Skip to content

Commit 57767e0

Browse files
schnattererk9ne257
authored and
nihussmann
committed
Implement first image pull secrets
Also add missing mailhog-image parameter ArgoCdApplicationStrategy: use valuesObject for easier debugging of our YAML objects. Co-authored-by: Aaron Frey <[email protected]>
1 parent 9f9b86f commit 57767e0

25 files changed

+492
-241
lines changed

‎applications/cluster-resources/mailhog-helm-values.ftl.yaml‎

Lines changed: 10 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,14 @@
1-
<#if image?has_content>
1+
<#assign DockerImageParser=statics['com.cloudogu.gitops.utils.DockerImageParser']>
2+
<#if config.features.mail.helm.image?has_content>
3+
<#assign imageObject = DockerImageParser.parse(config.features.mail.helm.image)>
24
image:
3-
repository: ${image?split(":")[0]}
4-
<#if image?contains(":")>
5-
tag: ${image?split(":")[1]}
6-
</#if>
5+
repository: ${imageObject.registryAndRepositoryAsString}
6+
<#if imageObject.tag?has_content> tag: ${imageObject.tag}</#if>
7+
</#if>
8+
9+
<#if config.registry.createImagePullSecrets?has_content && config.registry.twoRegistries?has_content>
10+
imagePullSecrets:
11+
- name: proxy-registry
712
</#if>
813

914
service:

‎applications/cluster-resources/secrets/external-secrets/values.ftl.yaml‎

Lines changed: 36 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
1-
<#if skipCrds == true>
1+
<#assign DockerImageParser=statics['com.cloudogu.gitops.utils.DockerImageParser']>
2+
<#if config.application.skipCrds == true>
23
installCRDs: false
34
</#if>
4-
5-
<#if podResources == true>
5+
<#if config.application.podResources == true>
66
certController:
77
resources:
88
limits:
@@ -20,12 +20,44 @@ webhook:
2020
requests:
2121
memory: 25Mi
2222
cpu: 50m
23-
23+
2424
resources:
2525
limits:
2626
memory: 80Mi
2727
cpu: 500m
2828
requests:
2929
memory: 40Mi
3030
cpu: 50m
31+
</#if>
32+
<#if config.registry.createImagePullSecrets?has_content && config.registry.twoRegistries?has_content>
33+
imagePullSecrets:
34+
- name: proxy-registry
35+
</#if>
36+
<#if config.features.secrets.externalSecrets.helm.image?has_content>
37+
<#assign imageObject = DockerImageParser.parse(config.features.secrets.externalSecrets.helm.image)>
38+
image:
39+
repository: ${imageObject.registryAndRepositoryAsString}
40+
tag: ${imageObject.tag}
41+
</#if>
42+
<#if config.features.secrets.externalSecrets.helm.certControllerImage?has_content>
43+
<#assign certControllerimageObject = DockerImageParser.parse(config.features.secrets.externalSecrets.helm.certControllerImage)>
44+
certController:
45+
image:
46+
repository: ${certControllerimageObject.registryAndRepositoryAsString}
47+
tag: ${certControllerimageObject.tag}
48+
<#if config.registry.createImagePullSecrets?has_content && config.registry.twoRegistries?has_content>
49+
imagePullSecrets:
50+
- name: proxy-registry
51+
</#if>
52+
</#if>
53+
<#if config.features.secrets.externalSecrets.helm.webhookImage?has_content>
54+
<#assign webhookImageObject = DockerImageParser.parse(config.features.secrets.externalSecrets.helm.webhookImage)>
55+
webhook:
56+
image:
57+
repository: ${webhookImageObject.registryAndRepositoryAsString}
58+
tag: ${webhookImageObject.tag}
59+
<#if config.registry.createImagePullSecrets?has_content && config.registry.twoRegistries?has_content>
60+
imagePullSecrets:
61+
- name: proxy-registry
62+
</#if>
3163
</#if>

