fix(scripts): make check-bootstrap.sh work under bash 3.2

[jvcorredor]

Summary

just smoke → smoke-bootstrap aborted on macOS:

scripts/check-bootstrap.sh: line 54: ns_args[@]: unbound variable

The script builds an optional namespace-args array and expands it as "${ns_args[@]}". For cluster-scoped resources (ClusterIssuer, ClusterSecretStore) that array is empty — and a bare empty-array expansion under set -u is an "unbound variable" error in bash 3.2 (macOS's /bin/bash, 3.2.57); it was only made safe in bash 4.4. The script worked on Linux (cluster / CI bash 5.x) but broke every time the operator ran just smoke from their Mac.

The namespaced Certificate check passed (non-empty array); the script then died on the cluster-scoped ClusterIssuer before checking it or the gsm ClusterSecretStore.

Fix

Use the bash-3.2-safe expansion "${ns_args[@]+"${ns_args[@]}"}" at both kubectl call sites — expands to nothing when the array is empty/unset, to the elements otherwise, no stray empty-string argument. A comment at the declaration records why the longer form is required.

Testing

Verified on this machine (bash 3.2.57):

$ bash -n scripts/check-bootstrap.sh        # syntax OK
$ TIMEOUT=30s bash scripts/check-bootstrap.sh
==> certificate.cert-manager.io -n cert-manager/wildcard-lab-jackhall-dev   condition met
==> clusterissuer.cert-manager.io/letsencrypt-dns01                         condition met
==> clustersecretstore.external-secrets.io/gsm                              condition met
bootstrap resources Ready=True                                              # exit 0

All three resources now check to completion. Combined with #212 and #215, just smoke passes end-to-end.

Context

Pre-existing and unrelated to Cilium — surfaced once #212 + #215 got smoke-cilium passing so execution reached smoke-bootstrap.

Closes: #216
Refs: #198

🤖 Generated with Claude Code