marker/shuffle-cracked
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

allow to specify image pull secrets for service accounts

Browse Source 
Signed-off-by: Pascal Sthamer <10992664+P4sca1@users.noreply.github.com>
This commit is contained in:
Pascal Sthamer
2025-02-21 10:44:49 +01:00
parent 53a7d2f2c4
commit 8263ba38aa
17 changed files with 248 additions and 30 deletions
Download Patch File Download Diff File Expand all files Collapse all files
charts/shuffle/templates/_helpers.tpl
+174 -12
View File
@@ -1,10 +1,3 @@
{{/*
Return the proper Docker Image Registry Secret Names
*/}}
{{- define "shuffle.imagePullSecrets" -}}
{{- include "common.images.renderPullSecrets" (dict "images" (list .Values.backend.image .Values.frontend.image .Values.orborus.image .Values.worker.image .Values.volumePermissions.image) "context" $) -}}
{{- end -}}
{{/*
Return the common name for backend componentes
*/}}
@@ -136,6 +129,13 @@ Return the proper Shuffle backend image name
{{- include "common.images.image" ( dict "imageRoot" .Values.backend.image "global" .Values.global ) -}}
{{- end -}}
{{/*
Return the proper Docker Image Registry Secret Names for the backend pod
*/}}
{{- define "shuffle.backend.imagePullSecrets" -}}
{{- include "common.images.renderPullSecrets" (dict "images" (list .Values.backend.image) "context" $) -}}
{{- end -}}
{{/*
Return the proper Shuffle frontend image name
*/}}
@@ -143,6 +143,13 @@ Return the proper Shuffle frontend image name
{{- include "common.images.image" ( dict "imageRoot" .Values.frontend.image "global" .Values.global ) -}}
{{- end -}}
{{/*
Return the proper Docker Image Registry Secret Names for the frontend pod
*/}}
{{- define "shuffle.frontend.imagePullSecrets" -}}
{{- include "common.images.renderPullSecrets" (dict "images" (list .Values.frontend.image) "context" $) -}}
{{- end -}}
{{/*
Return the proper Shuffle orborus image name
*/}}
@@ -150,6 +157,13 @@ Return the proper Shuffle orborus image name
{{- include "common.images.image" ( dict "imageRoot" .Values.orborus.image "global" .Values.global ) -}}
{{- end -}}
{{/*
Return the proper Docker Image Registry Secret Names for the orborus pod
*/}}
{{- define "shuffle.orborus.imagePullSecrets" -}}
{{- include "common.images.renderPullSecrets" (dict "images" (list .Values.orborus.image) "context" $) -}}
{{- end -}}
{{/*
Return the proper Shuffle worker image name
*/}}
@@ -160,7 +174,7 @@ Return the proper Shuffle worker image name
{{/*
Create the name of the service account to use for the Shuffle backend
*/}}
{{- define "shuffle.backend.serviceAccountName" -}}
{{- define "shuffle.backend.serviceAccount.name" -}}
{{- if .Values.backend.serviceAccount.create -}}
{{ default (include "shuffle.backend.name" .) .Values.backend.serviceAccount.name | trunc 63 | trimSuffix "-" }}
{{- else -}}
@@ -168,10 +182,40 @@ Create the name of the service account to use for the Shuffle backend
{{- end -}}
{{- end -}}
{{/*
Return the proper Docker Image Registry Secret Names for the backend service account
*/}}
{{- define "shuffle.backend.serviceAccount.imagePullSecrets" -}}
{{- $pullSecrets := list }}
{{- range .Values.global.imagePullSecrets -}}
{{- if kindIs "map" . -}}
{{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" .name "context" .)) -}}
{{- else -}}
{{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" . "context" .)) -}}
{{- end -}}
{{- end -}}
{{- range .Values.backend.serviceAccount.imagePullSecrets -}}
{{- if kindIs "map" . -}}
{{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" .name "context" .)) -}}
