Thanks! Helm-wise this looks okay to me on a first glance, but I'm not a fan of us pulling in yet another external image.

Have you investigated if this could be implemented in Go and make the job invoke a clustermesh-apiserver subcommand (or perhaps even run it a go-routine of one of the existing components)?

Thanks! A couple of initial comments inline.

Generally speaking, I'd also prefer to avoid pulling in yet another image, and replace the bash script with a sub-command of one of the already existing images. That would also make the overall command more robust compared to bash scripting, and easier to extend in future, especially in case more advanced tasks need to be performed. Additionally, kubectl has technically a relatively strict compatibility policy, making it tricky to pick the correct version (even though the commands here are simple enough that real problems are unlikely).

I'm not totally sure about the best image to use though. The clustermesh-apiserver seems the most likely candidate, even though it is not strictly necessary to run it to make MCS-API work. However, that would not be a significant problem as long as it is run as a separate job, which to me makes sense given its one-off nature.

Thanks! A couple of final comments inline.

Not as familiar with clustermesh but k8s helm changes seem reasonable to me. Approving for @cilium/sig-k8s.