FROM alpine/k8s:1.32.0
# No extra packages needed — kubectl and aws CLI are bundled in alpine/k8s
# OBS SSE-KMS handles encryption at rest; no openssl required