Allow specifying image pull secret

images/hub/jupyterhub_config.py

@@ -48,6 +48,8 @@
 
 c.KubeSpawner.image_pull_policy = get_config('singleuser.image-pull-policy')
 
+c.KubeSpawner.image_pull_secrets = get_config('singleuser.image-pull-secret', None)
+
 c.KubeSpawner.events_enabled = get_config('singleuser.events', False)
 
 c.KubeSpawner.extra_labels = get_config('singleuser.extra-labels', {})

jupyterhub/templates/_helpers.tpl

@@ -9,7 +9,7 @@
   generate some output based on one single dictionary of input that we call the
   helpers scope. When you are in helm, you access your current scope with a
   single a single punctuation (.).
-  
+
   When you ask a helper to render its content, one often forward the current
   scope to the helper in order to allow it to access .Release.Name,
   .Values.rbac.enabled and similar values.
@@ -27,7 +27,7 @@
   To let a helper access the current scope along with additional values we have
   opted to create dictionary containing additional values that is then populated
   with additional values from the current scope through a the merge function.
-  
+
   #### Example - Passing a new scope augmented with the old
   {{- $_ := merge (dict "appLabel" "kube-lego") . }}
   {{- include "jupyterhub.matchLabels" $_ | nindent 6 }}
@@ -97,7 +97,7 @@
     Used by "jupyterhub.labels" and "jupyterhub.nameField".
 
     NOTE: The component label is determined by either...
-    - 1: The provided scope's .componentLabel 
+    - 1: The provided scope's .componentLabel
     - 2: The template's filename if living in the root folder
     - 3: The template parent folder's name
     -  : ...and is combined with .componentPrefix and .componentSuffix
@@ -172,3 +172,11 @@ component: {{ include "jupyterhub.componentLabel" . }}
 {{- $_ := merge (dict "componentLabel" "singleuser-server") . -}}
 {{ include "jupyterhub.matchLabels" $_ | replace ": " "=" | replace "\n" "," | quote }}
 {{- end }}
+
+{{- /*
+  singleuser.image.pullSecret:
+    allows creating a base64 encoded docker registry json blob
+*/}}
+{{- define "singleuser.image.pullSecret" }}
+{{- printf "{\"auths\": {\"%s\": {\"auth\": \"%s\"}}}" .Values.singleuser.image.pullSecret.registry (printf "%s:%s" .Values.singleuser.image.pullSecret.username .Values.singleuser.image.pullSecret.password | b64enc) | b64enc }}
+{{- end }}

jupyterhub/templates/hub/configmap.yaml

@@ -67,7 +67,7 @@ data:
   auth.gitlab.client-secret: {{ .Values.auth.gitlab.clientSecret | quote }}
   auth.gitlab.callback-url: {{ .Values.auth.gitlab.callbackUrl | quote }}
   {{- end }}
-  
+
   {{- if eq .Values.auth.type "mediawiki" }}
   auth.mediawiki.client-id: {{ .Values.auth.mediawiki.clientId | quote }}
   auth.mediawiki.client-secret: {{ .Values.auth.mediawiki.clientSecret | quote }}
@@ -80,7 +80,7 @@ data:
   auth.globus.callback-url: {{ .Values.auth.globus.callbackUrl | quote }}
   auth.globus.identity-provider: {{ .Values.auth.globus.identityProvider | quote }}
   {{- end }}
-  
+
   {{- if eq .Values.auth.type "lti" }}
   auth.lti.consumers: |
     {{- .Values.auth.lti.consumers | toYaml | trimSuffix "\n" | nindent 4 }}
@@ -108,7 +108,7 @@ data:
   auth.ldap.dn.user.search-base: {{ .Values.auth.ldap.dn.user.searchBase | quote }}
   auth.ldap.dn.user.attribute: {{ .Values.auth.ldap.dn.user.attribute | quote }}
   {{- end }}
-  
+
   {{- if eq .Values.auth.type "dummy" }}
   {{- if .Values.auth.dummy.password }}
   auth.dummy.password: {{ .Values.auth.dummy.password | quote }}
@@ -133,6 +133,9 @@ data:
     {{- .Values.singleuser.cloudMetadata | toYaml | trimSuffix "\n" | nindent 4 }}
   singleuser.start-timeout: {{ .Values.singleuser.startTimeout | quote }}
   singleuser.image-pull-policy: {{ .Values.singleuser.image.pullPolicy | quote }}
+  {{- if .Values.singleuser.image.pullSecret }}
+  singleuser.image-pull-secret: singleuser-image-credentials
+  {{- end }}
   {{- if .Values.singleuser.cmd }}
   singleuser.cmd: {{ .Values.singleuser.cmd | quote }}
   {{- end }}
@@ -190,8 +193,8 @@ data:
     {{ $key | quote }}: {{ $value | quote }}
     {{- end }}
   {{- end }}
-  
-  
+
+
   {{- /* KubeSpawner */}}
   kubespawner.common-labels: |
     {{- $_ := merge (dict "heritageLabel" "jupyterhub") . }}

jupyterhub/templates/singleuser/image-credentials-secret.yaml

@@ -0,0 +1,12 @@
+{{- if .Values.singleuser.image.pullSecret }}
+kind: Secret
+apiVersion: v1
+metadata:
+  name: singleuser-image-credentials
+  labels:
+    {{- $_ := merge (dict "componentSuffix" "-image-credentials") . }}
+    {{- include "jupyterhub.labels" $_ | nindent 4 }}
+type: kubernetes.io/dockerconfigjson
+data:
+  .dockerconfigjson: {{ template "singleuser.image.pullSecret" . }}
+{{- end }}