Skip to content

Commit df3d6d9

Browse files
toddbaerttoddbaert
authored
fix: handle multiple imagePullSecrets (#666)
Signed-off-by: Todd Baert <todd.baert@dynatrace.com>
1 parent 2d7b30c commit df3d6d9

File tree

12 files changed

+66
-47
lines changed

12 files changed

+66
-47
lines changed

‎.github/scripts/strip-kustomize-helm.sh

+18
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
#!/bin/bash
2+
3+
# This script is a hack to support helm flow control in kustomize overlays, which would otherwise break them.
4+
# It allows us to render helm template bindings and add newlines.
5+
# For instance, it transforms "___{{ .Value.myValue }}___" to {{ .Value.myValue }}.
6+
# It also adds newlines wherever ___newline___ is found.
7+
8+
CHARTS_DIR='./chart/open-feature-operator/templates';
9+
10+
echo 'Running strip-kustomize-helm.sh script'
11+
filenames=`find $CHARTS_DIR -name "*.yaml"`
12+
for file in $filenames; do
13+
sed -i "s/___newline___/\\n/g" $file
14+
sed -i "s/\"___//g" $file
15+
sed -i "s/___\"//g" $file
16+
sed -i "s/___//g" $file
17+
done
18+
echo 'Done running strip-kustomize-helm.sh script'

‎Makefile

+1
Original file line numberDiff line numberDiff line change
@@ -252,6 +252,7 @@ set-helm-overlay:
252252
helm-package: set-helm-overlay generate release-manifests helm
253253
mkdir -p chart/open-feature-operator/templates/crds
254254
mv chart/open-feature-operator/templates/*customresourcedefinition* chart/open-feature-operator/templates/crds
255+
sh .github/scripts/strip-kustomize-helm.sh
255256
$(HELM) package --version $(CHART_VERSION) chart/open-feature-operator
256257
mkdir -p charts && mv open-feature-operator-*.tgz charts
257258
$(HELM) repo index --url https://open-feature.github.io/open-feature-operator/charts charts

‎chart/open-feature-operator/README.md

+4-4
Original file line numberDiff line numberDiff line change
@@ -93,10 +93,10 @@ The command removes all the Kubernetes components associated with the chart and
9393

9494
### Global
9595

96-
| Name | Description | Value |
97-
| ------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------ |
98-
| `defaultNamespace` | To override the namespace use the `--namespace` flag. This default is provided to ensure that the kustomize build charts in `/templates` deploy correctly when no `namespace` is provided via the `-n` flag. | `open-feature-operator-system` |
99-
| `imagePullSecret` | Secret containing credentials for images pulled by the operator (flagdProxyConfiguration.image, flagdConfiguration.image, controllerManager.manager.image, controllerManager.kubeRbacProxy.image). | `""` |
96+
| Name | Description | Value |
97+
| ------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------ |
98+
| `defaultNamespace` | To override the namespace use the `--namespace` flag. This default is provided to ensure that the kustomize build charts in `/templates` deploy correctly when no `namespace` is provided via the `-n` flag. | `open-feature-operator-system` |
99+
| `imagePullSecrets` | Array of ImagePullSecret objects containing credentials for images pulled by the operator (flagdProxyConfiguration.image, flagdConfiguration.image, controllerManager.manager.image, controllerManager.kubeRbacProxy.image). Example: imagePullSecrets: [{"name": "my-secret"}] | `[]` |
100100

101101
### Sidecar configuration
102102

‎chart/open-feature-operator/values.yaml

+2-2
Original file line numberDiff line numberDiff line change
@@ -2,8 +2,8 @@
22
## @section Global
33
## @param defaultNamespace To override the namespace use the `--namespace` flag. This default is provided to ensure that the kustomize build charts in `/templates` deploy correctly when no `namespace` is provided via the `-n` flag.
44
defaultNamespace: open-feature-operator-system
5-
## @param imagePullSecret Secret containing credentials for images pulled by the operator (flagdProxyConfiguration.image, flagdConfiguration.image, controllerManager.manager.image, controllerManager.kubeRbacProxy.image).
6-
imagePullSecret: ""
5+
## @param imagePullSecrets Array of ImagePullSecret objects containing credentials for images pulled by the operator (flagdProxyConfiguration.image, flagdConfiguration.image, controllerManager.manager.image, controllerManager.kubeRbacProxy.image). Example: imagePullSecrets: [{"name": "my-secret"}]
6+
imagePullSecrets: []
77

