add a comment on how and why we deal with image pull secret (deckhouse#40)

31337Ghost · web-flow · commit e9bba776089f · 2021-09-01T12:10:54.000+03:00
diff --git a/pkg/registry_checker/indexers.go b/pkg/registry_checker/indexers.go
@@ -153,6 +153,9 @@ func ExtractPullSecretRefs(kubeClient *kubernetes.Clientset, obj interface{}) (r
 	}
 
 	pullSecretRefs := extractPullSecretRefsFromPodSpec(namespace, podSpec)
+	// Image pull secret defined in Pod's `spec.ImagePullSecrets` takes preference over the secret from ServiceAccount.
+	// We are acting the same way as kubelet does:
+	// https://github.com/kubernetes/kubernetes/blob/88b31814f4a55c0af1c7d2712ce736a8fe08887e/plugin/pkg/admission/serviceaccount/admission.go#L163-L168.
 	if len(pullSecretRefs) == 0 && len(podSpec.ServiceAccountName) > 0 {
 		serviceAccount, err := kubeClient.CoreV1().ServiceAccounts(namespace).Get(podSpec.ServiceAccountName, metav1.GetOptions{})
 		if err == nil {

Original file line number	Diff line number	Diff line change
`@@ -153,6 +153,9 @@ func ExtractPullSecretRefs(kubeClient *kubernetes.Clientset, obj interface{}) (r`
`153`	`153`	`}`
`154`	`154`
`155`	`155`	`pullSecretRefs := extractPullSecretRefsFromPodSpec(namespace, podSpec)`
	`156`	+ // Image pull secret defined in Pod's `spec.ImagePullSecrets` takes preference over the secret from ServiceAccount.
	`157`	`+ // We are acting the same way as kubelet does:`
	`158`	`+ // https://github.com/kubernetes/kubernetes/blob/88b31814f4a55c0af1c7d2712ce736a8fe08887e/plugin/pkg/admission/serviceaccount/admission.go#L163-L168.`
`156`	`159`	`if len(pullSecretRefs) == 0 && len(podSpec.ServiceAccountName) > 0 {`
`157`	`160`	`serviceAccount, err := kubeClient.CoreV1().ServiceAccounts(namespace).Get(podSpec.ServiceAccountName, metav1.GetOptions{})`
`158`	`161`	`if err == nil {`