Add imagePullSecrets support to helm hook jobs (#741)

* Add imagePullSecrets support to helm hook jobs

Hook jobs lacked imagePullSecrets configuration on their pod specs,
causing image pull failures in environments using private registries
with authentication

* spire-server: post-install, pre-upgrade, post-upgrade, pre-delete
  hooks
* spire-oidc-discovery-provider: pre-delete hook
* spike-nexus: bootstrap hook
* spire: global imagePullSecrets

Fixes #649

Signed-off-by: Rowan Ruseler <[email protected]>

* Document global.imagePullSecrets parameter

Signed-off-by: Rowan Ruseler <[email protected]>

* Replaced non functioning 'or' with 'coalesce'

Signed-off-by: Rowan Ruseler <[email protected]>

---------

Signed-off-by: Rowan Ruseler <[email protected]>

charts/spire/README.md

@@ -273,6 +273,7 @@ Now you can interact with the Spire agent socket from your own application. The
 
 | Name                                             | Description                                                                                                                                                                                                                            | Value             |
 | ------------------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------- |
+| `global.imagePullSecrets`                        | Image pull secret names                                                                                                                                                                                                                | `[]`              |
 | `global.k8s.clusterDomain`                       | Cluster domain name configured for Spire install                                                                                                                                                                                       | `cluster.local`   |
 | `global.spire.bundleConfigMap`                   | A configmap containing the Spire bundle                                                                                                                                                                                                | `""`              |
 | `global.spire.clusterName`                       | The name of the k8s cluster for Spire install                                                                                                                                                                                          | `example-cluster` |

charts/spire/charts/spiffe-csi-driver/templates/daemonset.yaml

@@ -35,7 +35,7 @@ spec:
         {{- toYaml . | nindent 8 }}
         {{- end }}
     spec:
-      {{- with .Values.imagePullSecrets }}
+      {{- with (coalesce .Values.imagePullSecrets .Values.global.imagePullSecrets) }}
       imagePullSecrets:
         {{- toYaml . | nindent 8 }}
       {{- end }}

charts/spire/charts/spiffe-oidc-discovery-provider/templates/deployment.yaml

@@ -34,7 +34,7 @@ spec:
         {{- toYaml . | nindent 8 }}
         {{- end }}
     spec:
-      {{- with .Values.imagePullSecrets }}
+      {{- with (coalesce .Values.imagePullSecrets .Values.global.imagePullSecrets) }}
       imagePullSecrets:
         {{- toYaml . | nindent 8 }}
       {{- end }}

charts/spire/charts/spiffe-oidc-discovery-provider/templates/pre-delete-hook.yaml

@@ -57,6 +57,10 @@ spec:
       name: {{ include "spiffe-oidc-discovery-provider.fullname" . }}-pre-delete
     spec:
       restartPolicy: Never
+      {{- with (coalesce .Values.imagePullSecrets .Values.global.imagePullSecrets) }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
       serviceAccountName: {{ include "spiffe-oidc-discovery-provider.serviceAccountName" . }}-pre-delete
       securityContext:
         {{- include "spire-lib.podsecuritycontext" . | nindent 8 }}

charts/spire/charts/spike-keeper/templates/statefulset.yaml

@@ -19,7 +19,7 @@ spec:
         release-namespace: {{ .Release.Namespace }}
         component: spike-keeper
     spec:
-      {{- with .Values.imagePullSecrets }}
+      {{- with (coalesce .Values.imagePullSecrets .Values.global.imagePullSecrets) }}
       imagePullSecrets:
         {{- toYaml . | nindent 8 }}
       {{- end }}

charts/spire/charts/spike-nexus/templates/bootstrap-hook.yaml

@@ -68,6 +68,10 @@ spec:
         component: spike-bootstrap
     spec:
       restartPolicy: Never
+      {{- with (coalesce .Values.imagePullSecrets .Values.global.imagePullSecrets) }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
       serviceAccountName: {{ include "spike-nexus.serviceAccountName" . }}-bootstrap
       securityContext:
         {{- include "spire-lib.podsecuritycontext" . | nindent 8 }}

charts/spire/charts/spike-nexus/templates/statefulset.yaml

@@ -18,7 +18,7 @@ spec:
         release-namespace: {{ .Release.Namespace }}
         component: spike-nexus
     spec:
-      {{- with .Values.imagePullSecrets }}
+      {{- with (coalesce .Values.imagePullSecrets .Values.global.imagePullSecrets) }}
       imagePullSecrets:
         {{- toYaml . | nindent 8 }}
       {{- end }}