88
## @section Sidecar configuration
99
sidecarConfiguration:

‎common/flagdproxy/flagdproxy.go

+5-5
Original file line numberDiff line numberDiff line change
@@ -38,10 +38,10 @@ type FlagdProxyConfiguration struct {
3838
Tag string
3939
Namespace string
4040
OperatorDeploymentName string
41-
ImagePullSecret string
41+
ImagePullSecrets []string
4242
}
4343

44-
func NewFlagdProxyConfiguration(env types.EnvConfig, imagePullSecret string) *FlagdProxyConfiguration {
44+
func NewFlagdProxyConfiguration(env types.EnvConfig, imagePullSecrets []string) *FlagdProxyConfiguration {
4545
return &FlagdProxyConfiguration{
4646
Image: env.FlagdProxyImage,
4747
Tag: env.FlagdProxyTag,
@@ -50,7 +50,7 @@ func NewFlagdProxyConfiguration(env types.EnvConfig, imagePullSecret string) *Fl
5050
Port: env.FlagdProxyPort,
5151
ManagementPort: env.FlagdProxyManagementPort,
5252
DebugLogging: env.FlagdProxyDebugLogging,
53-
ImagePullSecret: imagePullSecret,
53+
ImagePullSecrets: imagePullSecrets,
5454
}
5555
}
5656

@@ -146,9 +146,9 @@ func (f *FlagdProxyHandler) newFlagdProxyManifest(ownerReference *metav1.OwnerRe
146146
args = append(args, "--debug")
147147
}
148148
imagePullSecrets := []corev1.LocalObjectReference{}
149-
if f.config.ImagePullSecret != "" {
149+
for _, secret := range f.config.ImagePullSecrets {
150150
imagePullSecrets = append(imagePullSecrets, corev1.LocalObjectReference{
151-
Name: f.config.ImagePullSecret,
151+
Name: secret,
152152
})
153153
}
154154

‎common/flagdproxy/flagdproxy_test.go

+12-12
Original file line numberDiff line numberDiff line change
@@ -19,22 +19,22 @@ import (
1919
"sigs.k8s.io/controller-runtime/pkg/client/fake"
2020
)
2121

22-
const pullSecret = "test-pullSecret"
22+
var pullSecrets = []string{"test-pullSecret"}
2323

2424
func TestNewFlagdProxyConfiguration(t *testing.T) {
2525

2626
kpConfig := NewFlagdProxyConfiguration(types.EnvConfig{
2727
FlagdProxyPort: 8015,
2828
FlagdProxyManagementPort: 8016,
29-
}, pullSecret)
29+
}, pullSecrets)
3030

3131
require.NotNil(t, kpConfig)
3232
require.Equal(t, &FlagdProxyConfiguration{
3333
Port: 8015,
3434
ManagementPort: 8016,
3535
DebugLogging: false,
3636
OperatorDeploymentName: common.OperatorDeploymentName,
37-
ImagePullSecret: pullSecret,
37+
ImagePullSecrets: pullSecrets,
3838
}, kpConfig)
3939
}
4040

@@ -48,7 +48,7 @@ func TestNewFlagdProxyConfiguration_OverrideEnvVars(t *testing.T) {
4848
FlagdProxyDebugLogging: true,
4949
}
5050

51-
kpConfig := NewFlagdProxyConfiguration(env, pullSecret)
51+
kpConfig := NewFlagdProxyConfiguration(env, pullSecrets)
5252