‎applications/cluster-resources/secrets/vault/values.ftl.yaml‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
<#assign DockerImageParser=statics['com.cloudogu.gitops.utils.DockerImageParser']>
2+
ui:
3+
enabled: true
4+
externalPort: 80
5+
<#if config.application.remote>
6+
serviceType: "LoadBalancer"
7+
<#else>
8+
serviceType: NodePort
9+
serviceNodePort: 8200
10+
</#if>
11+
injector:
12+
enabled: false
13+
<#if config.registry.createImagePullSecrets?has_content && config.registry.twoRegistries?has_content>
14+
global:
15+
imagePullSecrets:
16+
- name: proxy-registry
17+
</#if>
18+
<#if config.features.secrets.vault.helm.image?has_content
19+
|| url?has_content
20+
|| config.application.podResources == true>
21+
server:
22+
</#if>
23+
<#if config.features.secrets.vault.helm.image?has_content>
24+
<#assign imageObject = DockerImageParser.parse(config.features.secrets.vault.helm.image)>
25+
image:
26+
repository: ${imageObject.registryAndRepositoryAsString}
27+
tag: ${imageObject.tag}
28+
</#if>
29+
<#if url?has_content>
30+
ingress:
31+
enabled: true
32+
hosts:
33+
- host: ${url.host}
34+
</#if>
35+
36+
<#if config.application.podResources == true>
37+
resources:
38+
limits:
39+
memory: 200Mi
40+
cpu: 500m
41+
requests:
42+
memory: 100Mi
43+
cpu: 50m
44+
</#if>

‎docs/configuration.schema.json‎

Lines changed: 17 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -270,7 +270,7 @@
270270
}
271271
},
272272
"additionalProperties" : false,
273-
"description" : "Config parameters for the internal Mail Server"
273+
"description" : "Config parameters for mail servers"
274274
},
275275
"monitoring" : {
276276
"type" : "object",
@@ -516,6 +516,10 @@
516516
"registry" : {
517517
"type" : "object",
518518
"properties" : {
519+
"createImagePullSecrets" : {
520+
"type" : "boolean",
521+
"description" : "Create image pull secrets for registry and proxy-registry for all GOP namespaces and helm charts. Use this if your cluster is not auto-provisioned with credentials for your private registries or if you configure individual helm images to be pulled from the proxy-registry that requires authentication."
522+
},
519523
"helm" : {
520524
"$ref" : "#/$defs/HelmConfig"
521525
},
@@ -533,19 +537,27 @@
533537
},
534538
"proxyPassword" : {
535539
"type" : "string",
536-
"description" : "Use with registry-proxy-url, added to Jenkins as credentials."
540+
"description" : "Use with registry-proxy-url, added to Jenkins as credentials and created as pull secrets, when create-image-pull-secrets is set."
537541
},
538542
"proxyUrl" : {
539543
"type" : "string",
540-
"description" : "The url of your proxy-registry. Used in pipelines to authorize pull base images. Use in conjunction with petclinic base image."
544+
"description" : "The url of your proxy-registry. Used in pipelines to authorize pull base images. Use in conjunction with petclinic base image. Used in helm charts when create-image-pull-secrets is set. Use in conjunction with helm.*image fields."
541545
},
542546
"proxyUsername" : {
543547
"type" : "string",
544-
"description" : "Use with registry-proxy-url, added to Jenkins as credentials."
548+
"description" : "Use with registry-proxy-url, added to Jenkins as credentials and created as pull secrets, when create-image-pull-secrets is set."
549+
},
550+
"readOnlyPassword" : {
551+
"type" : "string",
552+
"description" : "Optional alternative password for registry-url with read-only permissions that is used when create-image-pull-secrets is set."
553+
},
554+
"readOnlyUsername" : {
555+
"type" : "string",
556+
"description" : "Optional alternative username for registry-url with read-only permissions that is used when create-image-pull-secrets is set."
545557
},
546558
"url" : {
547559
"type" : "string",
548-
"description" : "The url of your external registry"
560+
"description" : "The url of your external registry, used for pushing images"
549561
},
550562
"username" : {
551563
"type" : "string",

