Skip to content

feat: Add support for image pull secrets in deployments #99

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
kodiakhq merged 5 commits into from
Aug 12, 2025
Merged

feat: Add support for image pull secrets in deployments #99

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
59f5c64
feat: Add support for image pull secrets in deployments
teeohhem Aug 12, 2025
0a15a1f
Merge remote-tracking branch 'origin/main' into tom/add-image-pull-se…
teeohhem Aug 12, 2025
f60504a
Create rotten-numbers-protect.md
teeohhem Aug 12, 2025
ff5c0c6
Fix unit tests
teeohhem Aug 12, 2025
eb5384a
Merge branch 'main' into tom/add-image-pull-secrets
kodiakhq[bot] Aug 12, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions .changeset/rotten-numbers-protect.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,5 @@
---
"helm-charts": patch
---

feat: Add support for image pull secrets in deployments
4 changes: 4 additions & 0 deletions charts/hdx-oss-v2/templates/clickhouse-deployment.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,6 +26,10 @@ spec:
tolerations:
{{- toYaml .Values.clickhouse.tolerations | nindent 8 }}
{{- end }}
{{- if .Values.global.imagePullSecrets }}
imagePullSecrets:
{{- toYaml .Values.global.imagePullSecrets | nindent 8 }}
{{- end }}
containers:
- name: clickhouse
image: "{{ .Values.clickhouse.image }}"
Expand Down
4 changes: 4 additions & 0 deletions charts/hdx-oss-v2/templates/cronjobs/task-checkAlerts.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,6 +17,10 @@ spec:
{{- include "hdx-oss.selectorLabels" . | nindent 12 }}
app.kubernetes.io/component: task
spec:
{{- if .Values.global.imagePullSecrets }}
imagePullSecrets:
{{- toYaml .Values.global.imagePullSecrets | nindent 12 }}
{{- end }}
restartPolicy: OnFailure
containers:
- name: task
Expand Down
4 changes: 4 additions & 0 deletions charts/hdx-oss-v2/templates/hyperdx-deployment.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,6 +43,10 @@ spec:
{{- if .Values.hyperdx.priorityClassName }}
priorityClassName: {{ .Values.hyperdx.priorityClassName | quote }}
{{- end }}
{{- if .Values.global.imagePullSecrets }}
imagePullSecrets:
{{- toYaml .Values.global.imagePullSecrets | nindent 8 }}
{{- end }}
{{- if .Values.mongodb.enabled }}
initContainers:
- name: wait-for-mongodb
Expand Down
4 changes: 4 additions & 0 deletions charts/hdx-oss-v2/templates/mongodb-deployment.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -48,6 +48,10 @@ spec:
tolerations:
{{- toYaml .Values.mongodb.tolerations | nindent 8 }}
{{- end }}
{{- if .Values.global.imagePullSecrets }}
imagePullSecrets:
{{- toYaml .Values.global.imagePullSecrets | nindent 8 }}
{{- end }}
containers:
- name: mongodb
image: "{{ .Values.mongodb.image }}"
Expand Down
4 changes: 4 additions & 0 deletions charts/hdx-oss-v2/templates/otel-collector-deployment.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,6 +32,10 @@ spec:
tolerations:
{{- toYaml .Values.otel.tolerations | nindent 8 }}
{{- end }}
{{- if .Values.global.imagePullSecrets }}
imagePullSecrets:
{{- toYaml .Values.global.imagePullSecrets | nindent 8 }}
{{- end }}
containers:
- name: otel-collector
image: "{{ .Values.otel.image.repository }}:{{ .Values.otel.image.tag | default .Chart.AppVersion }}"
Expand Down
27 changes: 26 additions & 1 deletion charts/hdx-oss-v2/tests/clickhouse-deployment_test.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -338,4 +338,29 @@ tests:
of: PersistentVolumeClaim
- documentIndex: 5
isNull:
path: metadata.annotations
path: metadata.annotations

- it: should not include imagePullSecrets when not configured
set:
clickhouse:
enabled: true
asserts:
- documentIndex: 0
Copy link
Collaborator

@dhable dhable Aug 12, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

documentIndex works as long as we don't change the ordering of the documents in the file. Would a better pattern be to use documentSelector?

  - it: should not include imagePullSecrets when not configured
    set:
      clickhouse:
        enabled: true
    documentSelector:
      path: kind
      value: Deployment
    asserts:
      - isNull:
          path: spec.template.spec.imagePullSecrets

It looks like we're using documentIndex in the code so this matches. Just wondering if that's the pattern we want to use? It's more important when using the isNull check because a surprise reordering could still have a passing test because the test is working on a document that it didn't expect and thus gives a false positive - the key is missing because it's the wrong document, not because the template did the right thing.