5353
require.NotNil(t, kpConfig)
5454
require.Equal(t, &FlagdProxyConfiguration{
@@ -59,12 +59,12 @@ func TestNewFlagdProxyConfiguration_OverrideEnvVars(t *testing.T) {
5959
Tag: "my-tag",
6060
Namespace: "my-namespace",
6161
OperatorDeploymentName: common.OperatorDeploymentName,
62-
ImagePullSecret: pullSecret,
62+
ImagePullSecrets: pullSecrets,
6363
}, kpConfig)
6464
}
6565

6666
func TestNewFlagdProxyHandler(t *testing.T) {
67-
kpConfig := NewFlagdProxyConfiguration(types.EnvConfig{}, pullSecret)
67+
kpConfig := NewFlagdProxyConfiguration(types.EnvConfig{}, pullSecrets)
6868

6969
require.NotNil(t, kpConfig)
7070

@@ -100,7 +100,7 @@ func TestDoesFlagdProxyExist(t *testing.T) {
100100
},
101101
}
102102

103-
kpConfig := NewFlagdProxyConfiguration(env, pullSecret)
103+
kpConfig := NewFlagdProxyConfiguration(env, pullSecrets)
104104

105105
require.NotNil(t, kpConfig)
106106

@@ -128,7 +128,7 @@ func TestFlagdProxyHandler_HandleFlagdProxy_ProxyExistsWithBadVersion(t *testing
128128
env := types.EnvConfig{
129129
PodNamespace: "ns",
130130
}
131-
kpConfig := NewFlagdProxyConfiguration(env, pullSecret)
131+
kpConfig := NewFlagdProxyConfiguration(env, pullSecrets)
132132

133133
require.NotNil(t, kpConfig)
134134

@@ -187,7 +187,7 @@ func TestFlagdProxyHandler_HandleFlagdProxy_ProxyExistsWithoutLabel(t *testing.T
187187
env := types.EnvConfig{
188188
PodNamespace: "ns",
189189
}
190-
kpConfig := NewFlagdProxyConfiguration(env, pullSecret)
190+
kpConfig := NewFlagdProxyConfiguration(env, pullSecrets)
191191

192192
require.NotNil(t, kpConfig)
193193

@@ -236,7 +236,7 @@ func TestFlagdProxyHandler_HandleFlagdProxy_ProxyExistsWithNewestVersion(t *test
236236
env := types.EnvConfig{
237237
PodNamespace: "ns",
238238
}
239-
kpConfig := NewFlagdProxyConfiguration(env, pullSecret)
239+
kpConfig := NewFlagdProxyConfiguration(env, pullSecrets)
240240

241241
require.NotNil(t, kpConfig)
242242

@@ -280,7 +280,7 @@ func TestFlagdProxyHandler_HandleFlagdProxy_CreateProxy(t *testing.T) {
280280
FlagdProxyManagementPort: 90,
281281
FlagdProxyDebugLogging: true,
282282
}
283-
kpConfig := NewFlagdProxyConfiguration(env, pullSecret)
283+
kpConfig := NewFlagdProxyConfiguration(env, pullSecrets)
284284

285285
require.NotNil(t, kpConfig)
286286

@@ -362,7 +362,7 @@ func TestFlagdProxyHandler_HandleFlagdProxy_CreateProxy(t *testing.T) {
362362
Spec: corev1.PodSpec{
363363
ServiceAccountName: FlagdProxyServiceAccountName,
364364
ImagePullSecrets: []corev1.LocalObjectReference{
365-
{Name: pullSecret},
365+
{Name: pullSecrets[0]},
366366
},
367367
Containers: []corev1.Container{
368368
{

