From 724641ce0f8c69ed63a9b31a20be7e7925815df2 Mon Sep 17 00:00:00 2001 From: Erki Aas Date: Sun, 23 Aug 2026 13:49:23 +0300 Subject: [PATCH] Install bcrypt backend for passlib passlib does not ship a bcrypt implementation, it only wraps one. Until now these images got away with it because passlib fell back to the stdlib crypt module, but PEP 594 removed crypt in Python 3.13, so any image rebuilt on current python:alpine (3.14) raises MissingBackendError: bcrypt: no backends available on the first hash it computes. For secret-claim-operator that is fatal: reconcile_claim() hashes on every claim, so the operator crash-loops and stops reconciling SecretClaims entirely. bcrypt is pinned below 5.0 on purpose. passlib 1.7.4's backend probe hashes a >72 byte test string to detect a historical wraparound bug, and bcrypt 5 turned over-long passwords into a hard ValueError, so passlib 1.7.4 + bcrypt 5 fails just as reliably as no backend at all. Co-Authored-By: Claude Opus 5 (1M context) --- samples/keydb-operator/Dockerfile | 3 ++- samples/minio-bucket-operator/Dockerfile | 1 + samples/mysql-database-operator/Dockerfile | 3 ++- samples/postgres-database-operator/Dockerfile | 3 ++- samples/redis-operator/Dockerfile | 3 ++- samples/secret-claim-operator/Dockerfile | 3 ++- samples/wildduck-operator/Dockerfile | 1 + 7 files changed, 12 insertions(+), 5 deletions(-) diff --git a/samples/keydb-operator/Dockerfile b/samples/keydb-operator/Dockerfile index e45761c..838ed86 100644 --- a/samples/keydb-operator/Dockerfile +++ b/samples/keydb-operator/Dockerfile @@ -2,7 +2,8 @@ FROM python:alpine AS build RUN pip3 wheel --wheel-dir=/wheels \ kubernetes-asyncio \ redis \ - passlib + passlib \ + 'bcrypt<5' FROM python:alpine COPY --from=build /wheels /wheels diff --git a/samples/minio-bucket-operator/Dockerfile b/samples/minio-bucket-operator/Dockerfile index 587bd85..26c029b 100644 --- a/samples/minio-bucket-operator/Dockerfile +++ b/samples/minio-bucket-operator/Dockerfile @@ -2,6 +2,7 @@ FROM python:alpine AS build RUN pip3 wheel --wheel-dir=/wheels \ kubernetes-asyncio \ passlib \ + 'bcrypt<5' \ pyjwt \ httpx-auth \ httpx diff --git a/samples/mysql-database-operator/Dockerfile b/samples/mysql-database-operator/Dockerfile index 7345d8c..1b21d73 100644 --- a/samples/mysql-database-operator/Dockerfile +++ b/samples/mysql-database-operator/Dockerfile @@ -2,7 +2,8 @@ FROM python:alpine AS build RUN pip3 wheel --wheel-dir=/wheels \ kubernetes-asyncio \ aiomysql \ - passlib + passlib \ + 'bcrypt<5' FROM python:alpine COPY --from=build /wheels /wheels diff --git a/samples/postgres-database-operator/Dockerfile b/samples/postgres-database-operator/Dockerfile index 8bcc7c3..1626923 100644 --- a/samples/postgres-database-operator/Dockerfile +++ b/samples/postgres-database-operator/Dockerfile @@ -2,7 +2,8 @@ FROM python:alpine AS build RUN pip3 wheel --wheel-dir=/wheels \ kubernetes-asyncio \ aiopg \ - passlib + passlib \ + 'bcrypt<5' FROM python:alpine COPY --from=build /wheels /wheels diff --git a/samples/redis-operator/Dockerfile b/samples/redis-operator/Dockerfile index ac13522..0942b6d 100644 --- a/samples/redis-operator/Dockerfile +++ b/samples/redis-operator/Dockerfile @@ -2,7 +2,8 @@ FROM python:alpine AS build RUN pip3 wheel --wheel-dir=/wheels \ kubernetes-asyncio \ redis \ - passlib + passlib \ + 'bcrypt<5' FROM python:alpine COPY --from=build /wheels /wheels diff --git a/samples/secret-claim-operator/Dockerfile b/samples/secret-claim-operator/Dockerfile index 1d3da37..d4bcf72 100644 --- a/samples/secret-claim-operator/Dockerfile +++ b/samples/secret-claim-operator/Dockerfile @@ -1,7 +1,8 @@ FROM python:alpine AS build RUN pip3 wheel --wheel-dir=/wheels \ kubernetes-asyncio \ - passlib + passlib \ + 'bcrypt<5' FROM python:alpine COPY --from=build /wheels /wheels diff --git a/samples/wildduck-operator/Dockerfile b/samples/wildduck-operator/Dockerfile index c51eab0..277c105 100644 --- a/samples/wildduck-operator/Dockerfile +++ b/samples/wildduck-operator/Dockerfile @@ -2,6 +2,7 @@ FROM python:alpine AS build RUN pip3 wheel --wheel-dir=/wheels \ kubernetes-asyncio \ passlib \ + 'bcrypt<5' \ httpx-auth \ httpx FROM python:alpine