‎docs/developers.md‎

Lines changed: 12 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -465,6 +465,9 @@ for operation in "${operations[@]}"; do
465465
done
466466
467467
skopeo copy docker://eclipse-temurin:11-jre-alpine --dest-creds Proxy:Proxy12345 --dest-tls-verify=false docker://localhost:30000/proxy/eclipse-temurin:11-jre-alpine
468+
skopeo copy docker://ghcr.io/cloudogu/mailhog:v1.0.1 --dest-creds Proxy:Proxy12345 --dest-tls-verify=false docker://localhost:30000/proxy/mailhog
469+
skopeo copy docker://ghcr.io/external-secrets/external-secrets:v0.9.16 --dest-creds Proxy:Proxy12345 --dest-tls-verify=false docker://localhost:30000/proxy/eso
470+
skopeo copy docker://hashicorp/vault:1.14.0 --dest-creds Proxy:Proxy12345 --dest-tls-verify=false docker://localhost:30000/proxy/vault
468471
```
469472
470473
* Deploy playground:
@@ -475,33 +478,25 @@ docker run --rm -t -u $(id -u) \
475478
--net=host \
476479
gitops-playground:dev \
477480
--yes --argocd --ingress-nginx --base-url=http://localhost \
481+
--vault=dev --monitoring --mailhog \
482+
--create-image-pull-secrets \
478483
--registry-url=localhost:30000 \
479484
--registry-path=registry \
480485
--registry-username=Registry \
481486
--registry-password=Registry12345 \
482487
--registry-proxy-url=localhost:30000 \
483488
--registry-proxy-username=Proxy \
484489
--registry-proxy-password=Proxy12345 \
485-
--petclinic-image=localhost:30000/proxy/eclipse-temurin:11-jre-alpine
490+
--petclinic-image=localhost:30000/proxy/eclipse-temurin:11-jre-alpine \
491+
--mailhog-image=localhost:30000/proxy/mailhog:latest \
492+
--vault-image=localhost:30000/proxy/vault:latest \
493+
--external-secrets-image=localhost:30000/proxy/eso:latest \
494+
--external-secrets-certcontroller-image=localhost:30000/proxy/eso:latest \
495+
--external-secrets-webhook-image=localhost:30000/proxy/eso:latest
486496
487497
# Or with config file --config-file=/config/gitops-playground.yaml
488498
```
489499
490-
To make the registry credentials know to kubernetes, apply the following:
491-
492-
```bash
493-
namespaces=("example-apps-production" "example-apps-staging")
494-
495-
for namespace in "${namespaces[@]}"; do
496-
kubectl create secret docker-registry regcred \
497-
-n $namespace \
498-
--docker-server=localhost:30000 \
499-
--docker-username=Registry\
500-
--docker-password=Registry12345
501-
kubectl patch serviceaccount default -n $namespace -p '{"imagePullSecrets": [{"name": "regcred"}]}'
502-
done
503-
```
504-
505500
The same using a config file looks like so:
506501
507502
```yaml
@@ -513,6 +508,7 @@ registry:
513508
registryUsername: Registry
514509
registryPassword: Registry12345
515510
registryPath: Registry
511+
createImagePullSecrets: true
516512
images:
517513
petclinic: localhost:30000/proxy/eclipse-temurin:11-jre-alpine
518514
```

‎src/main/groovy/com/cloudogu/gitops/cli/GitopsPlaygroundCli.groovy‎

Lines changed: 19 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -45,15 +45,19 @@ class GitopsPlaygroundCli implements Runnable {
4545
private String registryUsername
4646
@Option(names = ['--registry-password'], description = REGISTRY_PASSWORD_DESCRIPTION)
4747
private String registryPassword
48-
@Option(names = ['--registry-proxy-url'], description = 'The url of your external proxy-registry. Make sure to always use this with --registry-proxy-url')
48+
@Option(names = ['--registry-proxy-url'], description = REGISTRY_PROXY_URL_DESCRIPTION)
4949
private String registryProxyUrl
50-
@Option(names = ['--registry-proxy-path'], description = 'Optional when --registry-proxy-url is set')
51-
private String registryProxyPath
52-
@Option(names = ['--registry-proxy-username'], description = 'Optional when --registry-proxy-url is set')
50+
@Option(names = ['--registry-proxy-username'], description = REGISTRY_PROXY_USERNAME_DESCRIPTION)
5351
private String registryProxyUsername
54-
@Option(names = ['--registry-proxy-password'], description = 'Optional when --registry-proxy-url is set')
52+
@Option(names = ['--registry-proxy-password'], description = REGISTRY_PROXY_PASSWORD_DESCRIPTION)
5553
private String registryProxyPassword
56-
54+
@Option(names = ['--registry-username-read-only'], description = REGISTRY_USERNAME_RO_DESCRIPTION)
55+
private String registryUsernameReadOnly
56+
@Option(names = ['--registry-password-read-only'], description = REGISTRY_PASSWORD_RO_DESCRIPTION)
57+
private String registryPasswordReadOnly
58+
@Option(names = ['--create-image-pull-secrets'], description = REGISTRY_CREATE_IMAGE_PULL_SECRETS_DESCRIPTION)
59+
private Boolean createImagePullSecrets
60+
5761
// args group jenkins
5862
@Option(names = ['--jenkins-url'], description = JENKINS_URL_DESCRIPTION)
5963
private String jenkinsUrl
@@ -159,6 +163,8 @@ class GitopsPlaygroundCli implements Runnable {
159163
private String mailhogUrl
160164
@Option(names = ['--mailhog', '--mail'], description = MAILHOG_ENABLE_DESCRIPTION, scope = CommandLine.ScopeType.INHERIT)
161165
private Boolean mailhog
166+
@Option(names = ['--mailhog-image'], description = HELM_CONFIG_IMAGE_DESCRIPTION)
167+
private String mailhogImage
162168