{{- else -}}
{{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" . "context" .)) -}}
{{- end -}}
{{- end -}}
{{- if (not (empty $pullSecrets)) -}}
imagePullSecrets:
{{- range $pullSecrets | uniq }}
- name: {{ . }}
{{- end }}
{{- end }}
{{- end -}}
{{/*
Create the name of the service account to use for the Shuffle frontend
*/}}
{{- define "shuffle.frontend.serviceAccountName" -}}
{{- define "shuffle.frontend.serviceAccount.name" -}}
{{- if .Values.frontend.serviceAccount.create -}}
{{ default (include "shuffle.frontend.name" .) .Values.frontend.serviceAccount.name | trunc 63 | trimSuffix "-" }}
{{- else -}}
@@ -179,10 +223,40 @@ Create the name of the service account to use for the Shuffle frontend
{{- end -}}
{{- end -}}
{{/*
Return the proper Docker Image Registry Secret Names for the frontend service account
*/}}
{{- define "shuffle.frontend.serviceAccount.imagePullSecrets" -}}
{{- $pullSecrets := list }}
{{- range .Values.global.imagePullSecrets -}}
{{- if kindIs "map" . -}}
{{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" .name "context" .)) -}}
{{- else -}}
{{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" . "context" .)) -}}
{{- end -}}
{{- end -}}
{{- range .Values.frontend.serviceAccount.imagePullSecrets -}}
{{- if kindIs "map" . -}}
{{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" .name "context" .)) -}}
{{- else -}}
{{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" . "context" .)) -}}
{{- end -}}
{{- end -}}
{{- if (not (empty $pullSecrets)) -}}
imagePullSecrets:
{{- range $pullSecrets | uniq }}
- name: {{ . }}
{{- end }}
{{- end }}
{{- end -}}
{{/*
Create the name of the service account to use for Shuffle orborus
*/}}
{{- define "shuffle.orborus.serviceAccountName" -}}
{{- define "shuffle.orborus.serviceAccount.name" -}}
{{- if .Values.orborus.serviceAccount.create -}}
{{ default (include "shuffle.orborus.name" .) .Values.orborus.serviceAccount.name | trunc 63 | trimSuffix "-" }}
{{- else -}}
@@ -190,10 +264,40 @@ Create the name of the service account to use for Shuffle orborus
{{- end -}}
{{- end -}}
{{/*
Return the proper Docker Image Registry Secret Names for the orborus service account
*/}}
{{- define "shuffle.orborus.serviceAccount.imagePullSecrets" -}}
{{- $pullSecrets := list }}
{{- range .Values.global.imagePullSecrets -}}
{{- if kindIs "map" . -}}
{{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" .name "context" .)) -}}
{{- else -}}
{{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" . "context" .)) -}}
{{- end -}}
{{- end -}}
{{- range .Values.orborus.serviceAccount.imagePullSecrets -}}
{{- if kindIs "map" . -}}
{{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" .name "context" .)) -}}
{{- else -}}
{{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" . "context" .)) -}}
{{- end -}}
{{- end -}}
{{- if (not (empty $pullSecrets)) -}}
imagePullSecrets:
{{- range $pullSecrets | uniq }}
- name: {{ . }}
{{- end }}
{{- end }}
{{- end -}}
{{/*
Create the name of the service account to use for Shuffle workers
*/}}
{{- define "shuffle.worker.serviceAccountName" -}}
{{- define "shuffle.worker.serviceAccount.name" -}}
{{- if .Values.worker.serviceAccount.create -}}
{{ default (include "shuffle.worker.name" .) .Values.worker.serviceAccount.name | trunc 63 | trimSuffix "-" }}
{{- else -}}
@@ -201,10 +305,40 @@ Create the name of the service account to use for Shuffle workers
{{- end -}}
{{- end -}}
{{/*
Return the proper Docker Image Registry Secret Names for the worker service account
*/}}
