ci: pin the dedicated lab Kubernetes client checksum

  before_script:

    - mkdir -p "$TMPDIR"

    - pip install pytest==8.3.2 requests==2.33.0

    - python ci/install_kubectl.py

    - export PATH="$CI_PROJECT_DIR/.cache/bin:$PATH"

    - kubectl version --client

  script:

    - python ci/sdk_live.py

## Protected CI execution

The `sdk-live-acceptance` job runs only with RUN_SDK_ACCEPTANCE=1 on a protected

lab ref and a dedicated `sdk-lab` runner with kubectl and lab network access.

lab ref and a dedicated `sdk-lab` runner with lab network access. kubectl 1.33.0 is checksum-pinned by this job.

Use SDK_CHECKPOINT=endpoints first, then ti after agreeing the NEF profile.

Supply protected file variables SDK_LAB_PROFILE, OOP_E2E_SETTINGS and KUBECONFIG,

and SDK_BUILD_JOB_ID for the exact SDK build artifact. Scope these credentials

"""Install the checksum-pinned client used by the dedicated SDK lab job."""

import hashlib

import json

from pathlib import Path

from urllib.request import urlopen

root = Path(__file__).resolve().parents[1]

config = json.loads((root / "ci/kubectl.json").read_text())

target = root / ".cache/bin/kubectl"

target.parent.mkdir(parents=True, exist_ok=True)

url = f"https://dl.k8s.io/release/{config['version']}/bin/linux/amd64/kubectl"

if not target.exists() or hashlib.sha256(target.read_bytes()).hexdigest() != config["linux_amd64_sha256"]:

    with urlopen(url, timeout=90) as response:

        data = response.read()

    if hashlib.sha256(data).hexdigest() != config["linux_amd64_sha256"]:

        raise ValueError("kubectl checksum mismatch")

    target.write_bytes(data)

target.chmod(0o755)

{

  "version": "v1.33.0",

  "linux_amd64_sha256": "9efe8d3facb23e1618cba36fb1c4e15ac9dc3ed5a2c2e18109e4a66b2bac12dc"

}