.69.3)

Trivy execution timed out

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

🧹 Nitpick comments (1)

modules/artifactories/default/0.1/ecr-token-refresher.tf (1)

49-49: 🔒 Security & Privacy | 🔵 Trivial | 💤 Low value

Consider pinning by digest instead of mutable tag.

facetscloud/aws-kubectl:1.31.0 is still a mutable tag; if the maintainer republishes that tag with different contents, the cron job would silently pick up a new image on next pull (image_pull_policy = "Always"). Pinning by immutable digest (image@sha256:...) would guarantee reproducibility for this critical secret-rotation job.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@modules/artifactories/default/0.1/ecr-token-refresher.tf` at line 49, The
cron job image reference in the ecr-token-refresher Terraform should not use the
mutable aws-kubectl tag. Update the image setting in the ecr-token-refresher
configuration to pin the container by immutable digest instead, using the
existing image reference as the base and replacing the tag with a digest form so
the job always pulls the exact same artifact.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@modules/artifactories/default/0.1/ecr-token-refresher.tf`:
- Line 49: The cron job image reference in the ecr-token-refresher Terraform
should not use the mutable aws-kubectl tag. Update the image setting in the
ecr-token-refresher configuration to pin the container by immutable digest
instead, using the existing image reference as the base and replacing the tag
with a digest form so the job always pulls the exact same artifact.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 6bb13ad6-c43c-4bd8-b885-c571e65e3d67

📥 Commits

Reviewing files that changed from the base of the PR and between c6a285c and 9191b94.

📒 Files selected for processing (1)

• modules/artifactories/default/0.1/ecr-token-refresher.tf