Skip to content

Commit eb2afa6

Browse files
ankitathomasankitathomas
committed
use global pullsecret for image pulls
Signed-off-by: Ankita Thomas <ankithom@redhat.com>
1 parent 9474d34 commit eb2afa6

File tree

5 files changed

+74
-19
lines changed

5 files changed

+74
-19
lines changed

‎cmd/manager/main.go‎

Lines changed: 47 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -23,13 +23,17 @@ import (
2323
"net/http"
2424
"os"
2525
"path/filepath"
26+
"strings"
2627
"time"
2728

2829
"github.com/spf13/pflag"
2930
"go.uber.org/zap/zapcore"
31+
corev1 "k8s.io/api/core/v1"
3032
apiextensionsv1client "k8s.io/apiextensions-apiserver/pkg/client/clientset/clientset/typed/apiextensions/v1"
33+
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
34+
"k8s.io/apimachinery/pkg/fields"
3135
k8slabels "k8s.io/apimachinery/pkg/labels"
32-
"k8s.io/apimachinery/pkg/selection"
36+
k8stypes "k8s.io/apimachinery/pkg/types"
3337
corev1client "k8s.io/client-go/kubernetes/typed/core/v1"
3438
_ "k8s.io/client-go/plugin/pkg/client/auth"
3539
ctrl "sigs.k8s.io/controller-runtime"
@@ -52,7 +56,6 @@ import (
5256
"github.com/operator-framework/operator-controller/internal/contentmanager"
5357
"github.com/operator-framework/operator-controller/internal/controllers"
5458
"github.com/operator-framework/operator-controller/internal/httputil"
55-
"github.com/operator-framework/operator-controller/internal/labels"
5659
"github.com/operator-framework/operator-controller/internal/resolve"
5760
"github.com/operator-framework/operator-controller/internal/rukpak/preflights/crdupgradesafety"
5861
"github.com/operator-framework/operator-controller/internal/rukpak/source"
@@ -87,6 +90,7 @@ func main() {
8790
operatorControllerVersion bool
8891
systemNamespace string
8992
caCertDir string
93+
globalPullSecret string
9094
)
9195
flag.StringVar(&metricsAddr, "metrics-bind-address", ":8080", "The address the metric endpoint binds to.")
9296
flag.StringVar(&probeAddr, "health-probe-bind-address", ":8081", "The address the probe endpoint binds to.")
@@ -97,6 +101,7 @@ func main() {
97101
flag.StringVar(&cachePath, "cache-path", "/var/cache", "The local directory path used for filesystem based caching")
98102
flag.BoolVar(&operatorControllerVersion, "version", false, "Prints operator-controller version information")
99103
flag.StringVar(&systemNamespace, "system-namespace", "", "Configures the namespace that gets used to deploy system resources.")
104+
flag.StringVar(&globalPullSecret, "global-pull-secret", "", "The <namespace>/<name> of the global pull secret that is going to be used to pull bundle images.")
100105
opts := zap.Options{
101106
Development: true,
102107
TimeEncoder: zapcore.RFC3339NanoTimeEncoder,
@@ -115,16 +120,41 @@ func main() {
115120
ctrl.SetLogger(zap.New(zap.UseFlagOptions(&opts), zap.StacktraceLevel(zapcore.DPanicLevel)))
116121
setupLog.Info("starting up the controller", "version info", version.String())
117122

123+
var globalPullSecretKey *k8stypes.NamespacedName
124+
if globalPullSecret != "" {
125+
secretParts := strings.Split(globalPullSecret, "/")
126+
if len(secretParts) != 2 {
127+
setupLog.Error(fmt.Errorf("incorrect number of components"), "value of global-pull-secret should be of the format <namespace>/<name>")
128+
os.Exit(1)
129+
}
130+
globalPullSecretKey = &k8stypes.NamespacedName{Name: secretParts[1], Namespace: secretParts[0]}
131+
}
132+
118133
if systemNamespace == "" {
119134
systemNamespace = podNamespace()
120135
}
121136

