ci(kubernetes): stabilize HA e2e setup

.github/workflows/branch-e2e.yml

@@ -117,9 +117,11 @@ jobs:
     permissions:
       contents: read
       packages: read
-    uses: ./.github/workflows/e2e-kubernetes-ha-test.yml
+    uses: ./.github/workflows/e2e-kubernetes-test.yml
     with:
       image-tag: ${{ github.sha }}
+      job-name: Kubernetes HA E2E (Rust smoke)
+      extra-helm-values: deploy/helm/openshell/ci/values-high-availability.yaml
 
   core-e2e-result:
     name: Core E2E result

.github/workflows/e2e-kubernetes-test.yml

@@ -17,19 +17,29 @@ on:
         required: false
         type: string
         default: ""
+      job-name:
+        description: "Display name for the Kubernetes e2e job"
+        required: false
+        type: string
+        default: "Kubernetes E2E (Rust smoke)"
       extra-helm-values:
         description: "Colon-separated Helm values files to layer on the Kubernetes e2e chart install"
         required: false
         type: string
         default: ""
+      mise-version:
+        description: "mise version to install on the bare Kubernetes e2e runner"
+        required: false
+        type: string
+        default: "v2026.4.25"
 
 permissions:
   contents: read
   packages: read
 
 jobs:
   e2e-kubernetes:
-    name: Kubernetes E2E (Rust smoke)
+    name: ${{ inputs.job-name }}
     # Bare runner: running kind-in-container hits nested-Docker / kubeconfig
     # complications. The runner has Docker; mise installs helm, kubectl, and
     # the Rust toolchain.
@@ -40,6 +50,8 @@ jobs:
       packages: read
     env:
       MISE_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      # Keep bare-runner installs aligned with the project CI image.
+      MISE_VERSION: ${{ inputs.mise-version }}
       KIND_CLUSTER_NAME: kube-e2e-${{ github.run_id }}
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

deploy/helm/openshell/ci/values-high-availability.yaml

@@ -6,7 +6,19 @@
 # this overlay enables the bundled PostgreSQL dependency added by the chart.
 replicaCount: 2
 
+global:
+  security:
+    # The mirror serves the same pinned Bitnami PostgreSQL digest, but Bitnami's
+    # chart verification treats non-Docker-Hub registries as unrecognized.
+    allowInsecureImages: true
+
 postgres:
   enabled: true
+  # Keep the HA CI/dev overlay off Docker Hub's unauthenticated pull path.
+  # The Bitnami subchart defaults to registry-1.docker.io/bitnami/postgresql:latest.
+  image:
+    registry: mirror.gcr.io
+    repository: bitnami/postgresql
+    digest: sha256:7651d7f24aad83fe68a222f7f20eded10d325c96ebee285ca5bf8162eddcba64
   auth:
     password: openshell-ha-ci