createImagePullSecrets also from other reg creds

schnatterer · nihussmann · commit 18c1759bbae7 · 2024-10-23T10:03:00.000+02:00
This improves UX because we can also create image pull secrets when
running with only one registry
diff --git a/Jenkinsfile b/Jenkinsfile
@@ -97,7 +97,7 @@ node('high-cpu') {
                                         .inside("-e KUBECONFIG=${env.WORKSPACE}/.kube/config " +
                                                 " --network=host --entrypoint=''") {
                                             sh "/app/apply-ng --yes --trace --internal-registry-port=${registryPort} " +
-                                                    "--argocd --monitoring --vault=dev --ingress-nginx --mailhog"
+                                                    "--argocd --monitoring --vault=dev --ingress-nginx --mailhog --base-url=http://localhost"
                                         }
                             }
                         }
diff --git a/applications/argocd/nginx/helm-jenkins/k8s/values-shared.ftl.yaml b/applications/argocd/nginx/helm-jenkins/k8s/values-shared.ftl.yaml
@@ -4,7 +4,7 @@ image:
   repository: ${nginxImage.repository}
   tag: ${nginxImage.tag}
 </#if>
-<#if config.registry.createImagePullSecrets?has_content && config.registry.twoRegistries?has_content>
+<#if config.registry.createImagePullSecrets == true>
 
 global:
   imagePullSecrets:
diff --git a/applications/cluster-resources/ingress-nginx-helm-values.ftl.yaml b/applications/cluster-resources/ingress-nginx-helm-values.ftl.yaml
@@ -1,5 +1,5 @@
 <#assign DockerImageParser=statics['com.cloudogu.gitops.utils.DockerImageParser']>
-<#if config.registry.createImagePullSecrets?has_content && config.registry.twoRegistries?has_content>
+<#if config.registry.createImagePullSecrets == true>
 imagePullSecrets:
   - name: proxy-registry
 
diff --git a/applications/cluster-resources/mailhog-helm-values.ftl.yaml b/applications/cluster-resources/mailhog-helm-values.ftl.yaml
@@ -5,7 +5,7 @@ image:
   repository: ${imageObject.registryAndRepositoryAsString}
 <#if imageObject.tag?has_content>  tag: ${imageObject.tag}</#if>
 </#if>
-<#if config.registry.createImagePullSecrets?has_content && config.registry.twoRegistries?has_content>
+<#if config.registry.createImagePullSecrets == true>
 
 imagePullSecrets: 
  - name: proxy-registry
diff --git a/applications/cluster-resources/secrets/external-secrets/values.ftl.yaml b/applications/cluster-resources/secrets/external-secrets/values.ftl.yaml
@@ -29,7 +29,7 @@ resources:
     memory: 40Mi
     cpu: 50m
 </#if>
-<#if config.registry.createImagePullSecrets?has_content && config.registry.twoRegistries?has_content>
+<#if config.registry.createImagePullSecrets  == true>
 imagePullSecrets:
   - name: proxy-registry
 </#if>
@@ -45,7 +45,7 @@ certController:
   image:
     repository: ${certControllerimageObject.registryAndRepositoryAsString}
     tag: ${certControllerimageObject.tag}
-  <#if config.registry.createImagePullSecrets?has_content && config.registry.twoRegistries?has_content>
+  <#if config.registry.createImagePullSecrets == true>
   imagePullSecrets:
     - name: proxy-registry
   </#if>
@@ -56,7 +56,7 @@ webhook:
   image:
     repository: ${webhookImageObject.registryAndRepositoryAsString}
     tag: ${webhookImageObject.tag}
-  <#if config.registry.createImagePullSecrets?has_content && config.registry.twoRegistries?has_content>
+  <#if config.registry.createImagePullSecrets == true>
   imagePullSecrets:
     - name: proxy-registry
   </#if>
diff --git a/applications/cluster-resources/secrets/vault/values.ftl.yaml b/applications/cluster-resources/secrets/vault/values.ftl.yaml
@@ -10,7 +10,7 @@ ui:
 </#if>
 injector: 
   enabled: false
-<#if config.registry.createImagePullSecrets?has_content && config.registry.twoRegistries?has_content>
+<#if config.registry.createImagePullSecrets == true>
 global:
   imagePullSecrets:
   - name: proxy-registry
@@ -26,11 +26,11 @@ server:
       repository: ${imageObject.registryAndRepositoryAsString}
       tag: ${imageObject.tag}
 </#if>
-<#if url?has_content>
+<#if host?has_content>
   ingress:
     enabled: true
     hosts:
-      - host: ${url.host}
+      - host: ${host}
 </#if>
 