122-
dependentRequirement, err := k8slabels.NewRequirement(labels.OwnerKindKey, selection.In, []string{ocv1alpha1.ClusterExtensionKind})
123-
if err != nil {
124-
setupLog.Error(err, "unable to create dependent label selector for cache")
125-
os.Exit(1)
137+
cacheOptions := crcache.Options{
138+
ByObject: map[client.Object]crcache.ByObject{
139+
&ocv1alpha1.ClusterExtension{}: {Label: k8slabels.Everything()},
140+
&catalogd.ClusterCatalog{}: {Label: k8slabels.Everything()},
141+
},
142+
DefaultNamespaces: map[string]crcache.Config{
143+
systemNamespace: {LabelSelector: k8slabels.Everything()},
144+
},
145+
}
146+
if globalPullSecretKey != nil {
147+
cacheOptions.ByObject[&corev1.Secret{}] = crcache.ByObject{
148+
Namespaces: map[string]crcache.Config{
149+
globalPullSecretKey.Namespace: {
150+
LabelSelector: k8slabels.Everything(),
151+
FieldSelector: fields.SelectorFromSet(map[string]string{
152+
"metadata.name": globalPullSecretKey.Name,
153+
}),
154+
},
155+
},
156+
}
126157
}
127-
dependentSelector := k8slabels.NewSelector().Add(*dependentRequirement)
128158

129159
setupLog.Info("set up manager")
130160
mgr, err := ctrl.NewManager(ctrl.GetConfigOrDie(), ctrl.Options{
@@ -133,16 +163,7 @@ func main() {
133163
HealthProbeBindAddress: probeAddr,
134164
LeaderElection: enableLeaderElection,
135165
LeaderElectionID: "9c4404e7.operatorframework.io",
136-
Cache: crcache.Options{
137-
ByObject: map[client.Object]crcache.ByObject{
138-
&ocv1alpha1.ClusterExtension{}: {Label: k8slabels.Everything()},
139-
&catalogd.ClusterCatalog{}: {Label: k8slabels.Everything()},
140-
},
141-
DefaultNamespaces: map[string]crcache.Config{
142-
systemNamespace: {LabelSelector: k8slabels.Everything()},
143-
},
144-
DefaultLabelSelector: dependentSelector,
145-
},
166+
Cache: cacheOptions,
146167
// LeaderElectionReleaseOnCancel defines if the leader should step down voluntarily
147168
// when the Manager ends. This requires the binary to immediately end when the
148169
// Manager is stopped, otherwise, this setting is unsafe. Setting this significantly
@@ -198,6 +219,15 @@ func main() {
198219
BaseCachePath: filepath.Join(cachePath, "unpack"),
199220
CertPoolWatcher: certPoolWatcher,
200221
}
222+
if globalPullSecretKey != nil {
223+
unpacker.PullSecretFetcher = func(ctx context.Context) ([]corev1.Secret, error) {
224+
pullSecret, err := coreClient.Secrets(globalPullSecretKey.Namespace).Get(ctx, globalPullSecretKey.Name, metav1.GetOptions{})
225+
if err != nil {
226+
return nil, err
227+
}
228+
return []corev1.Secret{*pullSecret}, err
229+
}
230+
}
201231

202232
clusterExtensionFinalizers := crfinalizer.NewFinalizers()
203233
domain := ocv1alpha1.GroupVersion.Group

‎go.mod‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,7 @@ require (
1111
github.com/go-logr/logr v1.4.2
1212
github.com/google/go-cmp v0.6.0
1313
github.com/google/go-containerregistry v0.20.2
14+
github.com/google/go-containerregistry/pkg/authn/kubernetes v0.0.0-20240505154900-ff385a972813
1415
github.com/onsi/ginkgo/v2 v2.20.1
1516
github.com/onsi/gomega v1.34.1
1617
github.com/operator-framework/api v0.26.0

