Skip to content

Commit

Permalink
Support multiple ImagePullSecrets
Browse files Browse the repository at this point in the history
  • Loading branch information
chunter0 committed Jul 29, 2024
1 parent 1583cb7 commit 71072f5
Show file tree
Hide file tree
Showing 8 changed files with 344 additions and 14 deletions.
6 changes: 6 additions & 0 deletions changelog/v0.40.5/image-pull-secrets.yaml
Original file line number Diff line number Diff line change
@@ -0,0 +1,6 @@
changelog:
- type: FIX
issueLink: https://github.com/solo-io/skv2/issues/574
description: >
Add support for multiple ImagePullSecret references
skipCI: "false"
115 changes: 106 additions & 9 deletions codegen/cmd_test.go
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,9 @@ package codegen_test
import (
"bytes"
"encoding/json"
"errors"
"fmt"
"io"
"os"
"os/exec"
"path/filepath"
Expand Down Expand Up @@ -41,6 +43,107 @@ var _ = Describe("Cmd", func() {
skv2Imports.External["github.com/solo-io/cue"] = []string{
"encoding/protobuf/cue/cue.proto",
}
Describe("image pull secrets", Ordered, func() {
BeforeAll(func() {
cmd := &Command{
Chart: &Chart{
Data: Data{
ApiVersion: "v1",
Description: "",
Name: "Painting Operator",
Version: "v0.0.1",
Home: "https://docs.solo.io/skv2/latest",
Sources: []string{
"https://github.com/solo-io/skv2",
},
},
Operators: []Operator{{
Name: "painter",
Deployment: Deployment{
Container: Container{
Image: Image{
Tag: "v0.0.0",
Repository: "painter",
Registry: "quay.io/solo-io",
PullPolicy: "IfNotPresent",
},
},
},
Values: map[string]any{
"imagePullSecrets": []v1.LocalObjectReference{},
},
}},
},
ManifestRoot: "codegen/test/chart/image-pull-secrets",
}
Expect(cmd.Execute()).NotTo(HaveOccurred(), "failed to execute command")
})
DescribeTable(
"using",
func(values any, expected ...v1.LocalObjectReference) {
manifests := helmTemplate("./test/chart/image-pull-secrets", values)

var (
renderedDeployment *appsv1.Deployment
decoder = kubeyaml.NewYAMLOrJSONDecoder(bytes.NewBuffer(manifests), 4096)
)
for {
var deployment appsv1.Deployment
if err := decoder.Decode(&deployment); errors.Is(err, io.EOF) {
break
}

if deployment.GetName() == "painter" && deployment.Kind == "Deployment" {
renderedDeployment = &deployment
break
}
}
Expect(renderedDeployment).NotTo(BeNil())
Expect(renderedDeployment.Spec.Template.Spec.ImagePullSecrets).To(ContainElements(expected))
},

Entry(
"legacy pullSecret field",
map[string]any{
"painter": map[string]any{
"enabled": true,
"image": map[string]any{
"pullSecret": "a-registry",
},
},
},
v1.LocalObjectReference{Name: "a-registry"},
),
Entry(
"imagePullSecrets field",
map[string]any{
"painter": map[string]any{
"enabled": true,
"imagePullSecrets": []v1.LocalObjectReference{{
Name: "b-registry",
}},
},
},
v1.LocalObjectReference{Name: "b-registry"},
),
Entry(
"imagePullSecrets field with legacy",
map[string]any{
"painter": map[string]any{
"enabled": true,
"image": map[string]any{
"pullSecret": "a-registry",
},
"imagePullSecrets": []v1.LocalObjectReference{{
Name: "b-registry",
}},
},
},
v1.LocalObjectReference{Name: "a-registry"}, v1.LocalObjectReference{Name: "b-registry"},
),
)
})

It("env variable priority", func() {
cmd := &Command{
Chart: &Chart{
Expand Down Expand Up @@ -3143,7 +3246,7 @@ roleRef:

func helmTemplate(path string, values interface{}) []byte {
raw, err := yaml.Marshal(values)
ExpectWithOffset(0, err).NotTo(HaveOccurred())
ExpectWithOffset(0, err).NotTo(HaveOccurred(), "failed to marshal values")

helmValuesFile, err := os.CreateTemp("", "-helm-values-skv2-test")
ExpectWithOffset(0, err).NotTo(HaveOccurred())
Expand All @@ -3159,16 +3262,10 @@ func helmTemplate(path string, values interface{}) []byte {
cc := exec.Command("helm", "template",
path,
"--values", helmValuesFile.Name(),
"--debug",
)
out, err := cc.CombinedOutput()
defer func(e error) {
if e == nil {
return
}
fmt.Printf("[Cameron]: failed to run %s\n", cc.String())
}(err)

ExpectWithOffset(0, err).NotTo(HaveOccurred(), string(out))
ExpectWithOffset(0, err).NotTo(HaveOccurred(), "helm template failed")
return out
}

