Skip to content

Commit 378f840

Browse files
committed
Create new namespace pull secret based on namespace pull robot account
which is granted read permisssions for all ImageRepositories in the namespace, namespace pull secret is also linked to component build SA and integration SA, new annotation 'image-controller.appstudio.redhat.com/namespace-pull-secret-ensured' is introduced as well, which is set to 'false' after namespace pull secret is created, when missing it will force to create namespace pull robot account and namespace secret, component linking check is based now only on component label, as new model won't have anymore application STONEBLD-4018 Signed-off-by: Robert Cerven <rcerven@redhat.com>
1 parent 3f8501f commit 378f840

23 files changed

+1099
-357
lines changed

api/v1alpha1/imagerepository_types.go

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -64,6 +64,9 @@ type ImageCredentials struct {
6464
// Refreshes both, push and pull tokens.
6565
// The field gets cleared after the refresh.
6666
RegenerateToken *bool `json:"regenerate-token,omitempty"`
67+
// RegenerateNamespacePullToken defines a request to refresh namespace pull robot credentials.
68+
// The field gets cleared after the refresh.
69+
RegenerateNamespacePullToken *bool `json:"regenerate-namespace-pull-token,omitempty"`
6770
// VerifyLinking defines a request to verify and fix
6871
// secret linking in pipeline service account.
6972
// The field gets cleared after fixing.

api/v1alpha1/zz_generated.deepcopy.go

Lines changed: 5 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

cmd/coverage_init.go

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,4 +7,3 @@ package main
77
// from the running binary during E2E tests.
88

99
import _ "github.com/konflux-ci/coverport/instrumentation/go" // starts coverage server via init()
10-

cmd/main.go

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -47,11 +47,11 @@ import (
4747
"sigs.k8s.io/controller-runtime/pkg/webhook"
4848

4949
"github.com/go-logr/logr"
50+
applicationapiv1alpha1 "github.com/konflux-ci/application-api/api/v1alpha1"
5051
imagerepositoryv1alpha1 "github.com/konflux-ci/image-controller/api/v1alpha1"
5152
controllers "github.com/konflux-ci/image-controller/internal/controller"
5253
controllermetrics "github.com/konflux-ci/image-controller/pkg/metrics"
5354
"github.com/konflux-ci/image-controller/pkg/quay"
54-
appstudioredhatcomv1alpha1 "github.com/redhat-appstudio/application-api/api/v1alpha1"
5555
// +kubebuilder:scaffold:imports
5656
)
5757

@@ -69,7 +69,7 @@ var (
6969
func init() {
7070
utilruntime.Must(clientgoscheme.AddToScheme(scheme))
7171

72-
utilruntime.Must(appstudioredhatcomv1alpha1.AddToScheme(scheme))
72+
utilruntime.Must(applicationapiv1alpha1.AddToScheme(scheme))
7373
utilruntime.Must(imagerepositoryv1alpha1.AddToScheme(scheme))
7474
// +kubebuilder:scaffold:scheme
7575
}

config/crd/bases/appstudio.redhat.com_imagerepositories.yaml

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -49,6 +49,11 @@ spec:
4949
credentials:
5050
description: Credentials management.
5151
properties:
52+
regenerate-namespace-pull-token:
53+
description: |-
54+
RegenerateNamespacePullToken defines a request to refresh namespace pull robot credentials.
55+
The field gets cleared after the refresh.
56+
type: boolean
5257
regenerate-token:
5358
description: |-
5459
RegenerateToken defines a request to refresh image accessing credentials.

config/rbac/role.yaml

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,14 @@ rules:
1313
- list
1414
- update
1515
- watch
16+
- apiGroups:
17+
- ""
18+
resources:
19+
- namespaces
20+
verbs:
21+
- get
22+
- list
23+
- watch
1624
- apiGroups:
1725
- ""
1826
resources:

