Merge pull request #196 from cognifloyd/service-account-pull-secrets

Add the ability to define imagePullSecrets for service account

Author: arm4b

CHANGELOG.md

@@ -2,6 +2,7 @@
 
 ## In Development
 * Updated redis constant sentinel ID which will allow other sentinel peers to update to the new given IP in case of pod failure or worker node reboots. (#191) (by @manisha-tanwar)
+* Add optional imagePullSecrets to ServiceAccount using `serviceAccount.pullSecret` from values.yaml. If pods do not have imagePullSecrets (eg without `image.pullSecret` in values.yaml), k8s populates them from the ServiceAccount. (#196) (by @cognifloyd)
 * Reformat some yaml strings so that single quotes wrap strings that include double quotes (#194) (by @cognifloyd)
 
 ## v0.60.0

templates/service-account.yaml

@@ -13,4 +13,8 @@ metadata:
     app: '{{ template "stackstorm-ha.name" . }}'
     heritage: "{{ .Release.Service }}"
     release: "{{ .Release.Name }}"
+  {{- if .Values.serviceAccount.pullSecret }}
+  imagePullSecrets:
+  - name: "{{ .Values.serviceAccount.pullSecret }}"
+  {{- end }}
 {{- end }}

values.yaml

@@ -29,6 +29,10 @@ serviceAccount:
   serviceAccountAnnotations: {}
   # Used to override service account name
   serviceAccountName:
+  # Fallback image pull secret.
+  # If a pod does not have pull secrets, k8s will use the service account's pull secrets.
+  # See: https://kubernetes.io/docs/reference/access-authn-authz/service-accounts-admin/#serviceaccount-admission-controller
+  #pullSecret: "your-pull-secret"
 
 ##
 ## StackStorm shared variables