chore(ci): replace bitnami/kubectl with chainguard/kubectl (#14512)

bitnami/containers#83267 documents how the bitnami container images are being browned out to signal a change. To unblock our CI, we can switch to chainguard/kubectl.

Author: olix0r

justfile

@@ -153,14 +153,14 @@ policy-test-cleanup:
     @while [ $({{ _kubectl }} get ns --selector='linkerd-policy-test' -o json |jq '.items | length') != "0" ]; do sleep 1 ; done
 
 policy-test-deps-pull:
-    docker pull -q docker.io/bitnami/kubectl:latest
+    docker pull -q docker.io/chainguard/kubectl:latest-dev
     docker pull -q docker.io/curlimages/curl:latest
     docker pull -q ghcr.io/olix0r/hokay:latest
 
 # Load all images into the test cluster.
 policy-test-deps-load: _k3d-init policy-test-deps-pull
     for i in {1..3} ; do {{ _k3d-load }} \
-        bitnami/kubectl:latest \
+        chainguard/kubectl:latest-dev \
         curlimages/curl:latest \
         fortio/fortio:latest \
         ghcr.io/olix0r/hokay:latest && exit || sleep 1 ; done

policy-test/src/curl.rs

@@ -198,7 +198,7 @@ impl Runner {
                 service_account: Some("curl".to_string()),
                 init_containers: Some(vec![k8s::api::core::v1::Container {
                     name: "wait-for-web".to_string(),
-                    image: Some("docker.io/bitnami/kubectl:latest".to_string()),
+                    image: Some("docker.io/chainguard/kubectl:latest-dev".to_string()),
                     // In CI, we can hit failures where the watch isn't updated
                     // after the configmap is deleted, even with a long timeout.
                     // Instead, we use a relatively short timeout and retry the