Expand Down
16 changes: 11 additions & 5 deletions codegen/templates/chart/operator-deployment.yamltmpl
Original file line number Diff line number Diff line change
Expand Up @@ -241,20 +241,26 @@ spec:
{{- end }}
[[- end ]]
[[- end ]]
{{- $pullSecrets := $[[ $operatorVar ]].imagePullSecrets }}
{{- if $[[ $operatorVar ]]Image.pullSecret }}
{{- $pullSecrets = append $pullSecrets (dict "name" $[[ $operatorVar ]]Image.pullSecret) }}
{{- end }}
{{- if $pullSecrets }}
imagePullSecrets:
- name: {{ $[[ $operatorVar ]]Image.pullSecret }}
{{- end}}
{{- end }} {{/* define "[[ $operator.Name ]].deploymentSpec" */}}
{{- end }}
{{- range $secret := $pullSecrets }}
- {{ toYaml $secret }}
{{- end }}
{{- end }} {{- /* define "[[ $operator.Name ]].deploymentSpec" */ -}}

{{/* Render [[ $operator.Name ]] deployment template with overrides from values*/}}
{{- /* Render [[ $operator.Name ]] deployment template with overrides from values */ -}}
[[- $operatorEnabledCondition -]]
{{- $[[ $operatorVar ]]DeploymentOverrides := dict }}
{{- if $[[ $operatorVar ]].deploymentOverrides }}
{{- $[[ $operatorVar ]]DeploymentOverrides = $[[ $operatorVar ]].deploymentOverrides }}
{{- end }}
---
{{ include "skv2.utils.merge" (list . $[[ $operatorVar ]]DeploymentOverrides "[[ $operator.Name ]].deploymentSpec") }}
{{- include "skv2.utils.merge" (list . $[[ $operatorVar ]]DeploymentOverrides "[[ $operator.Name ]].deploymentSpec") -}}
{{- end }}
---

Expand Down
8 changes: 8 additions & 0 deletions codegen/test/chart/image-pull-secrets/Chart.yaml
Original file line number Diff line number Diff line change
@@ -0,0 +1,8 @@
# Code generated by skv2. DO NOT EDIT.

apiVersion: v1
home: https://docs.solo.io/skv2/latest
name: Painting Operator
sources:
- https://github.com/solo-io/skv2
version: v0.0.1
54 changes: 54 additions & 0 deletions codegen/test/chart/image-pull-secrets/templates/_helpers.tpl
Original file line number Diff line number Diff line change
@@ -0,0 +1,54 @@
# Code generated by skv2. DO NOT EDIT.



{{/* Below are library functions provided by skv2 */}}

{{- /*
"skv2.utils.merge" takes an array of three values:
- the top context
- the yaml block that will be merged in (override)
- the name of the base template (source)
note: the source must be a named template (helm partial). This is necessary for the merging logic.
The behaviour is as follows, to align with already existing helm behaviour:
- If no source is found (template is empty), the merged output will be empty
- If no overrides are specified, the source is rendered as is
- If overrides are specified and source is not empty, overrides will be merged in to the source.
Overrides can replace / add to deeply nested dictionaries, but will completely replace lists.
Examples:
┌─────────────────────┬───────────────────────┬────────────────────────┐
│ Source (template) │ Overrides │ Result │
├─────────────────────┼───────────────────────┼────────────────────────┤
│ metadata: │ metadata: │ metadata: │
│ labels: │ labels: │ labels: │
│ app: gloo │ app: gloo1 │ app: gloo1 │
│ cluster: useast │ author: infra-team │ author: infra-team │
│ │ │ cluster: useast │
├─────────────────────┼───────────────────────┼────────────────────────┤
│ lists: │ lists: │ lists: │
│ groceries: │ groceries: │ groceries: │
│ - apple │ - grapes │ - grapes │
│ - banana │ │ │
└─────────────────────┴───────────────────────┴────────────────────────┘
skv2.utils.merge is a fork of a helm library chart function (https://github.com/helm/charts/blob/master/incubator/common/templates/_util.tpl).
This includes some optimizations to speed up chart rendering time, and merges in a value (overrides) with a named template, unlike the upstream
version, which merges two named templates.
*/ -}}
{{- define "skv2.utils.merge" -}}
{{- $top := first . -}}
{{- $overrides := (index . 1) -}}
{{- $tpl := fromYaml (include (index . 2) $top) -}}
{{- if or (empty $overrides) (empty $tpl) -}}
{{ include (index . 2) $top }} {{/* render source as is */}}
{{- else -}}
{{- $merged := merge $overrides $tpl -}}
{{- toYaml $merged -}} {{/* render source with overrides as YAML */}}
{{- end -}}
{{- end -}}
138 changes: 138 additions & 0 deletions codegen/test/chart/image-pull-secrets/templates/deployment.yaml
Original file line number Diff line number Diff line change
@@ -0,0 +1,138 @@
# Code generated by skv2. DO NOT EDIT.