{{- define "shuffle.worker.serviceAccount.imagePullSecrets" -}}
{{- $pullSecrets := list }}
{{- range .Values.global.imagePullSecrets -}}
{{- if kindIs "map" . -}}
{{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" .name "context" .)) -}}
{{- else -}}
{{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" . "context" .)) -}}
{{- end -}}
{{- end -}}
{{- range .Values.worker.serviceAccount.imagePullSecrets -}}
{{- if kindIs "map" . -}}
{{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" .name "context" .)) -}}
{{- else -}}
{{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" . "context" .)) -}}
{{- end -}}
{{- end -}}
{{- if (not (empty $pullSecrets)) -}}
imagePullSecrets:
{{- range $pullSecrets | uniq }}
- name: {{ . }}
{{- end }}
{{- end }}
{{- end -}}
{{/*
Create the name of the service account to use for Shuffle apps
*/}}
{{- define "shuffle.app.serviceAccountName" -}}
{{- define "shuffle.app.serviceAccount.name" -}}
{{- if .Values.app.serviceAccount.create -}}
{{ default (include "shuffle.app.name" .) .Values.app.serviceAccount.name | trunc 63 | trimSuffix "-" }}
{{- else -}}
@@ -212,4 +346,32 @@ Create the name of the service account to use for Shuffle apps
{{- end -}}
{{- end -}}
{{/*
Return the proper Docker Image Registry Secret Names for the app service account
*/}}
{{- define "shuffle.app.serviceAccount.imagePullSecrets" -}}
{{- $pullSecrets := list }}
{{- range .Values.global.imagePullSecrets -}}
{{- if kindIs "map" . -}}
{{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" .name "context" .)) -}}
{{- else -}}
{{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" . "context" .)) -}}
{{- end -}}
{{- end -}}
{{- range .Values.app.serviceAccount.imagePullSecrets -}}
{{- if kindIs "map" . -}}
{{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" .name "context" .)) -}}
{{- else -}}
{{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" . "context" .)) -}}
{{- end -}}
{{- end -}}
{{- if (not (empty $pullSecrets)) -}}
imagePullSecrets:
{{- range $pullSecrets | uniq }}
- name: {{ . }}
{{- end }}
{{- end }}
{{- end -}}
charts/shuffle/templates/backend/backend-dpl.yaml
+2 -2
View File
@@ -25,8 +25,8 @@ spec:
{{- end }}
labels: {{- include "shuffle.backend.labels" ( dict "customLabels" $podLabels "context" $ ) | nindent 8 }}
spec:
{{- include "shuffle.imagePullSecrets" . | nindent 6 }}
serviceAccountName: {{ template "shuffle.backend.serviceAccountName" . }}
{{- include "shuffle.backend.imagePullSecrets" . | nindent 6 }}
serviceAccountName: {{ template "shuffle.backend.serviceAccount.name" . }}
automountServiceAccountToken: {{ .Values.backend.automountServiceAccountToken }}
{{- if .Values.backend.hostAliases }}
hostAliases: {{- include "common.tplvalues.render" (dict "value" .Values.backend.hostAliases "context" $) | nindent 8 }}
charts/shuffle/templates/backend/backend-role-binding.yaml
+1 -1
View File
@@ -10,7 +10,7 @@ metadata:
{{- end }}
subjects:
- kind: ServiceAccount
name: {{ include "shuffle.backend.serviceAccountName" . }}
name: {{ include "shuffle.backend.serviceAccount.name" . }}
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: Role
charts/shuffle/templates/backend/backend-service-account.yaml
+2 -1
View File
@@ -2,7 +2,7 @@
apiVersion: v1
kind: ServiceAccount
metadata:
name: {{ include "shuffle.backend.serviceAccountName" . }}
name: {{ include "shuffle.backend.serviceAccount.name" . }}
namespace: {{ include "common.names.namespace" . | quote }}
labels: {{- include "shuffle.backend.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