163169
// condition check dependent parameters of external Mailserver
164170
@Option(names = ['--smtp-address'], description = SMTP_ADDRESS_DESCRIPTION)
@@ -388,9 +394,11 @@ class GitopsPlaygroundCli implements Runnable {
388394
username : registryUsername,
389395
password : registryPassword,
390396
proxyUrl : registryProxyUrl,
391-
proxyPath : registryProxyPath,
392397
proxyUsername : registryProxyUsername,
393398
proxyPassword : registryProxyPassword,
399+
readOnlyUsername : registryUsernameReadOnly,
400+
readOnlyPassword : registryPasswordReadOnly,
401+
createImagePullSecrets: createImagePullSecrets
394402
],
395403
jenkins : [
396404
url : jenkinsUrl,
@@ -451,7 +459,10 @@ class GitopsPlaygroundCli implements Runnable {
451459
smtpAddress : smtpAddress,
452460
smtpPort : smtpPort,
453461
smtpUser : smtpUser,
454-
smtpPassword : smtpPassword
462+
smtpPassword : smtpPassword,
463+
helm : [
464+
image: mailhogImage
465+
]
455466
],
456467
exampleApps: [
457468
petclinic: [

‎src/main/groovy/com/cloudogu/gitops/config/ApplicationConfigurator.groovy‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -43,6 +43,9 @@ class ApplicationConfigurator {
4343
proxyUrl : '',
4444
proxyUsername : '',
4545
proxyPassword : '',
46+
readOnlyUsername : '',
47+
readOnlyPassword : '',
48+
createImagePullSecrets: false,
4649
helm : [
4750
chart : 'docker-registry',
4851
repoURL: 'https://helm.twun.io',
@@ -317,6 +320,14 @@ class ApplicationConfigurator {
317320
k3d clusters. */
318321
newConfig.registry['url'] = "localhost:${newConfig.registry['internalPort']}"
319322
}
323+
324+
if (newConfig.registry['createImagePullSecrets']) {
325+
String username = newConfig.registry['readOnlyUsername'] ?: newConfig.registry['username']
326+
String password = newConfig.registry['readOnlyPassword'] ?: newConfig.registry['password']
327+
if (!username || !password) {
328+
throw new RuntimeException("createImagePullSecrets needs to be used with either registry username and password or the readOnly variants")
329+
}
330+
}
320331
}
321332

322333
Map setConfig(File configFile, boolean skipInternalConfig = false) {

‎src/main/groovy/com/cloudogu/gitops/config/ConfigConstants.groovy‎

Lines changed: 9 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -9,14 +9,18 @@ interface ConfigConstants {
99
// group registry
1010
String REGISTRY_DESCRIPTION = 'Config parameters for Registry'
1111
String REGISTRY_INTERNAL_PORT_DESCRIPTION = 'Port of registry registry. Ignored when a registry*url params are set'
12-
String REGISTRY_URL_DESCRIPTION = 'The url of your external registry'
12+
String REGISTRY_URL_DESCRIPTION = 'The url of your external registry, used for pushing images'
1313
String REGISTRY_PATH_DESCRIPTION = 'Optional when registry-url is set'
1414
String REGISTRY_USERNAME_DESCRIPTION = 'Optional when registry-url is set'
1515
String REGISTRY_PASSWORD_DESCRIPTION = 'Optional when registry-url is set'
1616