charts/spire/charts/spike-pilot/templates/deployment.yaml

@@ -18,7 +18,7 @@ spec:
         release-namespace: {{ .Release.Namespace }}
         component: spike-pilot
     spec:
-      {{- with .Values.imagePullSecrets }}
+      {{- with (coalesce .Values.imagePullSecrets .Values.global.imagePullSecrets) }}
       imagePullSecrets:
         {{- toYaml . | nindent 8 }}
       {{- end }}

charts/spire/charts/spire-agent/templates/daemonset.yaml

@@ -75,7 +75,7 @@ spec:
           {{- toYaml . | nindent 8 }}
         {{- end }}
     spec:
-      {{- with .Values.imagePullSecrets }}
+      {{- with (coalesce .Values.imagePullSecrets .Values.global.imagePullSecrets) }}
       imagePullSecrets:
         {{- toYaml . | nindent 8 }}
       {{- end }}

charts/spire/charts/spire-server/templates/post-install-hook.yaml

@@ -63,6 +63,10 @@ spec:
         {{- toYaml . | nindent 8 }}
       {{- end }}
       restartPolicy: Never
+      {{- with (coalesce .Values.imagePullSecrets .Values.global.imagePullSecrets) }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
       serviceAccountName: {{ include "spire-server.serviceAccountName" . }}-post-install
       securityContext:
         {{- include "spire-lib.podsecuritycontext" . | nindent 8 }}

charts/spire/charts/spire-server/templates/post-upgrade-hook.yaml

@@ -63,6 +63,10 @@ spec:
         {{- toYaml . | nindent 8 }}
       {{- end }}
       restartPolicy: Never
+      {{- with (coalesce .Values.imagePullSecrets .Values.global.imagePullSecrets) }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
       serviceAccountName: {{ include "spire-server.serviceAccountName" . }}-post-upgrade
       securityContext:
         {{- include "spire-lib.podsecuritycontext" . | nindent 8 }}

charts/spire/charts/spire-server/templates/pre-delete-hook.yaml

@@ -66,6 +66,10 @@ spec:
         {{- toYaml . | nindent 8 }}
       {{- end }}
       restartPolicy: Never
+      {{- with (coalesce .Values.imagePullSecrets .Values.global.imagePullSecrets) }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
       serviceAccountName: {{ include "spire-server.serviceAccountName" . }}-pre-delete
       securityContext:
         {{- include "spire-lib.podsecuritycontext" . | nindent 8 }}

charts/spire/charts/spire-server/templates/pre-upgrade-hook.yaml

@@ -63,6 +63,10 @@ spec:
         {{- toYaml . | nindent 8 }}
       {{- end }}
       restartPolicy: Never
+      {{- with (coalesce .Values.imagePullSecrets .Values.global.imagePullSecrets) }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
       serviceAccountName: {{ include "spire-server.serviceAccountName" . }}-pre-upgrade
       securityContext:
         {{- include "spire-lib.podsecuritycontext" . | nindent 8 }}

charts/spire/charts/spire-server/templates/server-resource.yaml

@@ -112,7 +112,7 @@ spec:
         {{- toYaml . | nindent 8 }}
         {{- end }}
     spec:
-      {{- with .Values.imagePullSecrets }}
+      {{- with (coalesce .Values.imagePullSecrets .Values.global.imagePullSecrets) }}
       imagePullSecrets:
         {{- toYaml . | nindent 8 }}
       {{- end }}

charts/spire/charts/tornjak-frontend/templates/deployment.yaml

@@ -15,7 +15,7 @@ spec:
       labels:
         {{- include "tornjak-frontend.selectorLabels" . | nindent 8 }}
     spec:
-      {{- with .Values.imagePullSecrets }}
+      {{- with (coalesce .Values.imagePullSecrets .Values.global.imagePullSecrets) }}
       imagePullSecrets:
         {{- toYaml . | nindent 8 }}
       {{- end }}

charts/spire/values.yaml

@@ -5,6 +5,9 @@
 ## Note: the parameter values specified here will override the chart level values for these parameters.
 ##
 global:
+  ## @param global.imagePullSecrets [array] Image pull secret names
+  imagePullSecrets: []
+
   k8s:
     ## @param global.k8s.clusterDomain Cluster domain name configured for Spire install
     clusterDomain: cluster.local