Merge pull request openshift#334 from e0ne/image-pull-secret

Pass imagePullSecrets values to operator components via helm chart
pacevedom · Aug 1, 2022 · e91b58d · e91b58d
2 parents d6c5f87 + f105b46
commit e91b58d
Show file tree

Hide file tree

Showing 10 changed files with 51 additions and 0 deletions.
diff --git a/bindata/manifests/daemon/daemonset.yaml b/bindata/manifests/daemon/daemonset.yaml
@@ -31,6 +31,12 @@ spec:
       - operator: Exists
       serviceAccountName: sriov-network-config-daemon
       priorityClassName: "system-node-critical"
+      {{- if .ImagePullSecrets }}
+      imagePullSecrets:
+      {{- range .ImagePullSecrets }}
+      - name: {{ . }}
+      {{- end }}
+      {{- end }}
       containers:
       - name: sriov-cni
         image: {{.SRIOVCNIImage}}

diff --git a/bindata/manifests/operator-webhook/server.yaml b/bindata/manifests/operator-webhook/server.yaml
@@ -47,6 +47,12 @@ spec:
       - key: "node.kubernetes.io/not-ready"
         operator: Exists
         effect: NoSchedule
+      {{- if .ImagePullSecrets }}
+      imagePullSecrets:
+      {{- range .ImagePullSecrets }}
+      - name: {{ . }}
+      {{- end }}
+      {{- end }}
       containers:
       - name: webhook-server
         image: {{.SriovNetworkWebhookImage}}

diff --git a/bindata/manifests/plugins/sriov-device-plugin.yaml b/bindata/manifests/plugins/sriov-device-plugin.yaml
@@ -32,6 +32,12 @@ spec:
       - operator: Exists
       serviceAccountName: sriov-device-plugin
       priorityClassName: "system-node-critical"
+      {{- if .ImagePullSecrets }}
+      imagePullSecrets:
+      {{- range .ImagePullSecrets }}
+        - name: {{ . }}
+      {{- end }}
+      {{- end }}
       containers:
       - name: sriov-device-plugin
         image: {{.SRIOVDevicePluginImage}}

diff --git a/bindata/manifests/webhook/server.yaml b/bindata/manifests/webhook/server.yaml
@@ -50,6 +50,12 @@ spec:
       - key: "node.kubernetes.io/not-ready"
         operator: Exists
         effect: NoSchedule
+      {{- if .ImagePullSecrets }}
+      imagePullSecrets:
+      {{- range .ImagePullSecrets }}
+      - name: {{ . }}
+      {{- end }}
+      {{- end }}
       containers:
       - name: webhook-server
         image: {{.NetworkResourcesInjectorImage}}

diff --git a/controllers/helper.go b/controllers/helper.go
@@ -18,6 +18,7 @@ package controllers
 
 import (
 	"os"
+	"strings"
 
 	constants "github.com/k8snetworkplumbingwg/sriov-network-operator/pkg/utils"
 )
@@ -28,3 +29,12 @@ var webhooks = map[string](string){
 }
 
 var namespace = os.Getenv("NAMESPACE")
+
+func GetImagePullSecrets() []string {
+	imagePullSecrets := os.Getenv("IMAGE_PULL_SECRETS")
+	if imagePullSecrets != "" {
+		return strings.Split(imagePullSecrets, ",")
+	} else {
+		return []string{}
+	}
+}
diff --git a/controllers/sriovnetworknodepolicy_controller.go b/controllers/sriovnetworknodepolicy_controller.go
@@ -334,6 +334,7 @@ func (r *SriovNetworkNodePolicyReconciler) syncPluginDaemonObjs(dp *sriovnetwork
 	data.Data["SRIOVDevicePluginImage"] = os.Getenv("SRIOV_DEVICE_PLUGIN_IMAGE")
 	data.Data["ReleaseVersion"] = os.Getenv("RELEASEVERSION")
 	data.Data["ResourcePrefix"] = os.Getenv("RESOURCE_PREFIX")
+	data.Data["ImagePullSecrets"] = GetImagePullSecrets()
 
 	objs, err := renderDsForCR(constants.PluginPath, &data)
 	if err != nil {

diff --git a/controllers/sriovoperatorconfig_controller.go b/controllers/sriovoperatorconfig_controller.go
@@ -173,6 +173,7 @@ func (r *SriovOperatorConfigReconciler) syncConfigDaemonSet(dc *sriovnetworkv1.S
 	data.Data["ReleaseVersion"] = os.Getenv("RELEASEVERSION")
 	data.Data["ClusterType"] = constants.ClusterType
 	data.Data["DevMode"] = os.Getenv("DEV_MODE")
+	data.Data["ImagePullSecrets"] = GetImagePullSecrets()
 	envCniBinPath := os.Getenv("SRIOV_CNI_BIN_PATH")
 	if envCniBinPath == "" {
 		data.Data["CNIBinPath"] = "/var/lib/cni/bin"
@@ -226,6 +227,7 @@ func (r *SriovOperatorConfigReconciler) syncWebhookObjs(dc *sriovnetworkv1.Sriov
 		data.Data["ClusterType"] = constants.ClusterType
 		data.Data["CaBundle"] = os.Getenv("WEBHOOK_CA_BUNDLE")
 		data.Data["DevMode"] = os.Getenv("DEV_MODE")
+		data.Data["ImagePullSecrets"] = GetImagePullSecrets()
 		objs, err := render.RenderDir(path, &data)
 		if err != nil {
 			logger.Error(err, "Fail to render webhook manifests")

diff --git a/deployment/sriov-network-operator/README.md b/deployment/sriov-network-operator/README.md
@@ -51,6 +51,10 @@ $ kubectl -n sriov-network-operator get pods
 In order to tailor the deployment of the network operator to your cluster needs
 We have introduced the following Chart parameters.
 
+| Name | Type | Default | description |
+| ---- |------|---------|-------------|
+| `imagePullSecrets` | list | `[]` | An optional list of references to secrets to use for pulling any of the SR-IOV Network Operator image |
+
 ### Operator parameters
 
 | Name | Type | Default | description |

diff --git a/deployment/sriov-network-operator/templates/operator.yaml b/deployment/sriov-network-operator/templates/operator.yaml
@@ -32,6 +32,12 @@ spec:
       {{- end }}
       serviceAccountName: {{ include "sriov-network-operator.fullname" . }}
       priorityClassName: "system-node-critical"
+      {{- if .ImagePullSecrets }}
+      imagePullSecrets:
+      {{- range .ImagePullSecrets }}
+      - name: {{ . }}
+      {{- end }}
+      {{- end }}
       containers:
         - name: {{ include "sriov-network-operator.fullname" . }}
           image: {{ .Values.images.operator }}
@@ -65,6 +71,8 @@ spec:
               value: {{ .Values.operator.resourcePrefix }}
             - name: ENABLE_ADMISSION_CONTROLLER
               value: {{ .Values.operator.enableAdmissionController | quote }}
+            - name: IMAGE_PULL_SECRETS
+              value: {{ join "," .Values.imagePullSecrets }}
             - name: NAMESPACE
               valueFrom:
                 fieldRef:

diff --git a/deployment/sriov-network-operator/values.yaml b/deployment/sriov-network-operator/values.yaml
@@ -35,3 +35,5 @@ images:
   sriovDevicePlugin: ghcr.io/k8snetworkplumbingwg/sriov-network-device-plugin
   resourcesInjector: ghcr.io/k8snetworkplumbingwg/network-resources-injector
   webhook: ghcr.io/k8snetworkplumbingwg/sriov-network-operator-webhook
+
+imagePullSecrets: []