17-
String REGISTRY_PROXY_URL_DESCRIPTION = 'The url of your proxy-registry. Used in pipelines to authorize pull base images. Use in conjunction with petclinic base image.'
18-
String REGISTRY_PROXY_USERNAME_DESCRIPTION = 'Use with registry-proxy-url, added to Jenkins as credentials.'
19-
String REGISTRY_PROXY_PASSWORD_DESCRIPTION = 'Use with registry-proxy-url, added to Jenkins as credentials.'
17+
String REGISTRY_PROXY_URL_DESCRIPTION = 'The url of your proxy-registry. Used in pipelines to authorize pull base images. Use in conjunction with petclinic base image. Used in helm charts when create-image-pull-secrets is set. Use in conjunction with helm.*image fields.'
18+
String REGISTRY_PROXY_USERNAME_DESCRIPTION = 'Use with registry-proxy-url, added to Jenkins as credentials and created as pull secrets, when create-image-pull-secrets is set.'
19+
String REGISTRY_PROXY_PASSWORD_DESCRIPTION = 'Use with registry-proxy-url, added to Jenkins as credentials and created as pull secrets, when create-image-pull-secrets is set.'
20+
21+
String REGISTRY_USERNAME_RO_DESCRIPTION = 'Optional alternative username for registry-url with read-only permissions that is used when create-image-pull-secrets is set.'
22+
String REGISTRY_PASSWORD_RO_DESCRIPTION = 'Optional alternative password for registry-url with read-only permissions that is used when create-image-pull-secrets is set.'
23+
String REGISTRY_CREATE_IMAGE_PULL_SECRETS_DESCRIPTION = 'Create image pull secrets for registry and proxy-registry for all GOP namespaces and helm charts. Uses proxy-username, read-only-username or registry-username (in this order). Use this if your cluster is not auto-provisioned with credentials for your private registries or if you configure individual helm images to be pulled from the proxy-registry that requires authentication.'
2024

2125
String FEATURES_DESCRIPTION = 'Config parameters for features or tools'
2226

@@ -92,7 +96,7 @@ interface ConfigConstants {
9296
String VAULT_ENABLE_DESCRIPTION = "Installs Hashicorp vault and the external secrets operator. Possible values: dev, prod."
9397
String VAULT_URL_DESCRIPTION = 'Sets url for vault ui'
9498

95-
String MAILHOG_DESCRIPTION = 'Config parameters for the internal Mail Server'
99+
String MAIL_DESCRIPTION = 'Config parameters for mail servers'
96100
String MAILHOG_URL_DESCRIPTION = 'Sets url for MailHog'
97101
String MAILHOG_ENABLE_DESCRIPTION = 'Installs MailHog as Mail server.'
98102

‎src/main/groovy/com/cloudogu/gitops/config/schema/Schema.groovy‎

Lines changed: 10 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,10 @@
11
//file:noinspection unused
2-
package com.cloudogu.gitops.config.schema
2+
package com.cloudogu.gitops.config.schema
33

44
import com.fasterxml.jackson.annotation.JsonClassDescription
55
import com.fasterxml.jackson.annotation.JsonPropertyDescription
66

7-
import static com.cloudogu.gitops.config.ConfigConstants.*
8-
7+
import static com.cloudogu.gitops.config.ConfigConstants.*
98
/**
109
* The schema for the configuration file.
1110
* It is used to validate the passed yaml file.
@@ -70,6 +69,13 @@ class Schema {
7069
String proxyUsername = ""
7170
@JsonPropertyDescription(REGISTRY_PROXY_PASSWORD_DESCRIPTION)
7271
String proxyPassword = ""
72+
// Alternative set of credentials for url, used only for image pull secrets
73+
@JsonPropertyDescription(REGISTRY_USERNAME_RO_DESCRIPTION)
74+
String readOnlyUsername
75+
@JsonPropertyDescription(REGISTRY_PASSWORD_RO_DESCRIPTION)
76+
String readOnlyPassword
77+
@JsonPropertyDescription(REGISTRY_CREATE_IMAGE_PULL_SECRETS_DESCRIPTION)
78+
Boolean createImagePullSecrets
7379

7480
HelmConfig helm
7581
}
@@ -218,7 +224,7 @@ class Schema {
218224
static class FeaturesSchema {
219225
@JsonPropertyDescription(ARGOCD_DESCRIPTION)
220226
ArgoCDSchema argocd
221-
@JsonPropertyDescription(MAILHOG_DESCRIPTION)
227+
@JsonPropertyDescription(MAIL_DESCRIPTION)
222228
MailSchema mail
223229
@JsonPropertyDescription(MONITORING_DESCRIPTION)
224230
MonitoringSchema monitoring

0 commit comments

Comments
 (0)