Nguyen Minh Phuc 4a426dbe50 worker: create namespaces with helm, drop the kubectl binary ...

trivy took the worker image 39 -> 18 -> 5 findings across two version bumps, and
the last 5 (4x golang.org/x/net, 1x Go stdlib) live in kubectl v1.36.2 — the
newest kubectl that exists. No release clears them; upstream has not rebuilt
against the patched Go yet. Chasing the version further has no end.

kubectl was in that image for exactly one call: ensure_namespace before helm.
`helm upgrade --install --create-namespace` does the same thing, idempotently,
as part of the install it already runs. So the binary goes, and its vendored CVEs
go with it. read_secret had no callers.

Tradeoff recorded: the namespace no longer gets an svcforge.io/team label, since
--create-namespace makes a bare one. Nothing reads that label today.

2026-07-18 13:05:22 +00:00

..

__init__.py

svcforge: reference implementation

2026-07-17 10:44:54 +00:00

deps.py

worker: create namespaces with helm, drop the kubectl binary

2026-07-18 13:05:22 +00:00

Dockerfile

worker: create namespaces with helm, drop the kubectl binary

2026-07-18 13:05:22 +00:00

handlers.py

worker: create namespaces with helm, drop the kubectl binary

2026-07-18 13:05:22 +00:00

main.py

worker: create namespaces with helm, drop the kubectl binary

2026-07-18 13:05:22 +00:00