Image pull secrets not working from a subchart
- Dominant language
- Python
- Stars
- 148
- Forks
- 93
- PR merge metrics
- No merged PRs in 30d
Description
Environment:
* dask-gateway: `0.8.0`
* helm: `version.BuildInfo{Version:"v3.5.2", GitCommit:"167aac70832d3a384f65f9745335e9fb40169dc2", GitTreeState:"dirty", GoVersion:"go1.15.7"}`
* kubectl: `Client Version: version.Info{Major:"1", Minor:"20", GitVersion:"v1.20.2", GitCommit:"faecb196815e248d3ecfb03c680a4507229c2a56", GitTreeState:"clean", BuildDate:"2021-01-13T13:28:09Z", GoVersion:"go1.15.5", Compiler:"gc", Platform:"linux/amd64"}
Server Version: version.Info{Major:"1", Minor:"17+", GitVersion:"v1.17.9-r0-CCE20.8.1.3.B001-17.36.5", GitCommit:"d61c11191a704802f93e5d86877a8fcffe208d58", GitTreeState:"clean", BuildDate:"2020-10-16T09:38:58Z", GoVersion:"go1.13.15", Compiler:"gc", Platform:"linux/amd64"}`
* OS: `Debian 10`
# Bug:
Image pull secrets are ignored if the Helm chart is a subchart of some other chart. This happens at least for the `gateway` and `controller` deployments.
It works though if the helm chart is directly installed (with the same `values.yaml` file configuration) as described here: https://gateway.dask.org/install-kube.html#install-the-helm-chart
Private repositories are relevant today because of the Docker Hub login limits.
# Steps to reproduce:
* A Helm chart `demo-cluster` with the following configuration:
`Chart.yaml`
```
apiVersion: v2
name: demo-cluster
description: A cluster
type: application
version: 0.1.0
appVersion: 0.1.0
dependencies:
- name: dask-gateway
repository: "https://dask.org/dask-gateway-helm-repo/"
version: 0.8.0
```
`values.yaml`
```
dask-gateway:
gateway:
image:
name: xxx.xxx.xxx.xxx:xxxxx/daskgateway/dask-gateway-server
tag: 0.8.0
pullPolicy: Always
imagePullSecrets:
- name: default-secret
controller:
image:
name: xxx.xxx.xxx.xxx:xxxxx/daskgateway/dask-gateway-server
tag: 0.8.0
pullPolicy: Always
imagePullSecrets:
- name: default-secret
```
* The `dask-gateway-server` needs to be uploaded to some private repository.
* Install the cluster with:
```
helm dependency update ./demo-cluster
helm install acluster ./demo-cluster/
```
* **Now the pods will fail with `ImagePullBackOff` and the logs reveal that this is because they are missing the image pull secret.**
* This can also be seen by the output of `helm install acluster ./demo-cluster/ --dry-run --debug`:
```
# Source: demo-cluster/charts/dask-gateway/templates/controller/deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
name: controller-acluster-dask-gateway
labels:
app.kubernetes.io/name: dask-gateway
helm.sh/chart: dask-gateway-0.8.0
app.kubernetes.io/instance: acluster
app.kubernetes.io/version: "0.8.0"
app.kubernetes.io/managed-by: Helm
gateway.dask.org/instance: acluster-dask-gateway
spec:
replicas: 1
strategy:
type: Recreate
selector:
matchLabels:
app.kubernetes.io/name: dask-gateway
app.kubernetes.io/instance: acluster
app.kubernetes.io/component: controller
template:
metadata:
labels:
app.kubernetes.io/name: dask-gateway
helm.sh/chart: dask-gateway-0.8.0
app.kubernetes.io/instance: acluster
app.kubernetes.io/version: "0.8.0"
app.kubernetes.io/managed-by: Helm
gateway.dask.org/instance: acluster-dask-gateway
app.kubernetes.io/component: controller
annotations:
checksum/configmap: 6c7fe4e12fc5e497efb932e8611fdb5a6fdb582cb4913c6b903fe1fbdb833196
spec:
serviceAccountName: controller-acluster-dask-gateway
volumes:
- name: configmap
configMap:
name: controller-acluster-dask-gateway
containers:
- name: controller
image: xxx.xxx.xxx.xxx:xxxxx/daskgateway/dask-gateway-server:0.8.0
imagePullPolicy: Always
command:
- dask-gateway-server
- kube-controller
- --config
- /etc/dask-gateway/dask_gateway_config.py
resources:
{}
volumeMounts:
- mountPath: /etc/dask-gateway/
name: configmap
ports:
- containerPort: 8000
name: api
```
There is no `imagePullSecrets` entry which is present in the same deployment if installing the Helm chart directly.
Contributor guide
Assessment
This issue has not been assessed yet.