Support to set imagePullSecret when creating environment (#1429)

pkg/executor/newdeploy/newdeploy.go

@@ -17,11 +17,11 @@ limitations under the License.
 package newdeploy
 
 import (
-	"errors"
 	"fmt"
 	"time"
 
 	multierror "github.com/hashicorp/go-multierror"
+	"github.com/pkg/errors"
 	"go.uber.org/zap"
 	appsv1 "k8s.io/api/apps/v1"
 	asv1 "k8s.io/api/autoscaling/v1"
@@ -76,7 +76,7 @@ func (deploy *NewDeploy) createOrGetDeployment(fn *fv1.Function, env *fv1.Enviro
 			return nil, err
 		}
 
-		deployment, err := deploy.getDeploymentSpec(fn, env, deployName, deployLabels)
+		deployment, err := deploy.getDeploymentSpec(fn, env, deployName, deployNamespace, deployLabels)
 		if err != nil {
 			return nil, err
 		}
@@ -158,7 +158,7 @@ func (deploy *NewDeploy) deleteDeployment(ns string, name string) error {
 }
 
 func (deploy *NewDeploy) getDeploymentSpec(fn *fv1.Function, env *fv1.Environment,
-	deployName string, deployLabels map[string]string) (*appsv1.Deployment, error) {
+	deployName string, deployNamespace string, deployLabels map[string]string) (*appsv1.Deployment, error) {
 
 	replicas := int32(fn.Spec.InvokeStrategy.ExecutionStrategy.MinScale)
 
@@ -227,6 +227,24 @@ func (deploy *NewDeploy) getDeploymentSpec(fn *fv1.Function, env *fv1.Environmen
 		return nil, err
 	}
 
+	pod := apiv1.PodTemplateSpec{
+		ObjectMeta: metav1.ObjectMeta{
+			Labels:      deployLabels,
+			Annotations: podAnnotations,
+		},
+		Spec: apiv1.PodSpec{
+			Containers:                    []apiv1.Container{*container},
+			ServiceAccountName:            "fission-fetcher",
+			TerminationGracePeriodSeconds: &gracePeriodSeconds,
+		},
+	}
+
+	podspec, err := util.ApplyImagePullSecret(deploy.kubernetesClient, env.Spec.ImagePullSecret, deployNamespace, pod.Spec)
+	if err != nil {
+		return nil, errors.Wrapf(err, "failed to apply image pull secret for env '%v'", env.Metadata.Name)
+	}
+	pod.Spec = *podspec
+
 	deployment := &appsv1.Deployment{
 		ObjectMeta: metav1.ObjectMeta{
 			Name:   deployName,
@@ -237,17 +255,7 @@ func (deploy *NewDeploy) getDeploymentSpec(fn *fv1.Function, env *fv1.Environmen
 			Selector: &metav1.LabelSelector{
 				MatchLabels: deployLabels,
 			},
-			Template: apiv1.PodTemplateSpec{
-				ObjectMeta: metav1.ObjectMeta{
-					Labels:      deployLabels,
-					Annotations: podAnnotations,
-				},
-				Spec: apiv1.PodSpec{
-					Containers:                    []apiv1.Container{*container},
-					ServiceAccountName:            "fission-fetcher",
-					TerminationGracePeriodSeconds: &gracePeriodSeconds,
-				},
-			},
+			Template: pod,
 			Strategy: appsv1.DeploymentStrategy{
 				Type: appsv1.RollingUpdateDeploymentStrategyType,
 				RollingUpdate: &appsv1.RollingUpdateDeployment{

pkg/executor/newdeploy/newdeploymgr.go

@@ -535,12 +535,6 @@ func (deploy *NewDeploy) updateFuncDeployment(fn *fv1.Function, env *fv1.Environ
 	deploy.logger.Info("updating deployment due to function/environment update",
 		zap.String("deployment", fnObjName), zap.Any("function", fn.Metadata.Name))
 
