karmadactl: add image pull secret flags for karmadactl init

[my-git9]

What type of PR is this?

/kind feature

What this PR does / why we need it:
In a production environment, registry are generally non-public. If the registry we get from the administrator is private, we need to configure the imagepullsecret in the application's yaml file.
So I think it would be better if karmadactl init could specify imagepullsecret.

Which issue(s) this PR fixes:
Fixes #

Special notes for your reviewer:

Does this PR introduce a user-facing change?:

`karmadactl`: Introduced `--image-pull-secrets` flag to `init` command to specify the secret.`

[codecov-commenter]

Codecov Report

Merging #3237 (efd0beb) into master (17533ac) will increase coverage by 0.00%.
The diff coverage is 50.00%.

📣 This organization is not using Codecov’s GitHub App Integration. We recommend you install it so Codecov can continue to function properly for your repositories. Learn more

@@           Coverage Diff           @@
##           master    #3237   +/-   ##
=======================================
  Coverage   49.20%   49.21%           
=======================================
  Files         203      203           
  Lines       18354    18372   +18     
=======================================
+ Hits         9032     9041    +9     
- Misses       8835     8843    +8     
- Partials      487      488    +1     

Flag	Coverage Δ
unittests	49.21% <50.00%> (+<0.01%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

Impacted Files	Coverage Δ
pkg/karmadactl/cmdinit/kubernetes/statefulset.go	0.00% <0.00%> (ø)
pkg/karmadactl/cmdinit/kubernetes/deploy.go	7.84% <20.00%> (+0.30%)	⬆️
pkg/karmadactl/cmdinit/cmdinit.go	73.07% <100.00%> (+0.34%)	⬆️
pkg/karmadactl/cmdinit/kubernetes/deployments.go	100.00% <100.00%> (ø)

Help us with your feedback. Take ten seconds to tell us how you rate us. Have a feature suggestion? Share it here.

[RainbowMango]

Hi @my-git9 Can you explain more about why we need this flag in the PR description?

[my-git9]

Hi @my-git9 Can you explain more about why we need this flag in the PR description?

The description has been updated, thanks

[RainbowMango]

In a production environment, registry are generally non-public. If the registry we get from the administrator is private, we need to configure the imagepullsecret in the application's yaml file.

It makes sense to me. I guess it should be used along with --private-image-registry, right?
But, what if people also specified --kube-image-registry? Should we set the imagePullSecrets for all components in that case?

[my-git9]

--kube-image-registry

The --kube-image-registry parameter seems to be more designed for the public network environment, if it seems that there is no need to specify imagepullsecret in the public network environment.
In a production environment, the image of kube's k8s should also be managed by a private registry, and imagepullsecret should be required. If both --private-image-registry and --kube-image-registry are specified and from different registry, we can specify two imagepullsecret. What you think?

[RainbowMango]

I'd like to invite @lonelyCZ for comments.

[lonelyCZ]

If both --private-image-registry and --kube-image-registry are specified and from different registry, we can specify two imagepullsecret. What you think?

I think it seems rare for using --private-image-registry and --kube-image-registry togather.

--kube-image-registry is mainly designed for solving that some people can't access k8s.gcr.io registry.

We should only consider a common case, otherwise it even need to set different pull secret for each image. So I this it only set one flag pull secrets for all components. In my opinion, if the registry need secret, it will found a matched secret in ImagePullSecrets, otherwise it don't need a secret even if already set this field.

[RainbowMango]

In my opinion, if the registry need secret, it will found a matched secret in ImagePullSecrets, otherwise it don't need a secret even if already set this field.

Do you mean the kubelet knows if the specified registry requires a secret? For public registry, the ImagePullSecrets will not be used even it is set, right?

[jwcesign]

Do you mean the kubelet knows if the specified registry requires a secret? For public registry, the ImagePullSecrets will not be used even it is set, right?

kubelet will try to select the secret by matching the registry. If not match, it will try without secrets.

https://github.com/kubernetes/kubernetes/blob/a55bd631728590045b51a4f65bba31aed1415571/pkg/kubelet/kuberuntime/kuberuntime_image.go#L45

[lonelyCZ]

Do you mean the kubelet knows if the specified registry requires a secret? For public registry, the ImagePullSecrets will not be used even it is set, right?

Yes, I just tried it that was ok.

[RainbowMango]

Thanks, I get it. Then, we don't need two flags for the pull secrets.

[RainbowMango]

Please share a test report here.
I wonder how to use it, especially how to prepare the secrets.

[my-git9]

If we want to use this parameter, we should have the following steps:

1. Create a namespace in advance, such as karmada-system
2. Create the required pullsecret in the namespace in advance, such as pullsecret1
3. Execute the installation command: karmactl init --image-pull-secrets=pullsecret1

The result:

$  ./karmadactl init --image-pull-secrets PullSecret1,PullSecret --crds /tmp/xx.tar.gz --kube-image-registry=registry.cn-hangzhou.aliyuncs.com/google_containers
....
$
$kubectl -nkarmada-system get po -oyaml |grep -A 1 imagePullSecrets
    imagePullSecrets:
    - name: PullSecret1
--
    imagePullSecrets:
    - name: PullSecret1
--
    imagePullSecrets:
    - name: PullSecret1

@RainbowMango

[RainbowMango]

OK, I get it. I guess we can explain it in the flag usage.

[my-git9]

OK, I get it. I guess we can explain it in the flag usage.

Updated, thanks

[RainbowMango]

Generally looks good to me.

Please @lonelyCZ take a look.
And consider if we need to add validation for checking the existence of the secret.

[RainbowMango]

Generally looks good to me now.
/assign @lonelyCZ

[RainbowMango]

/lgtm
/assign @lonelyCZ

Thanks.

[lonelyCZ]

I just tested it in my env that worked fine!

/approve

[karmada-bot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: lonelyCZ

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• pkg/karmadactl/cmdinit/OWNERS [lonelyCZ]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment