Skip to content

Commit 40ec690

Browse files
knrcknrc
committed
feat: add support for image pull secrets for all components
Signed-off-by: Kevin Conner <kev.conner@gmail.com>
1 parent 114060b commit 40ec690

37 files changed

+977
-25
lines changed

‎.crdify.yaml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
validations:
2+
- name: description
3+
enforcement: None

‎.github/workflows/linter.yml‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -31,27 +31,27 @@ jobs:
3131
go-version-file: 'go.mod'
3232
- name: Install crdifi
3333
run: |
34-
go install sigs.k8s.io/crdify@v0.4.0
34+
go install sigs.k8s.io/crdify@v0.5.0
3535
- name: Compare CTlog CRD
3636
run: |
37-
crdify "git://${{ github.event.pull_request.base.sha }}?path=config/crd/bases/rhtas.redhat.com_ctlogs.yaml" "git://${{ github.event.pull_request.head.sha }}?path=config/crd/bases/rhtas.redhat.com_ctlogs.yaml"
37+
crdify --config .crdify.yaml "git://${{ github.event.pull_request.base.sha }}?path=config/crd/bases/rhtas.redhat.com_ctlogs.yaml" "git://${{ github.event.pull_request.head.sha }}?path=config/crd/bases/rhtas.redhat.com_ctlogs.yaml"
3838
- name: Compare Fulcio CRD
3939
run: |
40-
crdify "git://${{ github.event.pull_request.base.sha }}?path=config/crd/bases/rhtas.redhat.com_fulcios.yaml" "git://${{ github.event.pull_request.head.sha }}?path=config/crd/bases/rhtas.redhat.com_fulcios.yaml"
40+
crdify --config .crdify.yaml "git://${{ github.event.pull_request.base.sha }}?path=config/crd/bases/rhtas.redhat.com_fulcios.yaml" "git://${{ github.event.pull_request.head.sha }}?path=config/crd/bases/rhtas.redhat.com_fulcios.yaml"
4141
- name: Compare Rekor CRD
4242
run: |
43-
crdify "git://${{ github.event.pull_request.base.sha }}?path=config/crd/bases/rhtas.redhat.com_rekors.yaml" "git://${{ github.event.pull_request.head.sha }}?path=config/crd/bases/rhtas.redhat.com_rekors.yaml"
43+
crdify --config .crdify.yaml "git://${{ github.event.pull_request.base.sha }}?path=config/crd/bases/rhtas.redhat.com_rekors.yaml" "git://${{ github.event.pull_request.head.sha }}?path=config/crd/bases/rhtas.redhat.com_rekors.yaml"
4444
- name: Compare TSA CRD
4545
run: |
46-
crdify "git://${{ github.event.pull_request.base.sha }}?path=config/crd/bases/rhtas.redhat.com_timestampauthorities.yaml" "git://${{ github.event.pull_request.head.sha }}?path=config/crd/bases/rhtas.redhat.com_timestampauthorities.yaml"
46+
crdify --config .crdify.yaml "git://${{ github.event.pull_request.base.sha }}?path=config/crd/bases/rhtas.redhat.com_timestampauthorities.yaml" "git://${{ github.event.pull_request.head.sha }}?path=config/crd/bases/rhtas.redhat.com_timestampauthorities.yaml"
4747
- name: Compare Trillian CRD
4848
run: |
49-
crdify "git://${{ github.event.pull_request.base.sha }}?path=config/crd/bases/rhtas.redhat.com_trillians.yaml" "git://${{ github.event.pull_request.head.sha }}?path=config/crd/bases/rhtas.redhat.com_trillians.yaml"
49+
crdify --config .crdify.yaml "git://${{ github.event.pull_request.base.sha }}?path=config/crd/bases/rhtas.redhat.com_trillians.yaml" "git://${{ github.event.pull_request.head.sha }}?path=config/crd/bases/rhtas.redhat.com_trillians.yaml"
5050
- name: Compare TUF CRD
5151
run: |
52-
crdify "git://${{ github.event.pull_request.base.sha }}?path=config/crd/bases/rhtas.redhat.com_tufs.yaml" "git://${{ github.event.pull_request.head.sha }}?path=config/crd/bases/rhtas.redhat.com_tufs.yaml"
52+
crdify --config .crdify.yaml "git://${{ github.event.pull_request.base.sha }}?path=config/crd/bases/rhtas.redhat.com_tufs.yaml" "git://${{ github.event.pull_request.head.sha }}?path=config/crd/bases/rhtas.redhat.com_tufs.yaml"
5353
- name: Compare Securesign CRD
5454
run: |
55-
crdify "git://${{ github.event.pull_request.base.sha }}?path=config/crd/bases/rhtas.redhat.com_securesigns.yaml" "git://${{ github.event.pull_request.head.sha }}?path=config/crd/bases/rhtas.redhat.com_securesigns.yaml"
55+
crdify --config .crdify.yaml "git://${{ github.event.pull_request.base.sha }}?path=config/crd/bases/rhtas.redhat.com_securesigns.yaml" "git://${{ github.event.pull_request.head.sha }}?path=config/crd/bases/rhtas.redhat.com_securesigns.yaml"
5656
5757

‎api/v1alpha1/common.go‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -159,3 +159,9 @@ type PodRequirements struct {
159159
Resources *core.ResourceRequirements `json:"resources,omitempty"`
160160
Tolerations []core.Toleration `json:"tolerations,omitempty"`
161161
}
162+
163+
type ServiceAccountRequirements struct {
164+
// ImagePullSecrets is an optional list of references to secrets for pulling container images.
165+
//+optional
166+
ImagePullSecrets []core.LocalObjectReference `json:"imagePullSecrets,omitempty"`
167+
}

‎api/v1alpha1/ctlog_types.go‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -58,6 +58,8 @@ type CTlogSpec struct {
5858
//+kubebuilder:default:=153600
5959
//+optional
6060
MaxCertChainSize *int64 `json:"maxCertChainSize,omitempty"`
61+
62+
ServiceAccountRequirements `json:",inline"`
6163
}
6264

6365
// CTlogStatus defines the observed state of CTlog component

‎api/v1alpha1/fulcio_types.go‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,8 @@ type FulcioSpec struct {
3333
// ConfigMap with additional bundle of trusted CA
3434
//+optional
3535
TrustedCA *LocalObjectReference `json:"trustedCA,omitempty"`
36+
37+
ServiceAccountRequirements `json:",inline"`
3638
}
3739

3840
// FulcioCert defines fields for system-generated certificate

‎api/v1alpha1/rekor_types.go‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -58,6 +58,8 @@ type RekorSpec struct {
5858
//+kubebuilder:default:=10485760
5959
//+optional
6060
MaxRequestBodySize *int64 `json:"maxRequestBodySize,omitempty"`
61+
62+
ServiceAccountRequirements `json:",inline"`
6163
}
6264

6365
// RekorAttestations defines the configuration for storing attestations.

‎api/v1alpha1/securesign_types.go‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,8 @@ import (
2424
// EDIT THIS FILE! THIS IS SCAFFOLDING FOR YOU TO OWN!
2525
// NOTE: json tags are required. Any new fields you add must have json tags for the fields to be serialized.
2626

27-
// SecuresignSpec defines the desired state of Securesign
27+
// SecuresignSpec defines the desired state of Securesign.
28+
// Service account settings defined at this level (such as imagePullSecrets) are inherited by all components.
2829
// +kubebuilder:validation:XValidation:rule="(has(self.rekor.attestations.enabled) && !self.rekor.attestations.enabled) || !self.rekor.attestations.url.startsWith('file://') || (!(self.rekor.replicas > 1) || ('ReadWriteMany' in self.rekor.pvc.accessModes))",message="When Rekor's rich attestation storage is enabled, and it's URL starts with 'file://', then PVC accessModes must contain 'ReadWriteMany' for replicas greater than 1."
2930
// +kubebuilder:validation:XValidation:rule="!(self.tuf.replicas > 1) || ('ReadWriteMany' in self.tuf.pvc.accessModes)",message="For TUF deployments with more than 1 replica, tuf.pvc.accessModes must include 'ReadWriteMany'."
3031
type SecuresignSpec struct {
@@ -35,6 +36,8 @@ type SecuresignSpec struct {
3536
Tuf TufSpec `json:"tuf,omitempty"`
3637
Ctlog CTlogSpec `json:"ctlog,omitempty"`
3738
TimestampAuthority *TimestampAuthoritySpec `json:"tsa,omitempty"`
39+
40+
ServiceAccountRequirements `json:",inline"`
3841
}
3942

4043
// SecuresignStatus defines the observed state of Securesign

‎api/v1alpha1/timestampauthority_types.go‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -42,6 +42,8 @@ type TimestampAuthoritySpec struct {
4242
//+kubebuilder:default:=1048576
4343
//+optional
4444
MaxRequestBodySize *int64 `json:"maxRequestBodySize,omitempty"`
45+
46+
ServiceAccountRequirements `json:",inline"`
4547
}
4648

4749
// TimestampAuthoritySigner defines the desired state of the Timestamp Authority Signer

‎api/v1alpha1/trillian_types.go‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -42,6 +42,8 @@ type TrillianSpec struct {
4242
//+kubebuilder:default:=153600
4343
//+optional
4444
MaxRecvMessageSize *int64 `json:"maxRecvMessageSize,omitempty"`
45+
46+
ServiceAccountRequirements `json:",inline"`
4547
}
4648

4749
type trillianService struct {

‎api/v1alpha1/tuf_types.go‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,8 @@ type TufSpec struct {
2929
// You can use ReadWriteOnce accessMode if you don't have suitable storage provider but your deployment will not support HA mode
3030
//+kubebuilder:default:={size: "100Mi",retain: true,accessModes: {ReadWriteOnce}}
3131
Pvc TufPvc `json:"pvc,omitempty"`
32+
33+
ServiceAccountRequirements `json:",inline"`
3234
}
3335

3436
// TufPvc configuration of the persistent storage claim for deployment in the cluster.

0 commit comments

Comments
 (0)