Skip to content

feat: add support for image pull secrets for all components #1427

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

feat: add support for image pull secrets for all components #1427

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 6 additions & 0 deletions api/v1alpha1/common.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -159,3 +159,9 @@ type PodRequirements struct {
Resources *core.ResourceRequirements `json:"resources,omitempty"`
Tolerations []core.Toleration `json:"tolerations,omitempty"`
}

type ServiceAccountRequirements struct {
// ImagePullSecrets is an optional list of references to secrets for pulling container images.
//+optional
ImagePullSecrets []core.LocalObjectReference `json:"imagePullSecrets,omitempty"`
}
2 changes: 2 additions & 0 deletions api/v1alpha1/ctlog_types.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -58,6 +58,8 @@ type CTlogSpec struct {
//+kubebuilder:default:=153600
//+optional
MaxCertChainSize *int64 `json:"maxCertChainSize,omitempty"`

ServiceAccountRequirements `json:",inline"`
}

// CTlogStatus defines the observed state of CTlog component
Expand Down
2 changes: 2 additions & 0 deletions api/v1alpha1/fulcio_types.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,6 +33,8 @@ type FulcioSpec struct {
// ConfigMap with additional bundle of trusted CA
//+optional
TrustedCA *LocalObjectReference `json:"trustedCA,omitempty"`

ServiceAccountRequirements `json:",inline"`
}

// FulcioCert defines fields for system-generated certificate
Expand Down
2 changes: 2 additions & 0 deletions api/v1alpha1/rekor_types.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -58,6 +58,8 @@ type RekorSpec struct {
//+kubebuilder:default:=10485760
//+optional
MaxRequestBodySize *int64 `json:"maxRequestBodySize,omitempty"`

ServiceAccountRequirements `json:",inline"`
}

// RekorAttestations defines the configuration for storing attestations.
Expand Down
4 changes: 3 additions & 1 deletion api/v1alpha1/securesign_types.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,7 +24,7 @@ import (
// EDIT THIS FILE! THIS IS SCAFFOLDING FOR YOU TO OWN!
// NOTE: json tags are required. Any new fields you add must have json tags for the fields to be serialized.

// SecuresignSpec defines the desired state of Securesign
// SecuresignSpec defines the desired state of Securesign.
// +kubebuilder:validation:XValidation:rule="(has(self.rekor.attestations.enabled) && !self.rekor.attestations.enabled) || !self.rekor.attestations.url.startsWith('file://') || (!(self.rekor.replicas > 1) || ('ReadWriteMany' in self.rekor.pvc.accessModes))",message="When Rekor's rich attestation storage is enabled, and it's URL starts with 'file://', then PVC accessModes must contain 'ReadWriteMany' for replicas greater than 1."
// +kubebuilder:validation:XValidation:rule="!(self.tuf.replicas > 1) || ('ReadWriteMany' in self.tuf.pvc.accessModes)",message="For TUF deployments with more than 1 replica, tuf.pvc.accessModes must include 'ReadWriteMany'."
type SecuresignSpec struct {
Expand All @@ -35,6 +35,8 @@ type SecuresignSpec struct {
Tuf TufSpec `json:"tuf,omitempty"`
Ctlog CTlogSpec `json:"ctlog,omitempty"`
TimestampAuthority *TimestampAuthoritySpec `json:"tsa,omitempty"`

ServiceAccountRequirements `json:",inline"`
Copy link
Collaborator

@osmman osmman Nov 11, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ImagePullSecrets for this CRD behave differently compare to other CRDs. It will require document that behavior and it will be good to provide some tests to not broke it in feature changes.

Copy link
Contributor Author

@knrc knrc Nov 11, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes to documentation, I've already reached out to Aron about creating the docs issues. Or are you referring to having a comment?

I'll add some tests

Copy link
Contributor Author

@knrc knrc Nov 12, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I add a comment to SecuresignSpec and some higher level tests to complement the lower level ones

Copy link
Collaborator

@osmman osmman Nov 12, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Unfortunately adding comment like you dud will not modify CRD's OpenAPI which is main source for documentation of CRDs.

For example:

oc explain securesign.spec

Copy link
Contributor Author

@knrc knrc Nov 12, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ah okay, now I understand what you are after. I'll take a look

Copy link
Collaborator

@osmman osmman Nov 12, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

One option is to not use ServiceAccountRquirements for Secureign resource and simply add directly imagePullSecrets to that resource. Other CRD can use shared struct.

