From 75ffbd06f593712ac63615ac51bae3cd4741f938 Mon Sep 17 00:00:00 2001 From: Rowan Ruseler Date: Thu, 12 Feb 2026 00:16:16 +0100 Subject: [PATCH] Add imagePullSecrets support to helm hook jobs (#741) * Add imagePullSecrets support to helm hook jobs Hook jobs lacked imagePullSecrets configuration on their pod specs, causing image pull failures in environments using private registries with authentication * spire-server: post-install, pre-upgrade, post-upgrade, pre-delete hooks * spire-oidc-discovery-provider: pre-delete hook * spike-nexus: bootstrap hook * spire: global imagePullSecrets Fixes #649 Signed-off-by: Rowan Ruseler * Document global.imagePullSecrets parameter Signed-off-by: Rowan Ruseler * Replaced non functioning 'or' with 'coalesce' Signed-off-by: Rowan Ruseler --------- Signed-off-by: Rowan Ruseler --- charts/spire/README.md | 1 + .../spire/charts/spiffe-csi-driver/templates/daemonset.yaml | 2 +- .../spiffe-oidc-discovery-provider/templates/deployment.yaml | 2 +- .../templates/pre-delete-hook.yaml | 4 ++++ charts/spire/charts/spike-keeper/templates/statefulset.yaml | 2 +- charts/spire/charts/spike-nexus/templates/bootstrap-hook.yaml | 4 ++++ charts/spire/charts/spike-nexus/templates/statefulset.yaml | 2 +- charts/spire/charts/spike-pilot/templates/deployment.yaml | 2 +- charts/spire/charts/spire-agent/templates/daemonset.yaml | 2 +- .../charts/spire-server/templates/post-install-hook.yaml | 4 ++++ .../charts/spire-server/templates/post-upgrade-hook.yaml | 4 ++++ .../spire/charts/spire-server/templates/pre-delete-hook.yaml | 4 ++++ .../spire/charts/spire-server/templates/pre-upgrade-hook.yaml | 4 ++++ .../spire/charts/spire-server/templates/server-resource.yaml | 2 +- .../spire/charts/tornjak-frontend/templates/deployment.yaml | 2 +- charts/spire/values.yaml | 3 +++ 16 files changed, 36 insertions(+), 8 deletions(-) diff --git a/charts/spire/README.md b/charts/spire/README.md index 75aac9d..7f85487 100644 --- a/charts/spire/README.md +++ b/charts/spire/README.md @@ -273,6 +273,7 @@ Now you can interact with the Spire agent socket from your own application. The | Name | Description | Value | | ------------------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------- | +| `global.imagePullSecrets` | Image pull secret names | `[]` | | `global.k8s.clusterDomain` | Cluster domain name configured for Spire install | `cluster.local` | | `global.spire.bundleConfigMap` | A configmap containing the Spire bundle | `""` | | `global.spire.clusterName` | The name of the k8s cluster for Spire install | `example-cluster` | diff --git a/charts/spire/charts/spiffe-csi-driver/templates/daemonset.yaml b/charts/spire/charts/spiffe-csi-driver/templates/daemonset.yaml index 6740bad..54ceb44 100644 --- a/charts/spire/charts/spiffe-csi-driver/templates/daemonset.yaml +++ b/charts/spire/charts/spiffe-csi-driver/templates/daemonset.yaml @@ -35,7 +35,7 @@ spec: {{- toYaml . | nindent 8 }} {{- end }} spec: - {{- with .Values.imagePullSecrets }} + {{- with (coalesce .Values.imagePullSecrets .Values.global.imagePullSecrets) }} imagePullSecrets: {{- toYaml . | nindent 8 }} {{- end }} diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/deployment.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/deployment.yaml index 99c4a54..044a3b7 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/deployment.yaml +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/deployment.yaml @@ -34,7 +34,7 @@ spec: {{- toYaml . | nindent 8 }} {{- end }} spec: - {{- with .Values.imagePullSecrets }} + {{- with (coalesce .Values.imagePullSecrets .Values.global.imagePullSecrets) }} imagePullSecrets: {{- toYaml . | nindent 8 }} {{- end }} diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/pre-delete-hook.