Mount all ServiceAccount imagePullSecrets to allow builds to read the run image #865
Conversation
… run image - The build's ServiceAccount's imagePullSecrets will be used to pull the builder image but, are unavailable to read the run image which is likely in the same registry. - This also supports multiple builder image pull secrets configured directly on the build resource. - Mounts the imagePullSecrets inside the rebase build pod.
matthewmcnew
requested review from
sambhav,
tylerphelan,
tomkennedy513 and
dumez-k
and removed request for
sambhav,
tylerphelan and
tomkennedy513
Codecov Report
@@ Coverage Diff @@
## main #865 +/- ##
==========================================
+ Coverage 67.68% 67.96% +0.27%
==========================================
Files 113 113
Lines 5019 5044 +25
==========================================
+ Hits 3397 3428 +31
+ Misses 1259 1254 -5
+ Partials 363 362 -1
Continue to review full report at Codecov.
|
| @@ -51,6 +52,7 @@ func init() { | |||
| flag.Var(&dockerCredentials, "basic-docker", "Basic authentication for docker of the form 'secretname=git.domain.com'") | |||
| flag.Var(&dockerCfgCredentials, "dockercfg", "Docker Cfg credentials in the form of the path to the credential") | |||
| flag.Var(&dockerConfigCredentials, "dockerconfig", "Docker Config JSON credentials in the form of the path to the credential") | |||
| flag.Var(&imagePullSecrets, "imagepull", "Builder Image pull credentials in the form of the path to the credential") | |||
There was a problem hiding this comment.
this appears to be a filename instead of the full path to the credential
There was a problem hiding this comment.
This is equivalent to the other path to credentials like dockercfg or dockerconfig and will attempt to read either a .dockerconfigjson or a .dockercfg file.
There was a problem hiding this comment.
maybe we should add to each then that it is the path inside the build-secrets dir
There was a problem hiding this comment.
not a big deal it just tripped me up for a second when i was looking at build_pod.go and saw we only passed in the name
There was a problem hiding this comment.
maybe we should add to each then that it is the path inside the build-secrets dir
Add what to each?
There was a problem hiding this comment.
update each description to be something like "..in the form of the path to the credential in the /var/build-secrets directory"
matthewmcnew
force-pushed
the
mount-image-pull-secrets
branch
from
edf6b69 to
d2816c9
Compare
Resolves: #858