‎config/overlays/helm/manager.yaml

+3-3
Original file line numberDiff line numberDiff line change
@@ -7,8 +7,8 @@ spec:
77
replicas: 0{{ .Values.controllerManager.replicas }}
88
template:
99
spec:
10-
imagePullSecrets:
11-
- name: "{{ .Values.imagePullSecret }}"
10+
# this is transformed by .github/scripts/strip-kustomize-helm.sh
11+
___imagePullSecrets___: "___ ___newline___{{ toYaml .Values.imagePullSecrets | indent 8 }}___"
1212
containers:
1313
- name: manager
1414
image: "{{ .Values.controllerManager.manager.image.repository }}:{{ .Values.controllerManager.manager.image.tag }}"
@@ -92,7 +92,7 @@ spec:
9292
- --sidecar-ram-limit={{ .Values.sidecarConfiguration.resources.limits.memory }}
9393
- --sidecar-cpu-request={{ .Values.sidecarConfiguration.resources.requests.cpu }}
9494
- --sidecar-ram-request={{ .Values.sidecarConfiguration.resources.requests.memory }}
95-
- --image-pull-secret={{ .Values.imagePullSecret }}
95+
- --image-pull-secrets={{ range .Values.imagePullSecrets }}{{ .name }},{{- end }}
9696
- name: kube-rbac-proxy
9797
image: "{{ .Values.controllerManager.kubeRbacProxy.image.repository }}:{{ .Values.controllerManager.kubeRbacProxy.image.tag }}"
9898
resources:

‎controllers/core/featureflagsource/controller_test.go

+2-2
Original file line numberDiff line numberDiff line change
@@ -27,8 +27,8 @@ func TestFeatureFlagSourceReconciler_Reconcile(t *testing.T) {
2727
testNamespace = "test-namespace"
2828
fsConfigName = "test-config"
2929
deploymentName = "test-deploy"
30-
pullSecret = "test-pullsecret"
3130
)
31+
var pullSecrets = []string{"test-pullsecret"}
3232

3333
tests := []struct {
3434
name string
@@ -93,7 +93,7 @@ func TestFeatureFlagSourceReconciler_Reconcile(t *testing.T) {
9393
kpConfig := flagdproxy.NewFlagdProxyConfiguration(commontypes.EnvConfig{
9494
FlagdProxyImage: "ghcr.io/open-feature/flagd-proxy",
9595
FlagdProxyTag: flagdProxyTag,
96-
}, pullSecret)
96+
}, pullSecrets)
9797

9898
kpConfig.Namespace = testNamespace
9999
kph := flagdproxy.NewFlagdProxyHandler(

‎controllers/core/flagd/common/common.go

+8-8
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,14 @@
11
package resources
22

33
type FlagdConfiguration struct {
4-
FlagdPort int
5-
OFREPPort int
6-
SyncPort int
7-
ManagementPort int
8-
DebugLogging bool
9-
Image string
10-
Tag string
11-
ImagePullSecret string
4+
FlagdPort int
5+
OFREPPort int
6+
SyncPort int
7+
ManagementPort int
8+
DebugLogging bool
9+
Image string
10+
Tag string
11+
ImagePullSecrets []string
1212

1313
OperatorNamespace string
1414
OperatorDeploymentName string

‎controllers/core/flagd/config.go

+2-2
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ import (
66
resources "github.com/open-feature/open-feature-operator/controllers/core/flagd/common"
77
)
88

9-
func NewFlagdConfiguration(env types.EnvConfig, imagePullSecret string) resources.FlagdConfiguration {
9+
func NewFlagdConfiguration(env types.EnvConfig, imagePullSecrets []string) resources.FlagdConfiguration {
1010
return resources.FlagdConfiguration{
1111
Image: env.FlagdImage,
1212
Tag: env.FlagdTag,
@@ -16,6 +16,6 @@ func NewFlagdConfiguration(env types.EnvConfig, imagePullSecret string) resource
1616
SyncPort: env.FlagdSyncPort,
1717
ManagementPort: env.FlagdManagementPort,
1818
DebugLogging: env.FlagdDebugLogging,
19-
ImagePullSecret: imagePullSecret,
19+
ImagePullSecrets: imagePullSecrets,
2020
}
2121
}