 <#if config.application.podResources == true>
diff --git a/docs/developers.md b/docs/developers.md
@@ -487,7 +487,7 @@ skopeo copy docker://quay.io/kiwigrid/k8s-sidecar:1.27.4 --dest-creds Proxy:Prox
 docker run --rm -t -u $(id -u)  \
    -v ~/.config/k3d/kubeconfig-gitops-playground.yaml:/home/.kube/config  \
     --net=host  \
-    gitops-playground:dev \
+    gitops-playground:dev -x \
     --yes --argocd --ingress-nginx --base-url=http://localhost \
     --vault=dev --monitoring --mailhog \
     --create-image-pull-secrets \
diff --git a/exercises/broken-application/broken-application.ftl.yaml b/exercises/broken-application/broken-application.ftl.yaml
@@ -7,7 +7,7 @@ spec:
   selector:
     matchLabels:
       app: broken-application
-<#if config.registry.createImagePullSecrets?has_content && config.registry.twoRegistries?has_content>
+<#if config.registry.createImagePullSecrets == true>
   imagePullSecrets:
     - name: proxy-registry
 </#if>
diff --git a/exercises/nginx-validation/k8s/values-shared.ftl.yaml b/exercises/nginx-validation/k8s/values-shared.ftl.yaml
@@ -4,7 +4,7 @@ image:
   repository: ${nginxImage.repository}
   tag: ${nginxImage.tag}
 </#if>
-<#if config.registry.createImagePullSecrets?has_content && config.registry.twoRegistries?has_content>
+<#if config.registry.createImagePullSecrets == true>
 global:
   imagePullSecrets:
     - proxy-registry
diff --git a/src/main/groovy/com/cloudogu/gitops/FeatureWithImage.groovy b/src/main/groovy/com/cloudogu/gitops/FeatureWithImage.groovy
@@ -12,12 +12,14 @@ trait FeatureWithImage {
     final Logger log = LoggerFactory.getLogger(this.class)
     
     void createImagePullSecret() {
-        if (config.registry['createImagePullSecrets'] && config.registry['twoRegistries']) {
+        if (config.registry['createImagePullSecrets']) {
             log.trace("Creating image pull secret 'proxy-registry' in namespace ${namespace}" as String)
+            String url = config.registry['proxyUrl'] ?: config.registry['url']
+            String user = config.registry['proxyUsername'] ?: config.registry['readOnlyUsername'] ?: config.registry['username']
+            String password = config.registry['proxyPassword'] ?: config.registry['readOnlyPassword'] ?: config.registry['password']
+            
             k8sClient.createNamespace(namespace)
-            k8sClient.createImagePullSecret('proxy-registry', namespace, config.registry['proxyUrl'] as String,
-                    config.registry['proxyUsername'] as String,
-                    config.registry['proxyPassword'] as String)
+            k8sClient.createImagePullSecret('proxy-registry', namespace, url, user, password)
         }
     }
     
diff --git a/src/main/groovy/com/cloudogu/gitops/features/Vault.groovy b/src/main/groovy/com/cloudogu/gitops/features/Vault.groovy
@@ -57,7 +57,7 @@ class Vault extends Feature implements FeatureWithImage {
 
         def yaml =  new YamlSlurper().parseText(
                 new TemplatingEngine().template(new File(HELM_VALUES_PATH), [
-                url: config.features['secrets']['vault']['url'] ? new URL(config.features['secrets']['vault']['url'] as String) : null,
+                host: config.features['secrets']['vault']['url'] ? new URL(config.features['secrets']['vault']['url'] as String).host : "",
                 config: config,
                 // Allow for using static classes inside the templates
                 statics: new DefaultObjectWrapperBuilder(freemarker.template.Configuration.VERSION_2_3_32).build().getStaticModels()
diff --git a/src/test/groovy/com/cloudogu/gitops/FeatureTest.groovy b/src/test/groovy/com/cloudogu/gitops/FeatureTest.groovy
@@ -18,21 +18,58 @@ class FeatureTest {
     @Test
     void 'Image pull secrets are create automatically'() {
         config['registry']['createImagePullSecrets'] = true
-        config['registry']['twoRegistries'] = true
         config['registry']['proxyUrl'] = 'proxy-url'
         config['registry']['proxyUsername'] = 'proxy-user'
         config['registry']['proxyPassword'] = 'proxy-pw'
+        config['registry']['url'] = 'url'
+        config['registry']['readOnlyUsername'] = 'ROuser'
+        config['registry']['readOnlyPassword'] = 'ROpw'
+        config['registry']['username'] = 'user'
+        config['registry']['password'] = 'pw'
 