-	newDeployment, err := deploy.getDeploymentSpec(fn, env, fnObjName, deployLabels)
-	if err != nil {
-		deploy.updateStatus(fn, err, "failed to get new deployment spec while updating function")
-		return err
-	}
-
 	// to support backward compatibility, if the function was created in default ns, we fall back to creating the
 	// deployment of the function in fission-function ns
 	ns := deploy.namespace
@@ -548,6 +542,12 @@ func (deploy *NewDeploy) updateFuncDeployment(fn *fv1.Function, env *fv1.Environ
 		ns = fn.Metadata.Namespace
 	}
 
+	newDeployment, err := deploy.getDeploymentSpec(fn, env, fnObjName, ns, deployLabels)
+	if err != nil {
+		deploy.updateStatus(fn, err, "failed to get new deployment spec while updating function")
+		return err
+	}
+
 	err = deploy.updateDeployment(newDeployment, ns)
 	if err != nil {
 		deploy.updateStatus(fn, err, "failed to update deployment while updating function")

pkg/executor/poolmgr/gp.go

@@ -389,6 +389,27 @@ func (gp *GenericPool) createPool() error {
 		return err
 	}
 
+	pod := apiv1.PodTemplateSpec{
+		ObjectMeta: metav1.ObjectMeta{
+			Labels:      gp.labelsForPool,
+			Annotations: podAnnotations,
+		},
+		Spec: apiv1.PodSpec{
+			Containers:         []apiv1.Container{*container},
+			ServiceAccountName: "fission-fetcher",
+			// TerminationGracePeriodSeconds should be equal to the
+			// sleep time of preStop to make sure that SIGTERM is sent
+			// to pod after 6 mins.
+			TerminationGracePeriodSeconds: &gracePeriodSeconds,
+		},
+	}
+
+	podspec, err := util.ApplyImagePullSecret(gp.kubernetesClient, gp.env.Spec.ImagePullSecret, gp.namespace, pod.Spec)
+	if err != nil {
+		return errors.Wrapf(err, "failed to apply image pull secret for env '%v'", gp.env.Metadata.Name)
+	}
+	pod.Spec = *podspec
+
 	deployment := &appsv1.Deployment{
 		ObjectMeta: metav1.ObjectMeta{
 			Name:   gp.getPoolName(),
@@ -399,20 +420,7 @@ func (gp *GenericPool) createPool() error {
 			Selector: &metav1.LabelSelector{
 				MatchLabels: gp.labelsForPool,
 			},
-			Template: apiv1.PodTemplateSpec{
-				ObjectMeta: metav1.ObjectMeta{
-					Labels:      gp.labelsForPool,
-					Annotations: podAnnotations,
-				},
-				Spec: apiv1.PodSpec{
-					Containers:         []apiv1.Container{*container},
-					ServiceAccountName: "fission-fetcher",
-					// TerminationGracePeriodSeconds should be equal to the
-					// sleep time of preStop to make sure that SIGTERM is sent
-					// to pod after 6 mins.
-					TerminationGracePeriodSeconds: &gracePeriodSeconds,
-				},
-			},
+			Template: pod,
 		},
 	}
 

pkg/executor/util/util.go

@@ -0,0 +1,38 @@
+/*
+Copyright 2019 The Fission Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package util
+
+import (
+	"github.com/pkg/errors"
+	apiv1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/client-go/kubernetes"
+)
+
+// ApplyImagePullSecret applies image pull secret to the give pod spec. An error will be returned if failed to get secret.
+func ApplyImagePullSecret(client *kubernetes.Clientset, secret string, secretNS string, podspec apiv1.PodSpec) (*apiv1.PodSpec, error) {
+	if len(secret) > 0 && client != nil {
+		_, err := client.CoreV1().Secrets(secretNS).Get(secret, metav1.GetOptions{})
+		if err != nil {
+			err = errors.Wrapf(err, "unable to get image pull secret '%v' under namespace '%v'",
+				secret, secretNS)
+			return nil, err
+		}
+		podspec.ImagePullSecrets = []apiv1.LocalObjectReference{{Name: secret}}
+	}
+	return &podspec, nil
+}