feat: add imagePullSecrets.name to reference existing registry secrets#244
feat: add imagePullSecrets.name to reference existing registry secrets#244AqeelMuhammad wants to merge 4 commits into
Conversation
Adds an optional imagePullSecrets.name field to all distributed charts (acp, tm, ugw, km), all-in-one chart, and all resource pattern default values files. When set, the chart skips creating a new dockerconfigjson Secret and references the named secret directly, allowing users to use pre-existing or externally-managed image pull secrets (e.g. sealed secrets, cloud-provider secrets). When name is empty the existing username/password credential-based behaviour is unchanged. Closes #17320
|
Warning Review limit reached
More reviews will be available in 39 minutes and 31 seconds. Learn how PR review limits work. Your organization has run out of usage credits. Purchase more credits in the billing tab to continue. ⌛ How to resolve this issue?After more reviews become available, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available. Please see our Fair Usage Limits Policy for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (21)
📝 WalkthroughWalkthroughThis pull request extends WSO2 API Manager Helm charts to support referencing existing Kubernetes image pull secrets by name. A new Suggested reviewers
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
resources/am-pattern-4-ACP_TM_GW_KM/default_km_values.yaml (1)
338-338: ⚡ Quick winAdd documentation comment for the new
imagePullSecrets.namefield across all values files.The new
namefield is added consistently across all five values files but lacks an explanatory comment. Users need to understand that this field references an existing pre-created Kubernetes image pull secret by name, and that setting it will skip creation of a new secret from theusernameandpasswordfields. Adding a brief comment will clarify the field's purpose and usage.💬 Proposed fix: add documentation comment
In each of the five files, update the
imagePullSecretsblock as follows:imagePullSecrets: enabled: false + # -- Name of the existing Kubernetes image pull secret to reference. + # If set, the chart will use this secret instead of creating one from username/password. name: "" username: "" password: ""This change should be applied identically in:
resources/am-pattern-4-ACP_TM_GW_KM/default_km_values.yamlresources/am-pattern-4-ACP_TM_GW_KM/default_tm_values.yamlresources/am-pattern-5-all-in-one_GW_KM/default_gw_values.yamlresources/am-pattern-5-all-in-one_GW_KM/default_km_values.yamlresources/am-pattern-5-all-in-one_GW_KM/default_values.yaml🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@resources/am-pattern-4-ACP_TM_GW_KM/default_km_values.yaml` at line 338, Add a brief documentation comment above the imagePullSecrets.name field in the imagePullSecrets block to explain that "name" should reference an existing pre-created Kubernetes image pull secret and that setting it causes the chart to use that secret instead of creating one from imagePullSecrets.username/imagePullSecrets.password; update the imagePullSecrets block (the imagePullSecrets.name field) identically across all values files where it was added so users see the same explanatory note.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@resources/am-pattern-1-all-in-one-HA/default_values.yaml`:
- Line 713: Add an inline YAML comment immediately above the
imagePullSecrets.name field explaining that imagePullSecrets.name references the
name of an existing image pull secret in the target namespace and, if set, the
chart will not create a new secret from username/password credentials (the chart
will use the provided secret instead); apply this same comment to the
imagePullSecrets.name entry in all values files where the field was added so
users understand its purpose and behavior.