+        createFeatureWithImage().install()
+        
+        k8sClient.commandExecutorForTest.assertExecuted(
+                'kubectl create secret docker-registry proxy-registry -n foo-my-ns' +
+                        ' --docker-server proxy-url --docker-username proxy-user --docker-password proxy-pw')
+    }
+
+    protected FeatureWithImageForTest createFeatureWithImage() {
         Feature feature = new FeatureWithImageForTest()
         feature.config = config
         feature.k8sClient = k8sClient
         feature.namespace = 'my-ns'
+        feature
+    }
+
+    @Test
+    void 'Image pull secrets: Falls back to using readOnly credentials and URL '() {
+        config['registry']['createImagePullSecrets'] = true
+        config['registry']['url'] = 'url'
+        config['registry']['readOnlyUsername'] = 'ROuser'
+        config['registry']['readOnlyPassword'] = 'ROpw'
+        config['registry']['username'] = 'user'
+        config['registry']['password'] = 'pw'
 
-        feature.install()
+        createFeatureWithImage().install()
         
         k8sClient.commandExecutorForTest.assertExecuted(
                 'kubectl create secret docker-registry proxy-registry -n foo-my-ns' +
-                        ' --docker-server proxy-url --docker-username proxy-user --docker-password proxy-pw')
+                        ' --docker-server url --docker-username ROuser --docker-password ROpw')
+    }
+    
+    @Test
+    void 'Image pull secrets: Falls back to using credentials and URL '() {
+        config['registry']['createImagePullSecrets'] = true
+        config['registry']['url'] = 'url'
+        config['registry']['username'] = 'user'
+        config['registry']['password'] = 'pw'
+
+        createFeatureWithImage().install()
+        
+        k8sClient.commandExecutorForTest.assertExecuted(
+                'kubectl create secret docker-registry proxy-registry -n foo-my-ns' +
+                        ' --docker-server url --docker-username user --docker-password pw')
     }
 
     class FeatureWithImageForTest extends Feature implements FeatureWithImage {
diff --git a/src/test/groovy/com/cloudogu/gitops/features/ContentTest.groovy b/src/test/groovy/com/cloudogu/gitops/features/ContentTest.groovy
@@ -45,7 +45,7 @@ class ContentTest {
     }
 
     @Test
-    void 'deploys image pull secrets for proxy registry'() {
+    void 'deploys additional image pull secrets for proxy registry'() {
         config['registry']['createImagePullSecrets'] = true
         config['registry']['twoRegistries'] = true
         config['registry']['proxyUrl'] = 'proxy-url'
diff --git a/src/test/groovy/com/cloudogu/gitops/features/ExternalSecretsOperatorTest.groovy b/src/test/groovy/com/cloudogu/gitops/features/ExternalSecretsOperatorTest.groovy
@@ -159,7 +159,6 @@ class ExternalSecretsOperatorTest {
     @Test
     void 'deploys image pull secrets for proxy registry'() {
         config['registry']['createImagePullSecrets'] = true
-        config['registry']['twoRegistries'] = true
         config['registry']['proxyUrl'] = 'proxy-url'
         config['registry']['proxyUsername'] = 'proxy-user'
         config['registry']['proxyPassword'] = 'proxy-pw'
diff --git a/src/test/groovy/com/cloudogu/gitops/features/IngressNginxTest.groovy b/src/test/groovy/com/cloudogu/gitops/features/IngressNginxTest.groovy
@@ -3,7 +3,6 @@ package com.cloudogu.gitops.features
 import com.cloudogu.gitops.config.Configuration
 import com.cloudogu.gitops.features.deployment.DeploymentStrategy
 import com.cloudogu.gitops.utils.AirGappedUtils
-import com.cloudogu.gitops.utils.CommandExecutorForTest
 import com.cloudogu.gitops.utils.FileSystemUtils
 import com.cloudogu.gitops.utils.K8sClientForTest
 import groovy.yaml.YamlSlurper
@@ -52,7 +51,6 @@ class IngressNginxTest {
             ],
     ]
 