{{- if or .Values.backend.serviceAccount.annotations .Values.commonAnnotations }}
@@ -10,4 +10,5 @@ metadata:
annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $ ) | nindent 4 }}
{{- end }}
automountServiceAccountToken: {{ .Values.backend.serviceAccount.automountServiceAccountToken }}
{{- include "shuffle.backend.serviceAccount.imagePullSecrets" . | nindent 0 }}
{{- end }}
charts/shuffle/templates/frontend/frontend-dpl.yaml
+2 -2
View File
@@ -25,8 +25,8 @@ spec:
{{- end }}
labels: {{- include "shuffle.frontend.labels" ( dict "customLabels" $podLabels "context" $ ) | nindent 8 }}
spec:
{{- include "shuffle.imagePullSecrets" . | nindent 6 }}
serviceAccountName: {{ template "shuffle.frontend.serviceAccountName" . }}
{{- include "shuffle.frontend.imagePullSecrets" . | nindent 6 }}
serviceAccountName: {{ template "shuffle.frontend.serviceAccount.name" . }}
automountServiceAccountToken: {{ .Values.frontend.automountServiceAccountToken }}
{{- if .Values.frontend.hostAliases }}
hostAliases: {{- include "common.tplvalues.render" (dict "value" .Values.frontend.hostAliases "context" $) | nindent 8 }}
charts/shuffle/templates/frontend/frontend-service-account.yaml
+2 -1
View File
@@ -2,7 +2,7 @@
apiVersion: v1
kind: ServiceAccount
metadata:
name: {{ include "shuffle.frontend.serviceAccountName" . }}
name: {{ include "shuffle.frontend.serviceAccount.name" . }}
namespace: {{ include "common.names.namespace" . | quote }}
labels: {{- include "shuffle.frontend.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
{{- if or .Values.frontend.serviceAccount.annotations .Values.commonAnnotations }}
@@ -10,4 +10,5 @@ metadata:
annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $ ) | nindent 4 }}
{{- end }}
automountServiceAccountToken: {{ .Values.frontend.serviceAccount.automountServiceAccountToken }}
{{- include "shuffle.frontend.serviceAccount.imagePullSecrets" . | nindent 0 }}
{{- end }}
charts/shuffle/templates/orborus/orborus-cm-env.yaml
+1 -1
View File
@@ -13,7 +13,7 @@ data:
TZ: "{{ .Values.shuffle.timezone }}"
BASE_URL: "http://{{ include "shuffle.backend.name" . }}.{{ .Release.Namespace }}.svc.cluster.local:5001"
KUBERNETES_NAMESPACE: "{{ .Release.Namespace }}"
KUBERNETES_SERVICE_ACCOUNT: {{ include "shuffle.orborus.serviceAccountName" . }}
KUBERNETES_SERVICE_ACCOUNT: {{ include "shuffle.orborus.serviceAccount.name" . }}
SHUFFLE_WORKER_IMAGE: "{{ include "shuffle.worker.image" . }}"
REGISTRY_URL: "{{ .Values.shuffle.appRegistry }}"
SHUFFLE_SWARM_CONFIG: run
charts/shuffle/templates/orborus/orborus-dpl.yaml
+4 -4
View File
@@ -25,8 +25,8 @@ spec:
{{- end }}
labels: {{- include "shuffle.orborus.labels" ( dict "customLabels" $podLabels "context" $ ) | nindent 8 }}
spec:
{{- include "shuffle.imagePullSecrets" . | nindent 6 }}
serviceAccountName: {{ template "shuffle.orborus.serviceAccountName" . }}
{{- include "shuffle.orborus.imagePullSecrets" . | nindent 6 }}
serviceAccountName: {{ template "shuffle.orborus.serviceAccount.name" . }}
automountServiceAccountToken: {{ .Values.orborus.automountServiceAccountToken }}
{{- if .Values.orborus.hostAliases }}
hostAliases: {{- include "common.tplvalues.render" (dict "value" .Values.orborus.hostAliases "context" $) | nindent 8 }}
@@ -87,9 +87,9 @@ spec:
- name: IS_KUBERNETES
value: "true"
- name: SHUFFLE_WORKER_SERVICE_ACCOUNT_NAME
value: {{ include "shuffle.worker.serviceAccountName" . }}
value: {{ include "shuffle.worker.serviceAccount.name" . }}
- name: SHUFFLE_APP_SERVICE_ACCOUNT_NAME
value: {{ include "shuffle.app.serviceAccountName" . }}
