From 87eddf8bbd23c48432e5393d0d7b1fdd40a60165 Mon Sep 17 00:00:00 2001 From: Ryan Richard Date: Wed, 12 Aug 2020 17:02:43 -0700 Subject: [PATCH] Add image pull secret as a data value for our ytt templates Signed-off-by: Aram Price --- deploy/deployment.yaml | 17 +++++++++++++++++ deploy/values.yaml | 4 +++- 2 files changed, 20 insertions(+), 1 deletion(-) diff --git a/deploy/deployment.yaml b/deploy/deployment.yaml index baec010f3..182c69e3d 100644 --- a/deploy/deployment.yaml +++ b/deploy/deployment.yaml @@ -30,6 +30,19 @@ data: url: (@= data.values.webhook_url @) caBundle: (@= data.values.webhook_ca_bundle @) --- +#@ if data.values.image_pull_dockerconfigjson and data.values.image_pull_dockerconfigjson != "": +apiVersion: v1 +kind: Secret +metadata: + name: image-pull-secret + namespace: #@ data.values.namespace + labels: + app: #@ data.values.app_name +data: + #! e.g. the output of: kubectl create secret docker-registry x --docker-server=https://example.io --docker-username="USERNAME" --docker-password="PASSWORD" --dry-run=client -o json | jq -r '.data[".dockerconfigjson"]' + .dockerconfigjson: #@ data.values.image_pull_dockerconfigjson +#@ end +--- #! TODO set up healthy, ready, etc. probes correctly? #! TODO set resource minimums (e.g. 512MB RAM) to make sure we get scheduled onto a reasonable node? apiVersion: apps/v1 @@ -51,6 +64,10 @@ spec: scheduler.alpha.kubernetes.io/critical-pod: "" spec: serviceAccountName: #@ data.values.app_name + "-service-account" + #@ if data.values.image_pull_dockerconfigjson and data.values.image_pull_dockerconfigjson != "": + imagePullSecrets: + - name: image-pull-secret + #@ end containers: - name: placeholder-name #@ if data.values.image_digest: diff --git a/deploy/values.yaml b/deploy/values.yaml index e63e611fd..cb747c6ae 100644 --- a/deploy/values.yaml +++ b/deploy/values.yaml @@ -6,7 +6,7 @@ app_name: placeholder-name namespace: #! e.g. placeholder-name #! Specify either an image_digest or an image_tag. If both are given, only image_digest will be used. -image_repo: #! e.g. gcr.io/your-project-name/repo-name +image_repo: #! e.g. registry.example.com/your-project-name/repo-name image_digest: #! e.g. sha256:f3c4fdfd3ef865d4b97a1fd295d94acc3f0c654c46b6f27ffad5cf80216903c8 image_tag: #! e.g. latest @@ -14,3 +14,5 @@ webhook_url: #! e.g., https://example.com webhook_ca_bundle: #! e.g., LS0tLS1CRUdJTiBDRVJUSUZJQ0F... discovery_url: #! e.g., https://example.com + +image_pull_dockerconfigjson: #! e.g. {"auths":{"https://registry.example.com":{"username":"USERNAME","password":"PASSWORD","auth":"BASE64_ENCODED_USERNAME_COLON_PASSWORD"}}}