Copy link
Contributor Author

@teeohhem teeohhem Aug 12, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

documentSelector is a better approach (The index reference already bit me once when I resolved a merge conflict with two different tests). I propose a widespread change / another ticket.

isNull:
path: spec.template.spec.imagePullSecrets

- it: should include imagePullSecrets when configured
set:
clickhouse:
enabled: true
global:
imagePullSecrets:
- name: regcred
asserts:
- documentIndex: 0
isNotNull:
path: spec.template.spec.imagePullSecrets
- documentIndex: 0
equal:
path: spec.template.spec.imagePullSecrets[0].name
value: regcred
45 changes: 44 additions & 1 deletion charts/hdx-oss-v2/tests/hyperdx-deployment_test.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -226,4 +226,47 @@ tests:
value: 9000
- equal:
path: spec.template.spec.containers[0].readinessProbe.httpGet.port
value: 9000
value: 9000

- it: should not include imagePullSecrets when not configured
asserts:
- isNull:
path: spec.template.spec.imagePullSecrets

- it: should include imagePullSecrets when configured with single secret
set:
global:
imagePullSecrets:
- name: regcred
asserts:
- isNotNull:
path: spec.template.spec.imagePullSecrets
- equal:
path: spec.template.spec.imagePullSecrets[0].name
value: regcred
- lengthEqual:
path: spec.template.spec.imagePullSecrets
count: 1

- it: should include imagePullSecrets when configured with multiple secrets
set:
global:
imagePullSecrets:
- name: regcred
- name: docker-hub-secret
- name: private-registry-secret
asserts:
- isNotNull:
path: spec.template.spec.imagePullSecrets
- equal:
path: spec.template.spec.imagePullSecrets[0].name
value: regcred
- equal:
path: spec.template.spec.imagePullSecrets[1].name
value: docker-hub-secret
- equal:
path: spec.template.spec.imagePullSecrets[2].name
value: private-registry-secret
- lengthEqual:
path: spec.template.spec.imagePullSecrets
count: 3
25 changes: 25 additions & 0 deletions charts/hdx-oss-v2/tests/mongodb-deployment_test.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -265,3 +265,28 @@ tests:
equal:
path: spec.storageClassName
value: fast-ssd

- it: should not include imagePullSecrets when not configured
set:
mongodb:
enabled: true
asserts:
- documentIndex: 0
isNull:
path: spec.template.spec.imagePullSecrets

- it: should include imagePullSecrets when configured
set:
mongodb:
enabled: true
global:
imagePullSecrets:
- name: regcred
asserts:
- documentIndex: 1
isNotNull:
path: spec.template.spec.imagePullSecrets
- documentIndex: 1
equal:
path: spec.template.spec.imagePullSecrets[0].name
value: regcred
25 changes: 25 additions & 0 deletions charts/hdx-oss-v2/tests/otel-collector_test.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -807,3 +807,28 @@ tests:
equal:
path: spec.template.spec.containers[0].readinessProbe.httpGet.port
value: 13134

- it: should not include imagePullSecrets when not configured
set:
otel:
enabled: true
asserts:
- documentIndex: 0
isNull:
path: spec.template.spec.imagePullSecrets

- it: should include imagePullSecrets when configured
set:
otel:
enabled: true
global:
imagePullSecrets:
- name: regcred
asserts:
- documentIndex: 0
isNotNull:
path: spec.template.spec.imagePullSecrets
- documentIndex: 0
equal:
path: spec.template.spec.imagePullSecrets[0].name
value: regcred
22 changes: 22 additions & 0 deletions charts/hdx-oss-v2/tests/task-checkAlerts_test.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -72,3 +72,25 @@ tests:
- equal:
path: spec.schedule
value: "*/1 * * * *"

- it: should not include imagePullSecrets when not configured
set:
tasks:
enabled: true
asserts:
- isNull:
path: spec.jobTemplate.spec.template.spec.imagePullSecrets

- it: should include imagePullSecrets when configured
set:
tasks:
enabled: true
global:
imagePullSecrets:
- name: regcred
asserts:
- isNotNull:
path: spec.jobTemplate.spec.template.spec.imagePullSecrets
- equal:
path: spec.jobTemplate.spec.template.spec.imagePullSecrets[0].name
value: regcred
6 changes: 6 additions & 0 deletions charts/hdx-oss-v2/values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,11 @@
global:
imageRegistry: ""
# List of image pull secrets to use for pulling images from private registries
# This helps avoid rate limiting (429 errors) when pulling from Docker Hub
# Example:
# imagePullSecrets:
# - name: regcred
# - name: docker-hub-secret
imagePullSecrets: []
storageClassName: "local-path"
# Keep PVCs when uninstalling helm release to preserve data
Expand Down