value: {{ include "shuffle.app.serviceAccount.name" . }}
{{- if .Values.orborus.extraEnvVars }}
{{- include "common.tplvalues.render" (dict "value" .Values.orborus.extraEnvVars "context" $) | nindent 12 }}
{{- end }}
charts/shuffle/templates/orborus/orborus-role-binding.yaml
+1 -1
View File
@@ -10,7 +10,7 @@ metadata:
{{- end }}
subjects:
- kind: ServiceAccount
name: {{ include "shuffle.orborus.serviceAccountName" . }}
name: {{ include "shuffle.orborus.serviceAccount.name" . }}
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: Role
charts/shuffle/templates/orborus/orborus-service-account.yaml
+2 -1
View File
@@ -2,7 +2,7 @@
apiVersion: v1
kind: ServiceAccount
metadata:
name: {{ include "shuffle.orborus.serviceAccountName" . }}
name: {{ include "shuffle.orborus.serviceAccount.name" . }}
namespace: {{ include "common.names.namespace" . | quote }}
labels: {{- include "shuffle.orborus.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
{{- if or .Values.orborus.serviceAccount.annotations .Values.commonAnnotations }}
@@ -10,4 +10,5 @@ metadata:
annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $ ) | nindent 4 }}
{{- end }}
automountServiceAccountToken: {{ .Values.orborus.serviceAccount.automountServiceAccountToken }}
{{- include "shuffle.orborus.serviceAccount.imagePullSecrets" . | nindent 0 }}
{{- end }}
charts/shuffle/templates/shuffle-app/shuffle-app-role-binding.yaml
+1 -1
View File
@@ -10,7 +10,7 @@ metadata:
{{- end }}
subjects:
- kind: ServiceAccount
name: {{ include "shuffle.app.serviceAccountName" . }}
name: {{ include "shuffle.app.serviceAccount.name" . }}
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: Role
charts/shuffle/templates/shuffle-app/shuffle-app-service-account.yaml
+2 -1
View File
@@ -2,7 +2,7 @@
apiVersion: v1
kind: ServiceAccount
metadata:
name: {{ include "shuffle.app.serviceAccountName" . }}
name: {{ include "shuffle.app.serviceAccount.name" . }}
namespace: {{ include "common.names.namespace" . | quote }}
labels: {{- include "shuffle.app.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
{{- if or .Values.app.serviceAccount.annotations .Values.commonAnnotations }}
@@ -10,4 +10,5 @@ metadata:
annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $ ) | nindent 4 }}
{{- end }}
automountServiceAccountToken: {{ .Values.app.serviceAccount.automountServiceAccountToken }}
{{- include "shuffle.app.serviceAccount.imagePullSecrets" . | nindent 0 }}
{{- end }}
charts/shuffle/templates/shuffle-worker/shuffle-worker-role-binding.yaml
+1 -1
View File
@@ -10,7 +10,7 @@ metadata:
{{- end }}
subjects:
- kind: ServiceAccount
name: {{ include "shuffle.worker.serviceAccountName" . }}
name: {{ include "shuffle.worker.serviceAccount.name" . }}
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: Role
charts/shuffle/templates/shuffle-worker/shuffle-worker-service-account.yaml
+2 -1
View File
@@ -2,7 +2,7 @@
apiVersion: v1
kind: ServiceAccount
metadata:
name: {{ include "shuffle.worker.serviceAccountName" . }}
name: {{ include "shuffle.worker.serviceAccount.name" . }}
namespace: {{ include "common.names.namespace" . | quote }}
labels: {{- include "shuffle.worker.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
{{- if or .Values.worker.serviceAccount.annotations .Values.commonAnnotations }}
@@ -10,4 +10,5 @@ metadata:
annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $ ) | nindent 4 }}
{{- end }}
automountServiceAccountToken: {{ .Values.worker.serviceAccount.automountServiceAccountToken }}
{{- include "shuffle.worker.serviceAccount.imagePullSecrets" . | nindent 0 }}
{{- end }}