go.mod

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -7,10 +7,11 @@ toolchain go1.24.6
77
require (
88
github.com/go-logr/logr v1.4.3
99
github.com/h2non/gock v1.2.0
10+
github.com/konflux-ci/application-api v0.0.0-20251126155256-d24742e8b026
11+
github.com/konflux-ci/coverport/instrumentation/go v0.0.0-20251127103713-95b5b5e04a62
1012
github.com/onsi/ginkgo/v2 v2.26.0
1113
github.com/onsi/gomega v1.38.2
1214
github.com/prometheus/client_golang v1.19.1
13-
github.com/redhat-appstudio/application-api v0.0.0-20231026192857-89515ad2504f
1415
go.uber.org/zap v1.27.0
1516
gotest.tools/v3 v3.5.2
1617
k8s.io/api v0.31.0
@@ -30,7 +31,6 @@ require (
3031
github.com/cespare/xxhash/v2 v2.3.0 // indirect
3132
github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
3233
github.com/emicklei/go-restful/v3 v3.11.0 // indirect
33-
github.com/evanphx/json-patch v4.5.0+incompatible // indirect
3434
github.com/evanphx/json-patch/v5 v5.9.11 // indirect
3535
github.com/felixge/httpsnoop v1.0.4 // indirect
3636
github.com/fsnotify/fsnotify v1.7.0 // indirect
@@ -56,7 +56,6 @@ require (
5656
github.com/inconshreveable/mousetrap v1.1.0 // indirect
5757
github.com/josharian/intern v1.0.0 // indirect
5858
github.com/json-iterator/go v1.1.12 // indirect
59-
github.com/konflux-ci/coverport/instrumentation/go v0.0.0-20251127103713-95b5b5e04a62 // indirect
6059
github.com/mailru/easyjson v0.7.7 // indirect
6160
github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
6261
github.com/modern-go/reflect2 v1.0.2 // indirect

go.sum

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -20,8 +20,8 @@ github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1
2020
github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
2121
github.com/emicklei/go-restful/v3 v3.11.0 h1:rAQeMHw1c7zTmncogyy8VvRZwtkmkZ4FxERmMY4rD+g=
2222
github.com/emicklei/go-restful/v3 v3.11.0/go.mod h1:6n3XBCmQQb25CM2LCACGz8ukIrRry+4bhvbpWn3mrbc=
23-
github.com/evanphx/json-patch v4.5.0+incompatible h1:ouOWdg56aJriqS0huScTkVXPC5IcNrDCXZ6OoTAWu7M=
24-
github.com/evanphx/json-patch v4.5.0+incompatible/go.mod h1:50XU6AFN0ol/bzJsmQLiYLvXMP4fmwYFNcr97nuDLSk=
23+
github.com/evanphx/json-patch v0.5.2 h1:xVCHIVMUu1wtM/VkR9jVZ45N3FhZfYMMYGorLCR8P3k=
24+
github.com/evanphx/json-patch v0.5.2/go.mod h1:ZWS5hhDbVDyob71nXKNL0+PWn6ToqBHMikGIFbs31qQ=
2525
github.com/evanphx/json-patch/v5 v5.9.11 h1:/8HVnzMq13/3x9TPvjG08wUGqBTmZBsCWzjTM0wiaDU=
2626
github.com/evanphx/json-patch/v5 v5.9.11/go.mod h1:3j+LviiESTElxA4p3EMKAB9HXj3/XEtnUf6OZxqIQTM=
2727
github.com/felixge/httpsnoop v1.0.4 h1:NFTV2Zj1bL4mc9sqWACXbQFVBBg2W3GPvqp8/ESS2Wg=
@@ -92,6 +92,8 @@ github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnr
9292
github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo=
9393
github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8=
9494
github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
95+
github.com/konflux-ci/application-api v0.0.0-20251126155256-d24742e8b026 h1:Y6oKDSxmDY7JiNsrPm0ZRUcW+9cv20B71DuitI3sl28=
96+
github.com/konflux-ci/application-api v0.0.0-20251126155256-d24742e8b026/go.mod h1:948Z+a1IbfRT0RtoHzWWSN9YEucSbMJTHaMhz7dVICc=
9597
github.com/konflux-ci/coverport/instrumentation/go v0.0.0-20251127103713-95b5b5e04a62 h1:lMTed+H0EesSqsH3iQXtLoy/+SpbBT0BS1J0izeEtFM=
9698
github.com/konflux-ci/coverport/instrumentation/go v0.0.0-20251127103713-95b5b5e04a62/go.mod h1:WVMHU9A2464s/vjH1xOTm4LJDD4xP+VlEiU+KM0gkSU=
9799
github.com/kr/pretty v0.2.1/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
@@ -135,8 +137,6 @@ github.com/prometheus/common v0.55.0 h1:KEi6DK7lXW/m7Ig5i47x0vRzuBsHuvJdi5ee6Y3G
135137
github.com/prometheus/common v0.55.0/go.mod h1:2SECS4xJG1kd8XF9IcM1gMX6510RAEL65zxzNImwdc8=
136138
github.com/prometheus/procfs v0.15.1 h1:YagwOFzUgYfKKHX6Dr+sHT7km/hxC76UB0learggepc=
137139
github.com/prometheus/procfs v0.15.1/go.mod h1:fB45yRUv8NstnjriLhBQLuOUt+WW4BsoGhij/e3PBqk=
138-
github.com/redhat-appstudio/application-api v0.0.0-20231026192857-89515ad2504f h1:PoKf7gCV/g5blkzVlODkqeynmfIACcR7NqWF8eqnuec=
139-
github.com/redhat-appstudio/application-api v0.0.0-20231026192857-89515ad2504f/go.mod h1:YvckuKHe82eWloGk0/BpSw4YYG2owrGZAanztbOj3pQ=
140140
github.com/rogpeppe/go-internal v1.13.1 h1:KvO1DLK/DRN07sQ1LQKScxyZJuNnedQ5/wKSR38lUII=
141141
github.com/rogpeppe/go-internal v1.13.1/go.mod h1:uMEvuHeurkdAXX61udpOXGD/AzZDWNMNyH2VO9fmH0o=
142142
github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=

