fix(chart): image-refresh CronJob must not treat every error as a benign skip (#571)

[LukasWodka]

The bug (Medium)

The image-refresh CronJob's settled-gate ran kubectl rollout status and treated any non-zero as "rollout in progress — skip this tick" (exit 0). But non-zero is also NotFound, RBAC denial, and API errors — so a misconfigured or unreachable deployment left the CronJob green forever while refresh never ran.

Second issue: the call had no --request-timeout (only --timeout, which is the rollout wait, not the API-call bound). With concurrencyPolicy: Forbid and no activeDeadlineSeconds, a wedged API could hang the tick and block every later tick.

Fix

• Disambiguate non-zero: if kubectl get deployment still succeeds, it's genuinely present-but-unsettled → legit skip (exit 0). Otherwise it's surfaced (exit 1) so the CronJob shows failed instead of green.
• --request-timeout=15s on both calls — bounds each API request, so a wedged server can't hang the tick.
• activeDeadlineSeconds: 300 on the Job — caps the whole run as a backstop.

Found by Bugbot on the prod promotion PR (client#571). Fixed on develop; it reaches prod via the normal develop → staging → prod path.

Note

The first commit on this branch mistakenly committed the file unmodified (a patch anchor mismatched the real 4-space indentation); the second commit is the actual fix. Net diff is the fix only.

Refs: tracebloc/backend#1426

---

Note

Medium Risk
Changes operational behavior of a cluster CronJob that restarts jobs-manager; misclassification fixes reduce silent outage risk but failed ticks may now alert where skips were previously hidden.

Overview
Fixes silent failure and hang risk in the image-refresh CronJob when the jobs-manager deployment cannot be reconciled normally.

The settled-gate no longer treats every failed kubectl rollout status as a benign skip. It now confirms the deployment still exists with kubectl get deployment; only then does it skip the tick (exit 0). NotFound, RBAC, or API errors fail the job (exit 1) so the CronJob shows failed instead of staying green while refresh never runs.

Both kubectl calls in that gate use --request-timeout=15s so a wedged API cannot block the tick indefinitely under concurrencyPolicy: Forbid.

The Job spec adds activeDeadlineSeconds: 1800 as a wall-clock backstop sized above the default rolloutTimeout (10m) so legitimate rollout waits are not killed mid-flight (which would prevent digest annotations and cause repeat restarts, #572).

Chart version bumps to 1.9.12.

^{Reviewed by Cursor Bugbot for commit a6bdb38. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit b191ff7. Configure here.}

[LukasWodka]

/fr-pass