Skip to content

Commit 4920347

Browse files
attilaedelenyiattilaedelenyi
committed
Working imagePullSecrets
1 parent d7857c4 commit 4920347

7 files changed

Lines changed: 126 additions & 13 deletions

File tree

‎.gitignore‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,3 +4,4 @@
44
charts/*/charts/
55
charts/*/*.tgz
66
charts/*/Chart.lock
7+
test.yaml

‎charts/ontoserver-indexer/README.md‎

Lines changed: 33 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -13,10 +13,33 @@ This chart wraps the Ontoserver `indexCodeSystemDebug` CLI tool. It retrieves on
1313

1414
The Job terminates after a single run. Helm's `ttlSecondsAfterFinished` removes it automatically. Re-indexing requires a fresh `helm install` (or `helm upgrade --install` with a unique release name).
1515

16+
## Registry Credentials
17+
18+
The default image (`quay.io/aehrc/ontoserver`) requires authentication. Pull credentials must be supplied via one of two methods:
19+
20+
**Inline credentials** — provide `image.credentials.username` and `image.credentials.password`; the chart creates a `kubernetes.io/dockerconfigjson` Secret automatically:
21+
```yaml
22+
image:
23+
credentials:
24+
registry: quay.io # default
25+
username: my-quay-user
26+
password: my-quay-password # use --set or External Secrets
27+
```
28+
29+
**Pre-existing Secret** — if you have already created an `imagePullSecret`, reference it instead:
30+
```yaml
31+
image:
32+
imagePullSecrets:
33+
- name: my-pull-secret
34+
```
35+
36+
Both can be combined — the chart-created secret is appended to the list.
37+
1638
## Prerequisites
1739

1840
- Kubernetes 1.21+
1941
- Helm 3.2+
42+
- quay.io credentials (or an existing imagePullSecret) — required to pull `quay.io/aehrc/ontoserver`
2043
- Either a syndication server with a configured feed, or a PersistentVolumeClaim for local output (or both)
2144
- Network access from the cluster to any HTTPS source file URLs and to the syndication server (if used)
2245