internal/controller/application_controller.go

Lines changed: 16 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -31,13 +31,13 @@ import (
3131
"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
3232
ctrllog "sigs.k8s.io/controller-runtime/pkg/log"
3333

34+
applicationapiv1alpha1 "github.com/konflux-ci/application-api/api/v1alpha1"
3435
imagerepositoryv1alpha1 "github.com/konflux-ci/image-controller/api/v1alpha1"
3536
l "github.com/konflux-ci/image-controller/pkg/logs"
36-
appstudioredhatcomv1alpha1 "github.com/redhat-appstudio/application-api/api/v1alpha1"
3737
)
3838

3939
const (
40-
IntegrationTestsServiceAccountName = "konflux-integration-runner"
40+
IntegrationServiceAccountName = "konflux-integration-runner"
4141
ApplicationSecretLinkToSaFinalizer = "application-secret-link-to-integration-tests-sa.appstudio.openshift.io/finalizer"
4242
)
4343

@@ -58,7 +58,7 @@ type ApplicationPullSecretCreator struct {
5858
// SetupWithManager sets up the controller with the Manager.
5959
func (r *ApplicationPullSecretCreator) SetupWithManager(mgr ctrl.Manager) error {
6060
return ctrl.NewControllerManagedBy(mgr).
61-
For(&appstudioredhatcomv1alpha1.Application{}).
61+
For(&applicationapiv1alpha1.Application{}).
6262
Complete(r)
6363
}
6464

@@ -73,7 +73,7 @@ func (r *ApplicationPullSecretCreator) Reconcile(ctx context.Context, req ctrl.R
7373
ctx = ctrllog.IntoContext(ctx, log)
7474

7575
// fetch the application instance
76-
application := &appstudioredhatcomv1alpha1.Application{}
76+
application := &applicationapiv1alpha1.Application{}
7777
err := r.Client.Get(ctx, req.NamespacedName, application)
7878
if err != nil {
7979
if errors.IsNotFound(err) {
@@ -132,7 +132,7 @@ func (r *ApplicationPullSecretCreator) Reconcile(ctx context.Context, req ctrl.R
132132
}
133133
}
134134

135-
if err := r.updateServiceAccountWithApplicationPullSecret(ctx, applicationPullSecretName, application.Namespace); err != nil {
135+
if err := r.updateIntegrationServiceAccountWithApplicationPullSecret(ctx, applicationPullSecretName, application.Namespace); err != nil {
136136
return ctrl.Result{}, err
137137
}
138138

@@ -147,7 +147,7 @@ func getApplicationPullSecretName(applicationName string) string {
147147
// getComponentIdsForApplication returns components id for all components owned by the application
148148
func (r *ApplicationPullSecretCreator) getComponentIdsForApplication(ctx context.Context, applicationId types.UID, namespace string) ([]types.UID, error) {
149149
log := ctrllog.FromContext(ctx)
150-
componentsList := &appstudioredhatcomv1alpha1.ComponentList{}
150+
componentsList := &applicationapiv1alpha1.ComponentList{}
151151
if err := r.Client.List(ctx, componentsList, &client.ListOptions{Namespace: namespace}); err != nil {
152152
log.Error(err, "failed to list components")
153153
return nil, err
@@ -198,7 +198,7 @@ func (r *ApplicationPullSecretCreator) getImageRepositoryPullSecretNamesForCompo
198198

199199
// createApplicationPullSecret creates or updates a single kubernetes.io/dockerconfigjson secret
200200
// by combining data from individual pull secrets.
201-
func (r *ApplicationPullSecretCreator) createApplicationPullSecret(ctx context.Context, applicationPullSecretName string, application *appstudioredhatcomv1alpha1.Application, individualSecretNames []string) error {
201+
func (r *ApplicationPullSecretCreator) createApplicationPullSecret(ctx context.Context, applicationPullSecretName string, application *applicationapiv1alpha1.Application, individualSecretNames []string) error {
202202
log := ctrllog.FromContext(ctx)
203203