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/pre-delete-hook.yaml index dd64a4a..82986de 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/pre-delete-hook.yaml +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/pre-delete-hook.yaml @@ -57,6 +57,10 @@ spec: name: {{ include "spiffe-oidc-discovery-provider.fullname" . }}-pre-delete spec: restartPolicy: Never + {{- with (coalesce .Values.imagePullSecrets .Values.global.imagePullSecrets) }} + imagePullSecrets: + {{- toYaml . | nindent 8 }} + {{- end }} serviceAccountName: {{ include "spiffe-oidc-discovery-provider.serviceAccountName" . }}-pre-delete securityContext: {{- include "spire-lib.podsecuritycontext" . | nindent 8 }} diff --git a/charts/spire/charts/spike-keeper/templates/statefulset.yaml b/charts/spire/charts/spike-keeper/templates/statefulset.yaml index 6af56c0..40f7e3c 100644 --- a/charts/spire/charts/spike-keeper/templates/statefulset.yaml +++ b/charts/spire/charts/spike-keeper/templates/statefulset.yaml @@ -19,7 +19,7 @@ spec: release-namespace: {{ .Release.Namespace }} component: spike-keeper spec: - {{- with .Values.imagePullSecrets }} + {{- with (coalesce .Values.imagePullSecrets .Values.global.imagePullSecrets) }} imagePullSecrets: {{- toYaml . | nindent 8 }} {{- end }} diff --git a/charts/spire/charts/spike-nexus/templates/bootstrap-hook.yaml b/charts/spire/charts/spike-nexus/templates/bootstrap-hook.yaml index b272d44..c46cb3a 100644 --- a/charts/spire/charts/spike-nexus/templates/bootstrap-hook.yaml +++ b/charts/spire/charts/spike-nexus/templates/bootstrap-hook.yaml @@ -68,6 +68,10 @@ spec: component: spike-bootstrap spec: restartPolicy: Never + {{- with (coalesce .Values.imagePullSecrets .Values.global.imagePullSecrets) }} + imagePullSecrets: + {{- toYaml . | nindent 8 }} + {{- end }} serviceAccountName: {{ include "spike-nexus.serviceAccountName" . }}-bootstrap securityContext: {{- include "spire-lib.podsecuritycontext" . | nindent 8 }} diff --git a/charts/spire/charts/spike-nexus/templates/statefulset.yaml b/charts/spire/charts/spike-nexus/templates/statefulset.yaml index 638998a..2483172 100644 --- a/charts/spire/charts/spike-nexus/templates/statefulset.yaml +++ b/charts/spire/charts/spike-nexus/templates/statefulset.yaml @@ -18,7 +18,7 @@ spec: release-namespace: {{ .Release.Namespace }} component: spike-nexus spec: - {{- with .Values.imagePullSecrets }} + {{- with (coalesce .Values.imagePullSecrets .Values.global.imagePullSecrets) }} imagePullSecrets: {{- toYaml . | nindent 8 }} {{- end }} diff --git a/charts/spire/charts/spike-pilot/templates/deployment.yaml b/charts/spire/charts/spike-pilot/templates/deployment.yaml index f6f8a8f..1417fa0 100644 --- a/charts/spire/charts/spike-pilot/templates/deployment.yaml +++ b/charts/spire/charts/spike-pilot/templates/deployment.yaml @@ -18,7 +18,7 @@ spec: release-namespace: {{ .Release.Namespace }} component: spike-pilot spec: - {{- with .Values.imagePullSecrets }} + {{- with (coalesce .Values.imagePullSecrets .Values.global.imagePullSecrets) }} imagePullSecrets: {{- toYaml . | nindent 8 }} {{- end }} diff --git a/charts/spire/charts/spire-agent/templates/daemonset.yaml b/charts/spire/charts/spire-agent/templates/daemonset.yaml index 4954d50..4122fab 100644 --- a/charts/spire/charts/spire-agent/templates/daemonset.yaml +++ b/charts/spire/charts/spire-agent/templates/daemonset.yaml @@ -75,7 +75,7 @@ spec: {{- toYaml . | nindent 8 }} {{- end }} spec: - {{- with .Values.imagePullSecrets }} + {{- with (coalesce .Values.imagePullSecrets .Values.global.imagePullSecrets) }} imagePullSecrets: {{- toYaml . | nindent 8 }} {{- end }} diff --git a/charts/spire/charts/spire-server/templates/post-install-hook.yaml b/charts/spire/charts/spire-server/templates/post-install-hook.yaml index e432a52..ed00051 100644 --- a/charts/spire/charts/spire-server/templates/post-install-hook.yaml +++ b/charts/spire/charts/spire-server/templates/post-install-hook.yaml @@ -63,6 +63,10 @@ spec: {{- toYaml . | nindent 8 }} {{- end }} restartPolicy: Never + {{- with (coalesce .Values.imagePullSecrets .Values.global.imagePullSecrets) }} + imagePullSecrets: + {{- toYaml . | nindent 