Where to put imagePullSecrets for mirror registry in linstorCluster resource ?

[pvbiesen]

Hi,

we're running an airgapped k8s cluster. Images are copied into a private registry. This registry requires authentication.

piraeus-operator version used : v2.8.0
k8s version : v1.31.4

For the operator creation, I use a kustomization to alter the image and add the imagePullSecrets to the manifests -- this works.

However, when I create a linstorCluster, I can only override the image repository, I see no place in the crd to add the imagePullSecrets.

apiVersion: piraeus.io/v1
kind: LinstorCluster
metadata:
  name: linstorecluster01
spec:
  nodeSelector:
    linstor.io/satellite: "yes"
  repository: private-registry.example.com/piraeusdatastore

How/where do I specify the imagePullSecrets in the linstorCluster resource ?

I am also assuming this overrides the base in config/manager/0_piraeus_datastore_images.yaml, but how does one do this for config/manager/0_sig_storage_images.yaml ?

Thanks in advance,

Peter.

[WanzenBug]

The way to do this is currently to patch the Operator deployment like this:

patches:
- patch: |
    apiVersion: apps/v1
    kind: Deployment
    metadata:
      name: controller-manager
    spec:
      template:
        spec:
          containers:
          - name: manager
            env:
              - name: PULL_SECRET
                value: pull-secret
  target:
    kind: Deployment
    name: controller-manager

Setting the PULL_SECRET variable on the operator deployment will add the pull secret to all the workloads deployed by the operator

[pvbiesen]

tested suggested answer with v2.8.0 - works !

Thank you @WanzenBug !

[pvbiesen]

For anyone trying to use a private registry, these are the kustomization files I used :

kustomization.yaml

apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization

resources:
  - https://github.com/piraeusdatastore/piraeus-operator//config/default?ref=v2.8.0

patches:
  - patch: |
      apiVersion: apps/v1
      kind: Deployment
      metadata:
        name: controller-manager
        namespace: piraeus-datastore
      spec:
        template:
          spec:
            containers:
            - name: manager
              env:
                - name: PULL_SECRET
                  value: oci-registry-pull-secret
              image: private-registry.example.com/piraeusdatastore/piraeus-operator:v2.8.0
  - patch: |
      apiVersion: apps/v1
      kind: Deployment
      metadata:
        name: piraeus-operator-gencert
        namespace: piraeus-datastore
      spec:
        template:
          spec:
            containers:
            - name: gencert
              image: private-registry.example.com/piraeusdatastore/piraeus-operator:v2.8.0


secretGenerator:
  - name: oci-registry-pull-secret
    namespace: piraeus-datastore
    type: kubernetes.io/dockerconfigjson
    files:
      - .dockerconfigjson=docker-config.json

configurations:
  - nameRef-secret-to-deployment-env.yaml

nameRef-secret-to-deployment-env.yaml

nameReference:
  - kind: Secret
    version: v1
    fieldSpecs:
      - path: spec/template/spec/containers/env/value
        kind: Deployment

There should also be a docker-config.json file in the current dir.