{{- $painter := $.Values.painter }}
---

{{- define "painter.deploymentSpec" }}
# Deployment manifest for painter

apiVersion: apps/v1
kind: Deployment
metadata:
labels:
app: painter
annotations:
app.kubernetes.io/name: painter
name: painter
namespace: {{ default .Release.Namespace $.Values.painter.namespace }}
spec:
selector:
matchLabels:
app: painter
template:
metadata:
labels:
app: painter
annotations:
app.kubernetes.io/name: painter
spec:
serviceAccountName: painter
{{- /* Override the default podSecurityContext config if it is set. */}}
{{- if or ($.Values.painter.podSecurityContext) (eq "map[]" (printf "%v" $.Values.painter.podSecurityContext)) }}
securityContext:
{{ toYaml $.Values.painter.podSecurityContext | indent 8 }}
{{- end }}
containers:
{{- $painter := $.Values.painter }}
{{- $painterImage := $painter.image }}
- name: painter
image: {{ $painterImage.registry }}/{{ $painterImage.repository }}:{{ $painterImage.tag }}
imagePullPolicy: {{ $painterImage.pullPolicy }}
{{- if or $painter.env $painter.extraEnvs }}
env:
{{- end }}
{{- if $painter.env }}
{{- toYaml $painter.env | nindent 10 }}
{{- end }}
{{- range $name, $item := $painter.extraEnvs }}
- name: {{ $name }}
{{- $item | toYaml | nindent 12 }}
{{- end }}
resources:
{{- if $painter.resources }}
{{ toYaml $painter.resources | indent 10}}
{{- else}}
requests:
cpu: 500m
memory: 256Mi
{{- end }}
{{- /*
Render securityContext configs if it is set.
If securityContext is not set, render the default securityContext.
If securityContext is set to 'false', render an empty map.
*/}}
securityContext:
{{- if or ($painter.securityContext) (eq "map[]" (printf "%v" $painter.securityContext)) }}
{{ toYaml $painter.securityContext | indent 10}}
{{/* Because securityContext is nil by default we can only perform following conversion if it is a boolean. Skip conditional otherwise. */}}
{{- else if eq (ternary $painter.securityContext true (eq "bool" (printf "%T" $painter.securityContext))) false }}
{}
{{- else}}
runAsNonRoot: true
{{- if not $painter.floatingUserId }}
runAsUser: {{ printf "%.0f" (float64 $painter.runAsUser) }}
{{- end }}
readOnlyRootFilesystem: true
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
{{- end }}
{{- $pullSecrets := $painter.imagePullSecrets }}
{{- if $painterImage.pullSecret }}
{{- $pullSecrets = append $pullSecrets (dict "name" $painterImage.pullSecret) }}
{{- end }}
{{- if $pullSecrets }}
imagePullSecrets:
{{- end }}
{{- range $secret := $pullSecrets }}
- {{ toYaml $secret }}
{{- end }}
{{- end }} {{- /* define "painter.deploymentSpec" */ -}}

{{- /* Render painter deployment template with overrides from values */ -}}
{{ if $painter.enabled }}
{{- $painterDeploymentOverrides := dict }}
{{- if $painter.deploymentOverrides }}
{{- $painterDeploymentOverrides = $painter.deploymentOverrides }}
{{- end }}
---
{{- include "skv2.utils.merge" (list . $painterDeploymentOverrides "painter.deploymentSpec") -}}
{{- end }}
---
{{ if $painter.enabled }}
apiVersion: v1
kind: ServiceAccount
metadata:
labels:
app: painter
{{- if $painter.serviceAccount}}
{{- if $painter.serviceAccount.extraAnnotations }}
annotations:
{{- range $key, $value := $painter.serviceAccount.extraAnnotations }}
{{ $key }}: {{ $value }}
{{- end }}
{{- end }}
{{- end}}
name: painter
namespace: {{ default .Release.Namespace $.Values.painter.namespace }}
{{- end }}


{{- define "painter.serviceSpec"}}

{{- end }} {{/* define "painter.serviceSpec" */}}
{{ if $painter.enabled }}
{{/* Render painter service template with overrides from values*/}}
{{- $painterServiceOverrides := dict }}
{{- if $painter.serviceOverrides }}
{{- $painterServiceOverrides = $painter.serviceOverrides }}
{{- end }}

---

{{ include "skv2.utils.merge" (list . $painterServiceOverrides "painter.serviceSpec") }}
{{- end }}

2 changes: 2 additions & 0 deletions codegen/test/chart/image-pull-secrets/templates/rbac.yaml
Original file line number Diff line number Diff line change
@@ -0,0 +1,2 @@
# Code generated by skv2. DO NOT EDIT.

Loading

0 comments on commit 71072f5

Please sign in to comment.