Copy link
Collaborator

@osmman osmman Nov 12, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

or have two versions of struct. We already have specific version for TufPvc.

Copy link
Contributor Author

@knrc knrc Nov 12, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Adding the comment to the type is ignored, because of the inlining, so I've added something to the SecureSignSpec instead

Copy link
Contributor Author

@knrc knrc Nov 12, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@osmman take a look and see if that works

Copy link
Contributor Author

@knrc knrc Nov 13, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@osmman crdify is complaining about the extra text, so I've reverted that

}

// SecuresignStatus defines the observed state of Securesign
Expand Down
2 changes: 2 additions & 0 deletions api/v1alpha1/timestampauthority_types.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -42,6 +42,8 @@ type TimestampAuthoritySpec struct {
//+kubebuilder:default:=1048576
//+optional
MaxRequestBodySize *int64 `json:"maxRequestBodySize,omitempty"`

ServiceAccountRequirements `json:",inline"`
}

// TimestampAuthoritySigner defines the desired state of the Timestamp Authority Signer
Expand Down
2 changes: 2 additions & 0 deletions api/v1alpha1/trillian_types.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -42,6 +42,8 @@ type TrillianSpec struct {
//+kubebuilder:default:=153600
//+optional
MaxRecvMessageSize *int64 `json:"maxRecvMessageSize,omitempty"`

ServiceAccountRequirements `json:",inline"`
}

type trillianService struct {
Expand Down
2 changes: 2 additions & 0 deletions api/v1alpha1/tuf_types.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,6 +29,8 @@ type TufSpec struct {
// You can use ReadWriteOnce accessMode if you don't have suitable storage provider but your deployment will not support HA mode
//+kubebuilder:default:={size: "100Mi",retain: true,accessModes: {ReadWriteOnce}}
Pvc TufPvc `json:"pvc,omitempty"`

ServiceAccountRequirements `json:",inline"`
}

// TufPvc configuration of the persistent storage claim for deployment in the cluster.
Expand Down
27 changes: 27 additions & 0 deletions api/v1alpha1/zz_generated.deepcopy.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

20 changes: 20 additions & 0 deletions config/crd/bases/rhtas.redhat.com_ctlogs.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -956,6 +956,26 @@ spec:
x-kubernetes-list-type: atomic
type: object
type: object
imagePullSecrets:
description: ImagePullSecrets is an optional list of references to
secrets for pulling container images.
items:
description: |-
LocalObjectReference contains enough information to let you locate the
referenced object inside the same namespace.
properties:
name:
default: ""
description: |-
Name of the referent.
This field is effectively required, but due to backwards compatibility is
allowed to be empty. Instances of this type with an empty value here are
almost certainly wrong.
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
type: string
type: object
x-kubernetes-map-type: atomic
type: array
maxCertChainSize:
default: 153600
description: Max certificate chain size in bytes. Passed as --max_cert_chain_size.
Expand Down
20 changes: 20 additions & 0 deletions config/crd/bases/rhtas.redhat.com_fulcios.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1280,6 +1280,26 @@ spec:
required:
- enabled
type: object
imagePullSecrets:
description: ImagePullSecrets is an optional list of references to
secrets for pulling container images.
items:
description: |-
LocalObjectReference contains enough information to let you locate the
referenced object inside the same namespace.
properties:
name:
default: ""
description: |-
Name of the referent.
This field is effectively required, but due to backwards compatibility is
allowed to be empty. Instances of this type with an empty value here are
almost certainly wrong.
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
type: string
type: object
x-kubernetes-map-type: atomic
type: array
monitoring:
description: Enable Service monitors for fulcio
properties:
Expand Down
20 changes: 20 additions & 0 deletions config/crd/bases/rhtas.redhat.com_rekors.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1247,6 +1247,26 @@ spec:
required:
- enabled
type: object
imagePullSecrets:
description: ImagePullSecrets is an optional list of references to
secrets for pulling container images.
items:
description: |-
LocalObjectReference contains enough information to let you locate the
referenced object inside the same namespace.
properties:
name:
default: ""
description: |-
Name of the referent.
This field is effectively required, but due to backwards compatibility is
allowed to be empty. Instances of this type with an empty value here are
almost certainly wrong.
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
type: string
type: object
x-kubernetes-map-type: atomic
type: array
maxRequestBodySize:
default: 10485760
description: MaxRequestBodySize sets the maximum size in bytes for
Expand Down
Loading
Loading