‎controllers/core/flagd/resources/deployment.go

+2-2
Original file line numberDiff line numberDiff line change
@@ -78,9 +78,9 @@ func (r *FlagdDeployment) GetResource(ctx context.Context, flagd *api.Flagd) (cl
7878

7979
featureFlagSource := &api.FeatureFlagSource{}
8080
imagePullSecrets := []corev1.LocalObjectReference{}
81-
if r.FlagdConfig.ImagePullSecret != "" {
81+
for _, secret := range r.FlagdConfig.ImagePullSecrets {
8282
imagePullSecrets = append(imagePullSecrets, corev1.LocalObjectReference{
83-
Name: r.FlagdConfig.ImagePullSecret,
83+
Name: secret,
8484
})
8585
}
8686

‎main.go

+7-7
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,7 @@ import (
2222
"fmt"
2323
"log"
2424
"os"
25+
"strings"
2526

2627
"github.com/kelseyhightower/envconfig"
2728
corev1beta1 "github.com/open-feature/open-feature-operator/apis/core/v1beta1"
@@ -65,8 +66,8 @@ const (
6566
sidecarRamLimitDefault = "64M"
6667
sidecarCpuRequestDefault = "0.2"
6768
sidecarRamRequestDefault = "32M"
68-
imagePullSecretFlagName = "image-pull-secret"
69-
imagePullSecretDefault = ""
69+
imagePullSecretFlagName = "image-pull-secrets"
70+
imagePullSecretFlagDefault = ""
7071
)
7172

7273
var (
@@ -77,7 +78,7 @@ var (
7778
probeAddr string
7879
verbose bool
7980
sidecarCpuLimit, sidecarRamLimit, sidecarCpuRequest, sidecarRamRequest string
80-
imagePullSecret string
81+
imagePullSecrets string
8182
)
8283

8384
func init() {
@@ -105,8 +106,7 @@ func main() {
105106
flag.StringVar(&sidecarRamLimit, sidecarRamLimitFlagName, sidecarRamLimitDefault, "sidecar memory limit, in bytes. (500Gi = 500GiB = 500 * 1024 * 1024 * 1024)")
106107
flag.StringVar(&sidecarCpuRequest, sidecarCpuRequestFlagName, sidecarCpuRequestDefault, "sidecar CPU minimum, in cores. (500m = .5 cores)")
107108
flag.StringVar(&sidecarRamRequest, sidecarRamRequestFlagName, sidecarRamRequestDefault, "sidecar memory minimum, in bytes. (500Gi = 500GiB = 500 * 1024 * 1024 * 1024)")
108-
109-
flag.StringVar(&imagePullSecret, imagePullSecretFlagName, imagePullSecretDefault, "secret containing credentials to pull images.")
109+
flag.StringVar(&imagePullSecrets, imagePullSecretFlagName, imagePullSecretFlagDefault, "Comma-delimited list of secrets containing credentials to pull images.")
110110

111111
flag.Parse()
112112

@@ -183,7 +183,7 @@ func main() {
183183
}
184184

185185
kph := flagdproxy.NewFlagdProxyHandler(
186-
flagdproxy.NewFlagdProxyConfiguration(env, imagePullSecret),
186+
flagdproxy.NewFlagdProxyConfiguration(env, strings.Split(imagePullSecrets, ",")),
187187
mgr.GetClient(),
188188
ctrl.Log.WithName("FeatureFlagSource FlagdProxyHandler"),
189189
)
@@ -215,7 +215,7 @@ func main() {
215215
Scheme: mgr.GetScheme(),
216216
Log: flagdControllerLogger,
217217
}
218-
flagdConfig := flagd.NewFlagdConfiguration(env, imagePullSecret)
218+
flagdConfig := flagd.NewFlagdConfiguration(env, strings.Split(imagePullSecrets, ","))
219219

220220
if err = (&flagd.FlagdReconciler{
221221
Client: mgr.GetClient(),

0 commit comments

Comments
 (0)