ROX-27209: Change image pull secret for operator deployments

stackrox · Dec 3, 2024 · c5834d2 · c5834d2
1 parent a886194
commit c5834d2
Show file tree

Hide file tree

Showing 9 changed files with 8 additions and 33 deletions.
diff --git a/dev/env/manifests/fleetshard-operator/07-serviceaccount.yaml b/dev/env/manifests/fleetshard-operator/07-serviceaccount.yaml
@@ -3,5 +3,3 @@ kind: ServiceAccount
 metadata:
   name: acs-fleetshard-operator
   namespace: "$ACSCS_NAMESPACE"
-imagePullSecrets:
-  - name: acs-fleetshard-operator
diff --git a/dev/env/manifests/fleetshard-operator/51-fleetshard-cr.yaml b/dev/env/manifests/fleetshard-operator/51-fleetshard-cr.yaml
@@ -29,8 +29,7 @@ spec:
     secretEncryption:
       type: "local"
     tenantImagePullSecret:
-      name: "fleetshard-sync"
-      key: "tenant-image-pull-secret"
+      create: false # created by create-imagepullsecrets script
     nodeSelector: null
     tolerations: null
     addonAutoUpgradeEnabled: false

diff --git a/dev/env/manifests/fleetshard-sync/01-fleetshard-sync-secrets.yaml b/dev/env/manifests/fleetshard-sync/01-fleetshard-sync-secrets.yaml
@@ -8,8 +8,6 @@ stringData:
   aws-access-key-id: "${AWS_ACCESS_KEY_ID}"
   aws-secret-access-key: "${AWS_SECRET_ACCESS_KEY}"
   telemetry-storage-key: "${TELEMETRY_STORAGE_KEY}"
-  tenant-image-pull-secret: |
-    ${TENANT_IMAGE_PULL_SECRET}
 ---
 apiVersion: v1
 kind: Secret

diff --git a/dev/env/scripts/bootstrap.sh b/dev/env/scripts/bootstrap.sh
@@ -38,7 +38,6 @@ wait_for_default_service_account "$ACSCS_NAMESPACE"
 if [[ "$INHERIT_IMAGEPULLSECRETS" == "true" ]]; then
     create-imagepullsecrets
     inject_ips "$ACSCS_NAMESPACE" "default" "quay-ips"
-    inject_ips "$STACKROX_OPERATOR_NAMESPACE" "default" "quay-ips"
 else
     log "Skipping creation of ImagePullSecrets because INHERIT_IMAGEPULLSECRETS is not true"
 fi

diff --git a/dev/env/scripts/create-imagepullsecrets b/dev/env/scripts/create-imagepullsecrets
@@ -69,15 +69,15 @@ function print_auth() {
 
 registry_auth="$(print_auth "$(mkauth "${username}" "${password}")")"
 
-log "Creating quay-ips image pull secret in namespace ${STACKROX_OPERATOR_NAMESPACE}"
+log "Creating rhacs-registry image pull secret in namespace ${STACKROX_OPERATOR_NAMESPACE}"
     resOperatorImage=$(
         cat <<EOF
 apiVersion: v1
 data:
   .dockerconfigjson: ${registry_auth}
 kind: Secret
 metadata:
-  name: quay-ips
+  name: rhacs-registry
   namespace: ${STACKROX_OPERATOR_NAMESPACE}
 type: kubernetes.io/dockerconfigjson
 EOF
@@ -98,17 +98,3 @@ type: kubernetes.io/dockerconfigjson
 EOF
 )
 echo "$res" | $KUBECTL -n "$ACSCS_NAMESPACE" apply -f -
-log "Creating acs-fleetshard-operator pull secret in namespace ${ACSCS_NAMESPACE}"
-res=$(
-    cat <<EOF
-apiVersion: v1
-data:
-  .dockerconfigjson: ${registry_auth}
-kind: Secret
-metadata:
-  name: acs-fleetshard-operator
-  namespace: $ACSCS_NAMESPACE
-type: kubernetes.io/dockerconfigjson
-EOF
-)
-echo "$res" | $KUBECTL -n "$ACSCS_NAMESPACE" apply -f -
diff --git a/dev/env/scripts/up.sh b/dev/env/scripts/up.sh
@@ -67,12 +67,6 @@ if [[ "$SPAWN_LOGGER" == "true" && -n "${LOG_DIR:-}" ]]; then
 fi
 
 log "Deploying fleetshard-sync"
-TENANT_IMAGE_PULL_SECRET=""
-if [[ "$INHERIT_IMAGEPULLSECRETS" == "true" ]]; then # pragma: allowlist secret
-    TENANT_IMAGE_PULL_SECRET=$($KUBECTL -n "$ACSCS_NAMESPACE" get secret quay-ips -o jsonpath="{.data['\.dockerconfigjson']}" | base64 -d)
-fi
-export TENANT_IMAGE_PULL_SECRET
-
 exec_fleetshard_sync.sh apply "${MANIFESTS_DIR}/fleetshard-sync"
 apply "${MANIFESTS_DIR}/fleetshard-operator"
 

diff --git a/dp-terraform/helm/rhacs-terraform/values.yaml b/dp-terraform/helm/rhacs-terraform/values.yaml
@@ -62,9 +62,9 @@ fleetshardSync:
   addonAutoUpgradeEnabled: true
   addonName: acs-fleetshard
   tenantImagePullSecret:
-    name: ""
+    name: rhacs-registry
     key: .dockerconfigjson
-    create: false
+    create: true
   printCentralUpdateDiff: false
   argoCdNamespace: openshift-gitops
 

diff --git a/...hard/pkg/central/charts/data/rhacs-operator/templates/rhacs-operator-service-account.yaml b/...hard/pkg/central/charts/data/rhacs-operator/templates/rhacs-operator-service-account.yaml
@@ -1,7 +1,7 @@
 apiVersion: v1
 kind: ServiceAccount
 imagePullSecrets:
-  - name: acs-fleetshard-operator
+  - name: rhacs-registry
 metadata:
   name: rhacs-operator-controller-manager
   namespace: {{ .Release.Namespace }}
diff --git a/fleetshard/pkg/central/operator/upgrade.go b/fleetshard/pkg/central/operator/upgrade.go
@@ -4,6 +4,8 @@ package operator
 import (
 	"context"
 	"fmt"
+	"strings"
+
 	"github.com/golang/glog"
 	"github.com/stackrox/acs-fleet-manager/fleetshard/pkg/central/charts"
 	"helm.sh/helm/v3/pkg/chartutil"
@@ -12,7 +14,6 @@ import (
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
 	ctrlClient "sigs.k8s.io/controller-runtime/pkg/client"
-	"strings"
 )
 
 const (