---
Nitpick comments:
In `@resources/am-pattern-4-ACP_TM_GW_KM/default_km_values.yaml`:
- Line 338: Add a brief documentation comment above the imagePullSecrets.name
field in the imagePullSecrets block to explain that "name" should reference an
existing pre-created Kubernetes image pull secret and that setting it causes the
chart to use that secret instead of creating one from
imagePullSecrets.username/imagePullSecrets.password; update the imagePullSecrets
block (the imagePullSecrets.name field) identically across all values files
where it was added so users see the same explanatory note.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: f5bf2d31-4c36-4381-864e-1444e4663580
📒 Files selected for processing (34)
all-in-one/default_openshift_values.yamlall-in-one/default_values.yamlall-in-one/templates/am/instance-1/wso2am-deployment.yamlall-in-one/templates/am/instance-2/wso2am-deployment.yamlall-in-one/templates/secrets/wso2am-secret-docker-registry.yamlall-in-one/values.yamldistributed/control-plane/templates/control-plane/instance-1/wso2am-cp-deployment.yamldistributed/control-plane/templates/control-plane/instance-2/wso2am-cp-deployment.yamldistributed/control-plane/templates/secrets/wso2am-secret-docker-registry.yamldistributed/control-plane/values.yamldistributed/gateway/templates/gateway/wso2am-gateway-deployment.yamldistributed/gateway/templates/secrets/wso2am-secret-docker-registry.yamldistributed/gateway/values.yamldistributed/key-manager/templates/key-manager/wso2am-km-deployment.yamldistributed/key-manager/templates/secrets/wso2am-secret-docker-registry.yamldistributed/key-manager/values.yamldistributed/traffic-manager/templates/secrets/wso2am-secret-docker-registry.yamldistributed/traffic-manager/templates/traffic-manager/instance-1/wso2am-tm-deployment.yamldistributed/traffic-manager/templates/traffic-manager/instance-2/wso2am-tm-deployment.yamldistributed/traffic-manager/values.yamlresources/am-pattern-0-all-in-one/default_values.yamlresources/am-pattern-1-all-in-one-HA/default_values.yamlresources/am-pattern-2-all-in-one_GW/default_gw_values.yamlresources/am-pattern-2-all-in-one_GW/default_values.yamlresources/am-pattern-3-ACP_TM_GW/default_acp_values.yamlresources/am-pattern-3-ACP_TM_GW/default_gw_values.yamlresources/am-pattern-3-ACP_TM_GW/default_tm_values.yamlresources/am-pattern-4-ACP_TM_GW_KM/default_acp_values.yamlresources/am-pattern-4-ACP_TM_GW_KM/default_gw_values.yamlresources/am-pattern-4-ACP_TM_GW_KM/default_km_values.yamlresources/am-pattern-4-ACP_TM_GW_KM/default_tm_values.yamlresources/am-pattern-5-all-in-one_GW_KM/default_gw_values.yamlresources/am-pattern-5-all-in-one_GW_KM/default_km_values.yamlresources/am-pattern-5-all-in-one_GW_KM/default_values.yaml
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
…files Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
1 participant
Summary
imagePullSecrets.namefield to all chartvalues.yamlfiles (control-plane, traffic-manager, gateway, key-manager, all-in-one) and theirdefault_values.yamlcounterpartsimagePullSecrets.nameis set, the chart uses the named pre-existing secret directly instead of creating a newkubernetes.io/dockerconfigjsonSecret from credentialsimagePullSecrets.nameis empty (default), existing credential-based behaviour is preserved — fully backward compatibleMotivation
Customers deploying APIM Helm charts in environments with centrally-managed image pull secrets (e.g. via Sealed Secrets, Vault, or corporate CI/CD pipelines) currently have no way to reference an existing secret by name. They must either supply raw credentials in
values.yamlor modify chart source directly.This change adds the missing
namefield alongside the existingusername/passwordfields, making both workflows available without breaking any existing deployment.Note: a related PR (#202) was previously open for
main; this PR supersedes it with a complete implementation covering all charts, deployment templates, secret templates, and resource pattern default values files.Files changed
distributed/*/values.yaml— addedimagePullSecrets.name: ""distributed/*/templates/secrets/wso2am-secret-docker-registry.yaml— skip secret creation whennameis setdistributed/*/templates/*/deployment.yaml— reference named secret whennameis setall-in-one/values.yaml,all-in-one/default_values.yaml,all-in-one/templates/...— same changesresources/am-pattern-*/default_*_values.yaml(16 files) — addedimagePullSecrets.name: ""Test plan
helm lintpasses on all 5 chartshelm templatewithimagePullSecrets.enabled=true,name=my-secretshowsimagePullSecrets: [{name: my-secret}]and no registry auth Secret renderedhelm templatewithimagePullSecrets.enabled=true,username=u,password=pstill renders the registry auth Secret and references it (backward compat)helm templatewithimagePullSecrets.enabled=falserenders noimagePullSecretsfield (unchanged)🤖 Generated with Claude Code