Install kubectl from the release binaries so it is version-stamped

The kitchen sink image installed kubectl via `apt-get install kubectl`.
The same layer also adds the Google Cloud SDK apt repo, which publishes
its own `kubectl` package, so which package provides /usr/bin/kubectl is
an apt resolution outcome rather than an explicit choice. In the 3.256.0
image the resulting binary is not version-stamped:

    $ kubectl version --client
    Client Version: v0.0.0-master+$Format:%H$

`major` and `minor` are empty and gitVersion/gitCommit still contain the
literal git-archive placeholders. That is not parseable as a version, and
it breaks tooling that checks the kubectl client version - @pulumi/eks
calls semver.clean() on it, gets null, and dies with a TypeError that
never mentions kubectl.

Install the official release binary and verify it against the published
checksum instead, matching how aws-iam-authenticator is already installed
in this layer, and drop the now-unused Kubernetes apt repo.

Adds a test asserting kubectl reports a parseable, non-placeholder
version, since this fails silently until something tries to parse it.

Author: rparsonsbb

CHANGELOG.md

@@ -2,6 +2,12 @@
 
 ## Unreleased
 
+- Install `kubectl` in the `pulumi/pulumi` image from the upstream release binaries
+  instead of apt, so it is version-stamped. The previous install could resolve to a
+  build reporting `v0.0.0-master+$Format:%H$`, which is not parseable as a version and
+  breaks tooling that checks the kubectl client version, such as `@pulumi/eks`.
+  ([#776](https://github.com/pulumi/pulumi-docker-containers/issues/776))
+
 - Add .NET 10 to the kitchen sink `pulumi/pulumi` image, alongside 8.0 and 9.0
   ([#763](https://github.com/pulumi/pulumi-docker-containers/issues/763))
 

docker/pulumi/Dockerfile

@@ -71,17 +71,25 @@ RUN \
   curl -fsSL https://packages.cloud.google.com/apt/doc/apt-key.gpg | gpg --dearmor -o /etc/apt/keyrings/google-cloud.gpg && \
   echo "deb [arch=${TARGETARCH} signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/debian $(lsb_release -cs) stable" | tee /etc/apt/sources.list.d/docker.list && \
   echo "deb [signed-by=/etc/apt/keyrings/google-cloud.gpg] http://packages.cloud.google.com/apt cloud-sdk-$(lsb_release -cs) main" | tee /etc/apt/sources.list.d/google-cloud-sdk.list && \
-  KUBE_LATEST=$(curl -L -s https://dl.k8s.io/release/stable.txt | awk 'BEGIN { FS="." } { printf "%s.%s", $1, $2 }') && \
-  curl -fsSL https://pkgs.k8s.io/core:/stable:/${KUBE_LATEST}/deb/Release.key | gpg --dearmor -o /etc/apt/keyrings/kubernetes-apt-keyring.gpg && \
-  echo "deb [signed-by=/etc/apt/keyrings/kubernetes-apt-keyring.gpg] https://pkgs.k8s.io/core:/stable:/${KUBE_LATEST}/deb/ /" | tee /etc/apt/sources.list.d/kubernetes.list && \
-  # Install azure-cli (from Debian repos), docker, gcloud, kubectl
+  # kubectl, from the official release binaries and verified against the published checksum.
+  # Installed this way rather than from apt so we get a version-stamped build: the Google Cloud
+  # SDK repo added above also publishes a `kubectl` package, and resolving between the two can
+  # yield a binary whose `kubectl version` reports `v0.0.0-master+$Format:%H$`, which breaks any
+  # tooling that parses the client version.
+  KUBE_LATEST=$(curl --proto "=https" --tlsv1.2 --fail --location --silent --show-error https://dl.k8s.io/release/stable.txt) && \
+  KUBECTL_BASE_URL="https://dl.k8s.io/release/${KUBE_LATEST}/bin/linux/${TARGETARCH}" && \
+  curl --proto "=https" --tlsv1.2 --fail --location --remote-name "${KUBECTL_BASE_URL}/kubectl" && \
+  curl --proto "=https" --tlsv1.2 --fail --location --silent --show-error "${KUBECTL_BASE_URL}/kubectl.sha256" \
+    | awk '{print $1"  kubectl"}' | sha256sum --check - && \
+  install --mode 755 kubectl /usr/bin/kubectl && \
+  rm kubectl && \
+  # Install azure-cli (from Debian repos), docker, gcloud
   apt-get update -y && \
   apt-get install -y \
   azure-cli \
   docker-ce \
   google-cloud-cli \
-  google-cloud-cli-gke-gcloud-auth-plugin \
-  kubectl && \
+  google-cloud-cli-gke-gcloud-auth-plugin && \
   rm -rf /var/lib/apt/lists/*
 
 # Install Go

tests/containers_test.go

@@ -377,6 +377,34 @@ func TestCLIToolTests(t *testing.T) {
 		}
 		require.Equal(t, project, projectNumber)
 	})
+
+	// kubectl must report a real, version-stamped build. A build without the version ldflags
+	// reports `v0.0.0-master+$Format:%H$`, which is not parseable as semver and breaks tooling
+	// that checks the client version (for example @pulumi/eks).
+	// https://github.com/pulumi/pulumi-docker-containers/issues/776
+	t.Run("Kubectl", func(t *testing.T) {
+		if !isKitchenSink(t) {
+			t.Skip("kubectl is only installed in the kitchen sink image")
+		}
+		t.Parallel()
+
+		cmd := exec.Command("kubectl", "version", "--client=true", "--output=json")
+		out, err := cmd.Output()
+		require.NoError(t, err)
+
+		var result struct {
+			ClientVersion struct {
+				GitVersion string `json:"gitVersion"`
+			} `json:"clientVersion"`
+		}
+		require.NoError(t, json.Unmarshal(out, &result))
+
+		gitVersion := result.ClientVersion.GitVersion
+		require.NotContains(t, gitVersion, "$Format:",
+			"kubectl is not version-stamped, got gitVersion %q", gitVersion)
+		require.Regexp(t, `^v\d+\.\d+\.\d+`, gitVersion,
+			"kubectl gitVersion %q is not parseable as a version", gitVersion)
+	})
 }
 
 func TestEnvironment(t *testing.T) {