@@ -26,6 +49,8 @@ The Job terminates after a single run. Helm's `ttlSecondsAfterFinished` removes
2649
helm install snomed-au-index ./charts/ontoserver-indexer \
2750
-f charts/ontoserver-indexer/examples/snomed-au.yaml \
2851
--set auth.oauth2.secretRef=your-secret \
52+
--set image.credentials.username=your-quay-username \
53+
--set image.credentials.password=your-quay-password \
2954
--namespace indexing --create-namespace
3055
```
3156

@@ -176,11 +201,14 @@ kubectl get job <release-name> -n <namespace>
176201

177202
### Image parameters
178203

179-
| Name | Description | Value |
180-
| ------------------ | ------------------------------------------------------------------- | -------------------------- |
181-
| `image.repository` | Container image repository for the Ontoserver indexer | `quay.io/aehrc/ontoserver` |
182-
| `image.tag` | Container image tag | `ctsa-6` |
183-
| `image.pullSecret` | Name of an existing imagePullSecret for pulling the container image | `""` |
204+
| Name | Description | Value |
205+
| ---------------------------- | ------------------------------------------------------------------------------------------------------------------ | -------------------------- |
206+
| `image.repository` | Container image repository for the Ontoserver indexer | `quay.io/aehrc/ontoserver` |
207+
| `image.tag` | Container image tag | `ctsa-6` |
208+
| `image.imagePullSecrets` | List of pre-existing imagePullSecret names to attach to the pod | `[]` |
209+
| `image.credentials.registry` | Registry hostname for the chart-managed pull secret | `quay.io` |
210+
| `image.credentials.username` | Registry username; required to pull from quay.io/aehrc/ontoserver — chart creates an imagePullSecret automatically | `""` |
211+
| `image.credentials.password` | Registry password; set via --set or populate via External Secrets | `""` |
184212

185213
### Job parameters
186214

‎charts/ontoserver-indexer/templates/imagepullsecret.yaml‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
{{- if and .Values.image.credentials.username .Values.image.credentials.password }}
2+
apiVersion: v1
3+
kind: Secret
4+
metadata:
5+
name: {{ .Release.Name }}-indexer-pull-secret
6+
type: kubernetes.io/dockerconfigjson
7+
data:
8+
.dockerconfigjson: {{ printf "{\"auths\":{\"%s\":{\"username\":\"%s\",\"password\":\"%s\",\"auth\":\"%s\"}}}" .Values.image.credentials.registry .Values.image.credentials.username .Values.image.credentials.password (printf "%s:%s" .Values.image.credentials.username .Values.image.credentials.password | b64enc) | b64enc }}
9+
{{- end }}

‎charts/ontoserver-indexer/templates/job.yaml‎

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -17,9 +17,12 @@ spec:
1717
{{- if .Values.tolerations }}
1818
tolerations: {{ toJson .Values.tolerations }}
1919
{{- end }}
20-
{{- if .Values.image.pullSecret }}
21-
imagePullSecrets:
22-
- name: {{ .Values.image.pullSecret }}
20+
{{- $pullSecrets := .Values.image.imagePullSecrets | default list }}
21+
{{- if and .Values.image.credentials.username .Values.image.credentials.password }}
22+
{{- $pullSecrets = append $pullSecrets (dict "name" (printf "%s-indexer-pull-secret" .Release.Name)) }}
23+
{{- end }}
24+
{{- if $pullSecrets }}
25+
imagePullSecrets: {{ toJson $pullSecrets }}
2326
{{- end }}
2427
{{- if or .Values.output.pvcName .Values.input.pvcName }}
2528
volumes:

‎charts/ontoserver-indexer/tests/imagepullsecret_test.yaml‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
suite: imagepullsecret template tests
2+
templates:
3+
- templates/imagepullsecret.yaml
4+
5+
tests:
6+
- it: renders no secret when credentials not set
7+
asserts:
8+
- hasDocuments:
9+
count: 0
10+
11+
- it: renders no secret when only username set
12+
set:
13+
image.credentials.username: myuser
14+
asserts:
15+
- hasDocuments:
16+
count: 0
17+
18+
- it: renders no secret when only password set
19+
set:
20+
image.credentials.password: mypass
21+
asserts:
22+
- hasDocuments:
23+
count: 0
24+
25+
- it: renders pull secret when both username and password set
26+
set:
27+
image.credentials.username: myuser
28+
image.credentials.password: mypass
29+
asserts:
30+
- hasDocuments:
31+
count: 1
32+
- isKind:
33+
of: Secret
34+
- equal:
35+
path: metadata.name
36+
value: RELEASE-NAME-indexer-pull-secret
37+
- equal:
38+
path: type
39+
value: kubernetes.io/dockerconfigjson
40+
- isNotEmpty:
41+
path: data[".dockerconfigjson"]

‎charts/ontoserver-indexer/tests/job_test.yaml‎

Lines changed: 27 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -94,15 +94,39 @@ tests:
9494
path: spec.template.spec.containers[0].resources.limits.memory
9595
value: 24G
9696

97-
- it: sets imagePullSecrets when pullSecret provided
97+
- it: sets imagePullSecrets from image.imagePullSecrets list
9898
set:
9999
<<: *snomed
100-
image.pullSecret: my-pull-secret
100+
image.imagePullSecrets[0].name: my-pull-secret
101101
asserts:
102102
- equal:
103103
path: spec.template.spec.imagePullSecrets[0].name
104104
value: my-pull-secret
105105

106+
- it: appends chart-created pull secret when credentials provided
107+
set:
108+
<<: *snomed
109+
image.credentials.username: myuser
110+
image.credentials.password: mypass
111+
asserts:
112+
- equal:
113+
path: spec.template.spec.imagePullSecrets[0].name
114+
value: RELEASE-NAME-indexer-pull-secret
115+
116+
- it: merges list and chart-created pull secret when both provided
117+
set:
118+
<<: *snomed
119+
image.imagePullSecrets[0].name: existing-secret
120+
image.credentials.username: myuser
121+
image.credentials.password: mypass
122+
asserts:
123+
- equal:
124+
path: spec.template.spec.imagePullSecrets[0].name
125+
value: existing-secret
126+
- equal:
127+
path: spec.template.spec.imagePullSecrets[1].name
128+
value: RELEASE-NAME-indexer-pull-secret
129+
106130
- it: sets tolerations when provided
107131
set:
108132
<<: *snomed
@@ -123,7 +147,7 @@ tests:
123147
- isNull:
124148
path: spec.template.spec.tolerations
125149

126-
- it: omits imagePullSecrets when pullSecret empty
150+
- it: omits imagePullSecrets when none configured
127151
set:
128152
<<: *snomed
129153
asserts:

‎charts/ontoserver-indexer/values.yaml‎

Lines changed: 9 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6,8 +6,15 @@ image:
66
repository: quay.io/aehrc/ontoserver
77
## @param image.tag Container image tag
88
tag: ctsa-6
9-
## @param image.pullSecret Name of an existing imagePullSecret for pulling the container image
10-
pullSecret: "" # name of an existing imagePullSecret
9+
## @param image.imagePullSecrets [array] List of pre-existing imagePullSecret names to attach to the pod
10+
imagePullSecrets: [] # list of {name: ...} objects; merged with the chart-managed secret when credentials are set
11+
credentials:
12+
## @param image.credentials.registry Registry hostname for the chart-managed pull secret
13+
registry: quay.io
14+
## @param image.credentials.username Registry username; required to pull from quay.io/aehrc/ontoserver — chart creates an imagePullSecret automatically
15+
username: ""
16+
## @param image.credentials.password Registry password; set via --set or populate via External Secrets
17+
password: ""
1118

1219

1320
## @section Job parameters

0 commit comments

Comments
 (0)