-    CommandExecutorForTest k8sCommandExecutor = new CommandExecutorForTest()
     Path temporaryYamlFile
     FileSystemUtils fileSystemUtils = new FileSystemUtils()
     DeploymentStrategy deploymentStrategy = mock(DeploymentStrategy)
@@ -169,7 +167,6 @@ class IngressNginxTest {
     @Test
     void 'deploys image pull secrets for proxy registry'() {
         config['registry']['createImagePullSecrets'] = true
-        config['registry']['twoRegistries'] = true
         config['registry']['proxyUrl'] = 'proxy-url'
         config['registry']['proxyUsername'] = 'proxy-user'
         config['registry']['proxyPassword'] = 'proxy-pw'
diff --git a/src/test/groovy/com/cloudogu/gitops/features/MailhogTest.groovy b/src/test/groovy/com/cloudogu/gitops/features/MailhogTest.groovy
@@ -3,7 +3,6 @@ package com.cloudogu.gitops.features
 import com.cloudogu.gitops.config.Configuration
 import com.cloudogu.gitops.features.deployment.DeploymentStrategy
 import com.cloudogu.gitops.utils.AirGappedUtils
-import com.cloudogu.gitops.utils.CommandExecutorForTest
 import com.cloudogu.gitops.utils.FileSystemUtils
 import com.cloudogu.gitops.utils.K8sClientForTest
 import groovy.yaml.YamlSlurper
@@ -22,8 +21,7 @@ class MailhogTest {
 
     Map config = [
             registry   : [
-                    createImagePullSecret: false,
-                    twoRegistries        : false
+                    createImagePullSecrets: false,
             ],
             application: [
                     username    : 'abc',
@@ -53,7 +51,6 @@ class MailhogTest {
     DeploymentStrategy deploymentStrategy = mock(DeploymentStrategy)
     AirGappedUtils airGappedUtils = mock(AirGappedUtils)
     Path temporaryYamlFile = null
-    CommandExecutorForTest k8sCommandExecutor = new CommandExecutorForTest()
     FileSystemUtils fileSystemUtils = new FileSystemUtils()
     K8sClientForTest k8sClient = new K8sClientForTest(config)
 
@@ -200,7 +197,6 @@ class MailhogTest {
     @Test
     void 'deploys image pull secrets for proxy registry'() {
         config['registry']['createImagePullSecrets'] = true
-        config['registry']['twoRegistries'] = true
         config['registry']['proxyUrl'] = 'proxy-url'
         config['registry']['proxyUsername'] = 'proxy-user'
         config['registry']['proxyPassword'] = 'proxy-pw'
diff --git a/src/test/groovy/com/cloudogu/gitops/features/VaultTest.groovy b/src/test/groovy/com/cloudogu/gitops/features/VaultTest.groovy
@@ -232,7 +232,6 @@ class VaultTest {
     @Test
     void 'deploys image pull secrets for proxy registry'() {
         config['registry']['createImagePullSecrets'] = true
-        config['registry']['twoRegistries'] = true
         config['registry']['proxyUrl'] = 'proxy-url'
         config['registry']['proxyUsername'] = 'proxy-user'
         config['registry']['proxyPassword'] = 'proxy-pw'
diff --git a/src/test/groovy/com/cloudogu/gitops/features/argocd/ArgoCDTest.groovy b/src/test/groovy/com/cloudogu/gitops/features/argocd/ArgoCDTest.groovy
@@ -59,7 +59,7 @@ class ArgoCDTest {
             images      : buildImages + [petclinic: 'petclinic-value'],
             registry    : [
                     twoRegistries: false,
-                    createImagePullSecrets : false
+                    createImagePullSecrets: false
             ],
             repositories: [
                     springBootHelmChart: [

Original file line number	Diff line number	Diff line change
`@@ -97,7 +97,7 @@ node('high-cpu') {`
`97`	`97`	`.inside("-e KUBECONFIG=${env.WORKSPACE}/.kube/config " +`
`98`	`98`	`" --network=host --entrypoint=''") {`
`99`	`99`	`sh "/app/apply-ng --yes --trace --internal-registry-port=${registryPort} " +`
`100`		`- "--argocd --monitoring --vault=dev --ingress-nginx --mailhog"`
	`100`	`+ "--argocd --monitoring --vault=dev --ingress-nginx --mailhog --base-url=http://localhost"`
`101`	`101`	`}`
`102`	`102`	`}`
`103`	`103`	`}`