fix: forward CLI overrides to in-cluster deploy for Git-based remote deploys

[Ankitsinghsisodya]

Fixes #3768

Note: Re-submission of #3777, accidentally closed when the head repository was deleted.

Problem

When func deploy uses a Git-based pipeline (f.Build.Git.URL is set), CLI flags like --image-pull-secret, --service-account, and --deployer are silently ignored. The on-cluster func-deploy task step reads func.yaml directly from the cloned Git repo, which never contains in-memory CLI overrides — unlike the PVC-upload path fixed by #3663.

Solution

Forward the three CLI overrides as discrete Tekton params on the pipeline run and apply them as environment variables on the func-deploy task step. The in-cluster deploy binary reads these env vars and applies them over the values loaded from func.yaml.

How it works

func deploy --image-pull-secret my-secret --deployer raw
  → templateData.ImagePullSecret / Deployer populated
  → PipelineRun param: imagePullSecret=my-secret, deployer=raw
  → Pipeline threads params to Task: IMAGE_PULL_SECRET, DEPLOYER
  → func-deploy step env: FUNC_IMAGE_PULL_SECRET, FUNC_DEPLOYER
  → deploy binary: os.Getenv overrides f loaded from committed func.yaml

The env vars are only applied when non-empty, so existing behaviour is unchanged when no overrides are passed.

Changes

• cmd/func-util/main.go — read FUNC_IMAGE_PULL_SECRET, FUNC_SERVICE_ACCOUNT, FUNC_DEPLOYER env vars after loading func.yaml and apply them over the struct before deploying
• task-buildpack.yaml.tmpl / task-s2i.yaml.tmpl — add IMAGE_PULL_SECRET, SERVICE_ACCOUNT, DEPLOYER params; set corresponding FUNC_* env vars on the func-deploy step
• templates_pack.go / templates_s2i.go — add the three params to the Pipeline spec and thread them to the task; add them to the PipelineRun params
• templates.go — add ImagePullSecret, ServiceAccountName, Deployer to templateData; populate from f.Deploy.* in createAndApplyPipelineRunTemplate

Notes

• The DeployerImage is scratch-based with no shell, so env vars are used instead of a bash script with conditional flag appending.
• This is the Git-path equivalent of fix: write func.yaml before remote deploy upload #3663, which fixed the same bug for the PVC-upload path.

[knative-prow]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: Ankitsinghsisodya
Once this PR has been reviewed and has the lgtm label, please assign lkingland for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[knative-prow]

Hi @Ankitsinghsisodya. Thanks for your PR.

I'm waiting for a knative member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Tip

We noticed you've done this a few times! Consider joining the org to skip this step and gain /lgtm and other bot rights. We recommend asking approvers on your previous PRs to sponsor you.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[Copilot]

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

This PR threads CLI deploy overrides through Tekton pipeline params into the in-cluster func-deploy step, so Git-based remote deploys can apply user-supplied deploy settings even when func.yaml is sourced from the repo.

Changes:

• Add new Pipeline/PipelineRun params for imagePullSecret, serviceAccount, and deployer in both S2I and buildpacks pipelines.
• Forward these params into Tekton Task params and then into the deploy step via FUNC_* environment variables.
• Teach cmd/func-util to read FUNC_* env vars and apply them onto f.Deploy before deploying.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
pkg/pipelines/tekton/templates_s2i.go	Adds new pipeline + pipelinerun params and forwards them into the S2I build task.
pkg/pipelines/tekton/templates_pack.go	Adds new pipeline + pipelinerun params and forwards them into the buildpacks build task.
pkg/pipelines/tekton/templates.go	Extends template data and populates it from f.Deploy.* fields.
pkg/pipelines/tekton/task-s2i.yaml.tmpl	Adds task params and maps them to FUNC_* env vars for the deploy step.
pkg/pipelines/tekton/task-buildpack.yaml.tmpl	Adds task params and maps them to FUNC_* env vars for the deploy step.
cmd/func-util/main.go	Applies env var overrides to f.Deploy for in-cluster/Git-based deploys.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.