204204
log.Info("Creating application pull secret", "secretName", applicationPullSecretName)
@@ -282,19 +282,19 @@ func (r *ApplicationPullSecretCreator) createApplicationPullSecret(ctx context.C
282282
return nil
283283
}
284284

285-
// udateServiceAccountWithApplicationPullSecret updates the ServiceAccount to include
285+
// updateIntegrationServiceAccountWithApplicationPullSecret updates the ServiceAccount to include
286286
// the application pull secret as an imagePullSecret and as a Secret
287-
func (r *ApplicationPullSecretCreator) updateServiceAccountWithApplicationPullSecret(ctx context.Context, applicationPullSecretName string, namespace string) error {
287+
func (r *ApplicationPullSecretCreator) updateIntegrationServiceAccountWithApplicationPullSecret(ctx context.Context, applicationPullSecretName string, namespace string) error {
288288
log := ctrllog.FromContext(ctx)
289289

290290
// fetch namespace SA
291291
namespaceServiceAccount := &corev1.ServiceAccount{}
292-
if err := r.Client.Get(ctx, types.NamespacedName{Name: IntegrationTestsServiceAccountName, Namespace: namespace}, namespaceServiceAccount); err != nil {
292+
if err := r.Client.Get(ctx, types.NamespacedName{Name: IntegrationServiceAccountName, Namespace: namespace}, namespaceServiceAccount); err != nil {
293293
if errors.IsNotFound(err) {
294-
log.Info("Namespace ServiceAccount not found", "serviceAccountName", IntegrationTestsServiceAccountName, "namespace", namespace)
294+
log.Info("Integration ServiceAccount not found", "serviceAccountName", IntegrationServiceAccountName, "namespace", namespace)
295295
return nil
296296
}
297-
log.Error(err, "failed to read namespace ServiceAccount", "serviceAccountName", IntegrationTestsServiceAccountName, "namespace", namespace, l.Action, l.ActionView)
297+
log.Error(err, "failed to read integration ServiceAccount", "serviceAccountName", IntegrationServiceAccountName, "namespace", namespace, l.Action, l.ActionView)
298298
return err
299299
}
300300

@@ -337,7 +337,7 @@ func (r *ApplicationPullSecretCreator) updateServiceAccountWithApplicationPullSe
337337
return nil
338338
}
339339

340-
func (r *ApplicationPullSecretCreator) doesApplicationPullSecretExist(ctx context.Context, applicationPullSecretName string, application *appstudioredhatcomv1alpha1.Application) (bool, error) {
340+
func (r *ApplicationPullSecretCreator) doesApplicationPullSecretExist(ctx context.Context, applicationPullSecretName string, application *applicationapiv1alpha1.Application) (bool, error) {
341341
log := ctrllog.FromContext(ctx)
342342

343343
applicationPullSecret := &corev1.Secret{}
@@ -355,15 +355,15 @@ func (r *ApplicationPullSecretCreator) doesApplicationPullSecretExist(ctx contex
355355

356356
// unlinkApplicationSecretFromIntegrationTestsSa ensures that the given secret is not linked with the integration tests service account.
357357
func (r *ApplicationPullSecretCreator) unlinkApplicationSecretFromIntegrationTestsSa(ctx context.Context, secretNameToRemove, namespace string) error {
358-
log := ctrllog.FromContext(ctx).WithValues("ServiceAccountName", IntegrationTestsServiceAccountName, "SecretName", secretNameToRemove)
358+
log := ctrllog.FromContext(ctx).WithValues("ServiceAccountName", IntegrationServiceAccountName, "SecretName", secretNameToRemove)
359359

360360
serviceAccount := &corev1.ServiceAccount{}
361-
err := r.Client.Get(ctx, types.NamespacedName{Name: IntegrationTestsServiceAccountName, Namespace: namespace}, serviceAccount)
361+
err := r.Client.Get(ctx, types.NamespacedName{Name: IntegrationServiceAccountName, Namespace: namespace}, serviceAccount)
362362
if err != nil {
363363
if errors.IsNotFound(err) {
364364
return nil
365365
}
366-
log.Error(err, "failed to read namespace service account", l.Action, l.ActionView)
366+
log.Error(err, "failed to read integration service account", l.Action, l.ActionView)
367367
return err
368368
}
369369

0 commit comments

Comments
 (0)