Ability to pull builder image from private registry (#1431)

pkg/buildermgr/envwatcher.go

@@ -495,7 +495,6 @@ func (envw *environmentWatcher) createBuilderDeployment(env *fv1.Environment, ns
 	}
 
 	finalPodSpec, err := util.MergePodSpec(&podSpec, env.Spec.Builder.PodSpec)
-
 	if err != nil {
 		return nil, err
 	}
@@ -516,7 +515,7 @@ func (envw *environmentWatcher) createBuilderDeployment(env *fv1.Environment, ns
 					Labels:      sel,
 					Annotations: podAnnotations,
 				},
-				Spec: *finalPodSpec,
+				Spec: *(util.ApplyImagePullSecret(env.Spec.ImagePullSecret, *finalPodSpec)),
 			},
 		},
 	}

pkg/executor/newdeploy/newdeploy.go

@@ -239,11 +239,7 @@ func (deploy *NewDeploy) getDeploymentSpec(fn *fv1.Function, env *fv1.Environmen
 		},
 	}
 
-	podspec, err := util.ApplyImagePullSecret(deploy.kubernetesClient, env.Spec.ImagePullSecret, deployNamespace, pod.Spec)
-	if err != nil {
-		return nil, errors.Wrapf(err, "failed to apply image pull secret for env '%v'", env.Metadata.Name)
-	}
-	pod.Spec = *podspec
+	pod.Spec = *(util.ApplyImagePullSecret(env.Spec.ImagePullSecret, pod.Spec))
 
 	deployment := &appsv1.Deployment{
 		ObjectMeta: metav1.ObjectMeta{

pkg/executor/poolmgr/gp.go

@@ -404,11 +404,7 @@ func (gp *GenericPool) createPool() error {
 		},
 	}
 
-	podspec, err := util.ApplyImagePullSecret(gp.kubernetesClient, gp.env.Spec.ImagePullSecret, gp.namespace, pod.Spec)
-	if err != nil {
-		return errors.Wrapf(err, "failed to apply image pull secret for env '%v'", gp.env.Metadata.Name)
-	}
-	pod.Spec = *podspec
+	pod.Spec = *(util.ApplyImagePullSecret(gp.env.Spec.ImagePullSecret, pod.Spec))
 
 	deployment := &appsv1.Deployment{
 		ObjectMeta: metav1.ObjectMeta{

pkg/executor/util/util.go

@@ -17,22 +17,17 @@ limitations under the License.
 package util
 
 import (
-	"github.com/pkg/errors"
 	apiv1 "k8s.io/api/core/v1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/client-go/kubernetes"
 )
 
-// ApplyImagePullSecret applies image pull secret to the give pod spec. An error will be returned if failed to get secret.
-func ApplyImagePullSecret(client *kubernetes.Clientset, secret string, secretNS string, podspec apiv1.PodSpec) (*apiv1.PodSpec, error) {
-	if len(secret) > 0 && client != nil {
-		_, err := client.CoreV1().Secrets(secretNS).Get(secret, metav1.GetOptions{})
-		if err != nil {
-			err = errors.Wrapf(err, "unable to get image pull secret '%v' under namespace '%v'",
-				secret, secretNS)
-			return nil, err
-		}
-		podspec.ImagePullSecrets = []apiv1.LocalObjectReference{{Name: secret}}
-	}
-	return &podspec, nil
+// ApplyImagePullSecret applies image pull secret to the give pod spec.
+// It's intentional not to check the existence of secret here.
+// First, Kubernetes will set Pod status to "ImagePullBackOff" once
+// kubelet failed to pull image so that users will know what's happening.
+// Second, Fission no longer need to handle "secret not found" error
+// when creating the environment deployment since kubelet will retry to
+// pull image until successes.
+func ApplyImagePullSecret(secret string, podspec apiv1.PodSpec) *apiv1.PodSpec {
+	podspec.ImagePullSecrets = []apiv1.LocalObjectReference{{Name: secret}}
+	return &podspec
 }