‎go.sum‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -281,6 +281,8 @@ github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
281281
github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
282282
github.com/google/go-containerregistry v0.20.2 h1:B1wPJ1SN/S7pB+ZAimcciVD+r+yV/l/DSArMxlbwseo=
283283
github.com/google/go-containerregistry v0.20.2/go.mod h1:z38EKdKh4h7IP2gSfUUqEvalZBqs6AoLeWfUy34nQC8=
284+
github.com/google/go-containerregistry/pkg/authn/kubernetes v0.0.0-20240505154900-ff385a972813 h1:irEChX0pAmED+6auieJELA0JKeCakr6iDCTLjJUiT8k=
285+
github.com/google/go-containerregistry/pkg/authn/kubernetes v0.0.0-20240505154900-ff385a972813/go.mod h1:8oYKXummIO/NNasXRCKr4DBziuA1MZ+VEhSQMYI8aJ0=
284286
github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
285287
github.com/google/gofuzz v1.2.0 h1:xRy4A+RhZaiKjJ1bPfwQ8sedCA+YS2YcCHW6ec7JMi0=
286288
github.com/google/gofuzz v1.2.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=

‎internal/rukpak/source/image_registry.go‎

Lines changed: 21 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -13,8 +13,10 @@ import (
1313
"strings"
1414

1515
"github.com/containerd/containerd/archive"
16+
k8sauth "github.com/google/go-containerregistry/pkg/authn/kubernetes"
1617
"github.com/google/go-containerregistry/pkg/name"
1718
"github.com/google/go-containerregistry/pkg/v1/remote"
19+
corev1 "k8s.io/api/core/v1"
1820
apimacherrors "k8s.io/apimachinery/pkg/util/errors"
1921
"sigs.k8s.io/controller-runtime/pkg/log"
2022

@@ -48,10 +50,13 @@ func NewUnrecoverable(err error) *Unrecoverable {
4850
// TODO: Make asynchronous
4951

5052
type ImageRegistry struct {
51-
BaseCachePath string
52-
CertPoolWatcher *httputil.CertPoolWatcher
53+
BaseCachePath string
54+
CertPoolWatcher *httputil.CertPoolWatcher
55+
PullSecretFetcher PullSecretFetcher
5356
}
5457

58+
type PullSecretFetcher func(ctx context.Context) ([]corev1.Secret, error)
59+
5560
func (i *ImageRegistry) Unpack(ctx context.Context, bundle *BundleSource) (*Result, error) {
5661
l := log.FromContext(ctx)
5762
if bundle.Type != SourceTypeImage {
@@ -98,6 +103,20 @@ func (i *ImageRegistry) Unpack(ctx context.Context, bundle *BundleSource) (*Resu
98103
}
99104
}
100105

106+
if i.PullSecretFetcher != nil {
107+
pullSecrets, err := i.PullSecretFetcher(ctx)
108+
if err != nil {
109+
l.V(1).Error(err, "Failed to fetch global pullsecret, attempting unauthenticated image pull")
110+
} else {
111+
pullSecretAuth, err := k8sauth.NewFromPullSecrets(ctx, pullSecrets)
112+
if err != nil {
113+
l.V(1).Error(err, "Failed to parse global pullsecret, attempting unauthenticated image pull")
114+
} else {
115+
remoteOpts = append(remoteOpts, remote.WithAuthFromKeychain(pullSecretAuth))
116+
}
117+
}
118+
}
119+
101120
// always fetch the hash
102121
imgDesc, err := remote.Head(imgRef, remoteOpts...)
103122
if err != nil {

‎vendor/modules.txt‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -457,6 +457,9 @@ github.com/google/go-containerregistry/pkg/v1/remote/transport
457457
github.com/google/go-containerregistry/pkg/v1/stream
458458
github.com/google/go-containerregistry/pkg/v1/tarball
459459
github.com/google/go-containerregistry/pkg/v1/types
460+
# github.com/google/go-containerregistry/pkg/authn/kubernetes v0.0.0-20240505154900-ff385a972813
461+
## explicit; go 1.18
462+
github.com/google/go-containerregistry/pkg/authn/kubernetes
460463
# github.com/google/gofuzz v1.2.0
461464
## explicit; go 1.12
462465
github.com/google/gofuzz

0 commit comments

Comments
 (0)