8 }} + {{- end }} serviceAccountName: {{ include "spire-server.serviceAccountName" . }}-post-install securityContext: {{- include "spire-lib.podsecuritycontext" . | nindent 8 }} diff --git a/charts/spire/charts/spire-server/templates/post-upgrade-hook.yaml b/charts/spire/charts/spire-server/templates/post-upgrade-hook.yaml index a4583a2..fb42cfb 100644 --- a/charts/spire/charts/spire-server/templates/post-upgrade-hook.yaml +++ b/charts/spire/charts/spire-server/templates/post-upgrade-hook.yaml @@ -63,6 +63,10 @@ spec: {{- toYaml . | nindent 8 }} {{- end }} restartPolicy: Never + {{- with (coalesce .Values.imagePullSecrets .Values.global.imagePullSecrets) }} + imagePullSecrets: + {{- toYaml . | nindent 8 }} + {{- end }} serviceAccountName: {{ include "spire-server.serviceAccountName" . }}-post-upgrade securityContext: {{- include "spire-lib.podsecuritycontext" . | nindent 8 }} diff --git a/charts/spire/charts/spire-server/templates/pre-delete-hook.yaml b/charts/spire/charts/spire-server/templates/pre-delete-hook.yaml index e06cbd8..20b0666 100644 --- a/charts/spire/charts/spire-server/templates/pre-delete-hook.yaml +++ b/charts/spire/charts/spire-server/templates/pre-delete-hook.yaml @@ -66,6 +66,10 @@ spec: {{- toYaml . | nindent 8 }} {{- end }} restartPolicy: Never + {{- with (coalesce .Values.imagePullSecrets .Values.global.imagePullSecrets) }} + imagePullSecrets: + {{- toYaml . | nindent 8 }} + {{- end }} serviceAccountName: {{ include "spire-server.serviceAccountName" . }}-pre-delete securityContext: {{- include "spire-lib.podsecuritycontext" . | nindent 8 }} diff --git a/charts/spire/charts/spire-server/templates/pre-upgrade-hook.yaml b/charts/spire/charts/spire-server/templates/pre-upgrade-hook.yaml index 84c6760..18a5bc6 100644 --- a/charts/spire/charts/spire-server/templates/pre-upgrade-hook.yaml +++ b/charts/spire/charts/spire-server/templates/pre-upgrade-hook.yaml @@ -63,6 +63,10 @@ spec: {{- toYaml . | nindent 8 }} {{- end }} restartPolicy: Never + {{- with (coalesce .Values.imagePullSecrets .Values.global.imagePullSecrets) }} + imagePullSecrets: + {{- toYaml . | nindent 8 }} + {{- end }} serviceAccountName: {{ include "spire-server.serviceAccountName" . }}-pre-upgrade securityContext: {{- include "spire-lib.podsecuritycontext" . | nindent 8 }} diff --git a/charts/spire/charts/spire-server/templates/server-resource.yaml b/charts/spire/charts/spire-server/templates/server-resource.yaml index f790eff..b8e7422 100644 --- a/charts/spire/charts/spire-server/templates/server-resource.yaml +++ b/charts/spire/charts/spire-server/templates/server-resource.yaml @@ -112,7 +112,7 @@ spec: {{- toYaml . | nindent 8 }} {{- end }} spec: - {{- with .Values.imagePullSecrets }} + {{- with (coalesce .Values.imagePullSecrets .Values.global.imagePullSecrets) }} imagePullSecrets: {{- toYaml . | nindent 8 }} {{- end }} diff --git a/charts/spire/charts/tornjak-frontend/templates/deployment.yaml b/charts/spire/charts/tornjak-frontend/templates/deployment.yaml index e70b5c0..9a4cfeb 100644 --- a/charts/spire/charts/tornjak-frontend/templates/deployment.yaml +++ b/charts/spire/charts/tornjak-frontend/templates/deployment.yaml @@ -15,7 +15,7 @@ spec: labels: {{- include "tornjak-frontend.selectorLabels" . | nindent 8 }} spec: - {{- with .Values.imagePullSecrets }} + {{- with (coalesce .Values.imagePullSecrets .Values.global.imagePullSecrets) }} imagePullSecrets: {{- toYaml . | nindent 8 }} {{- end }} diff --git a/charts/spire/values.yaml b/charts/spire/values.yaml index 1cff2cf..ceca886 100644 --- a/charts/spire/values.yaml +++ b/charts/spire/values.yaml @@ -5,6 +5,9 @@ ## Note: the parameter values specified here will override the chart level values for these parameters. ## global: + ## @param global.imagePullSecrets [array] Image pull secret names + imagePullSecrets: [] + k8s: ## @param global.k8s.clusterDomain Cluster domain name configured for Spire install clusterDomain: cluster.local