Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat: add image pull secrets support #33

Merged
merged 2 commits into from
Dec 1, 2022
Merged

feat: add image pull secrets support #33

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
36a783b
feat: add image pull secrets support
eddycharly Dec 1, 2022
8f7b975
Merge branch 'main' into pull-secrets
eddycharly Dec 1, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 1 addition & 2 deletions charts/kyverno-aws-adapter/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -42,13 +42,12 @@ You’ll need an [EKS](https://aws.amazon.com/eks/) cluster to run against.
| pollInterval | int | `30` | Interval at which the controller reconciles in minutes |
| eksCluster.name | string | `nil` | EKS cluster name |
| eksCluster.region | string | `nil` | EKS cluster region |
| registryConfig.username | string | `nil` | Username to pull the private image (ghcr.io) |
| registryConfig.password | string | `nil` | Password to pull the private image (ghcr.io) |
| rbac.create | bool | `true` | Enable RBAC resources creation |
| rbac.serviceAccount.name | string | `nil` | Service account name, you MUST provide one when `rbac.create` is set to `false` |
| image.repository | string | `"ghcr.io/nirmata/kyverno-aws-adapter"` | Image repository |
| image.pullPolicy | string | `"Always"` | Image pull policy |
| image.tag | string | `nil` | Image tag (defaults to chart app version) |
| image.imagePullSecrets | list | `[]` | Image pull secrets |

## IAM Role for Service Account

Expand Down
4 changes: 2 additions & 2 deletions charts/kyverno-aws-adapter/templates/deployment.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,9 +16,9 @@ spec:
labels:
{{- include "kyverno-aws-adapter.labels" . | nindent 8 }}
spec:
{{- if .Values.registryConfig.username }}
{{- with .Values.image.imagePullSecrets }}
imagePullSecrets:
- name: {{ include "kyverno-aws-adapter.fullname" . }}
{{- toYaml . | nindent 8 }}
{{- end }}
containers:
- command:
Expand Down
11 changes: 0 additions & 11 deletions charts/kyverno-aws-adapter/templates/secret.yaml
View file
Open in desktop

This file was deleted.

8 changes: 2 additions & 6 deletions charts/kyverno-aws-adapter/values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,12 +20,6 @@ eksCluster:
# -- EKS cluster region
region:

registryConfig:
# -- Username to pull the private image (ghcr.io)
username:
# -- Password to pull the private image (ghcr.io)
password:

rbac:
# -- Enable RBAC resources creation
create: true
Expand All @@ -41,3 +35,5 @@ image:
pullPolicy: Always
Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Do we really want Always here ?
cc @anusha94 @pns-nirmata

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

'Always' allows pulling a new version of image corresponding to a tag in case it is updated. Say, xyz:v0.1.0 is upgraded to xyz:v0.1.1, then having an image with xyz:v0.1 can get the fixes done in v0.1.1 by just a restart. No change to the gitops yaml is needed. Secondly, fail fast if the image is erroneous, needs to be removed.

Downside is of course, it takes time.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't have a better answer. But let's change it to IfNotPresent since that's the default behavior usually. The user can always provide a different value if needed.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, that can be the default.

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Are we going to release different images with the same tag ?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Leaves an option. Like ":latest". It is a pointer that could point to different versions.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Are we going to release different images with the same tag

I don't think that's true at the moment. We can change it to Never if that's the case in the future.
Let's go with IfNotPresent for now.

# -- Image tag (defaults to chart app version)
tag:
# -- Image pull secrets
imagePullSecrets: []