Skip to content
This repository was archived by the owner on Jan 30, 2026. It is now read-only.

Commit 812a509

Browse files
ciaranRocheciaranRoche
authored
Merge pull request #2 from ldornele/HYPERFLEET-273
[HYPERFLEET-273]: Implement MVP pull-secret job for GCP Secret Manager with Helm deployment
2 parents 6be9eb6 + 1c20e8c commit 812a509

File tree

12 files changed

+1549
-0
lines changed

12 files changed

+1549
-0
lines changed

‎charts/pull-secret/.helmignore‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
# Patterns to ignore when building packages.
2+
# This supports shell glob matching, relative path matching, and
3+
# negation (prefixed with !). Only one pattern per line.
4+
.DS_Store
5+
# Common VCS dirs
6+
.git/
7+
.gitignore
8+
.bzr/
9+
.bzrignore
10+
.hg/
11+
.hgignore
12+
.svn/
13+
# Common backup files
14+
*.swp
15+
*.bak
16+
*.tmp
17+
*.orig
18+
*~
19+
# Various IDEs
20+
.project
21+
.idea/
22+
*.tmproj
23+
.vscode/

‎charts/pull-secret/Chart.yaml‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
apiVersion: v2
2+
name: pull-secret
3+
description: HyperFleet Pull Secret Adapter - Manages pull secrets in GCP Secret Manager
4+
type: application
5+
version: 0.1.0
6+
appVersion: "1.0"
7+
keywords:
8+
- hyperfleet
9+
- pull-secret
10+
- gcp
11+
- secret-manager
12+
maintainers:
13+
- name: HyperFleet Team

‎charts/pull-secret/README.md‎

Lines changed: 193 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,193 @@
1+
# Pull Secret Adapter Helm Chart
2+
3+
This Helm chart deploys the HyperFleet Pull Secret Adapter as a Kubernetes Job on GKE.
4+
5+
## Prerequisites
6+
7+
1. **Helm 3.x installed**
8+
```bash
9+
curl https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3 | bash
10+
```
11+
12+
2. **kubectl configured for your GKE cluster**
13+
```bash
14+
gcloud container clusters get-credentials YOUR_CLUSTER_NAME \
15+
--zone=YOUR_ZONE \
16+
--project=YOUR_PROJECT_ID
17+
```
18+
19+
3. **Workload Identity configured**
20+
- Service Account: `your-service-account@your-project.iam.gserviceaccount.com`
21+
- Workload Pool: `your-project.svc.id.goog`
22+
23+
## Installation
24+
25+
### Quick Start
26+
27+
Deploy with default values:
28+
29+
```bash
30+
helm install pullsecret-job ./charts/pull-secret \
31+
--namespace hyperfleet-system \
32+
--create-namespace
33+
```
34+
35+
### Custom Values
36+
37+
Deploy with custom configuration:
38+
39+
```bash
40+
helm install pullsecret-job ./charts/pull-secret \
41+
--namespace hyperfleet-system \
42+
--create-namespace \
43+
--set env.gcpProjectId=my-project \
44+
--set env.clusterId=my-cluster-123 \
45+
--set env.pullSecretData='{"auths":{...}}' \
46+
--set image.tag=latest
47+
```
48+
49+
### Using a Values File
50+
51+
Create a custom values file (`my-values.yaml`):
52+
53+
```yaml
54+
env:
55+
gcpProjectId: "my-gcp-project"
56+
clusterId: "my-cluster-123"
57+
secretName: "hyperfleet-my-cluster-123-pull-secret"
58+
pullSecretData: '{"auths":{"registry.example.com":{"auth":"...","email":"user@example.com"}}}'
59+
60+
serviceAccount:
61+
gcpServiceAccount: "my-service-account@my-project.iam.gserviceaccount.com"
62+
63+
image:
64+
tag: "v1.0.0"
65+
```
66+
67+
Then install:
68+
69+
```bash
70+
helm install pullsecret-job ./charts/pull-secret \
71+
--namespace hyperfleet-system \
72+
--create-namespace \
73+
-f my-values.yaml
74+
```
75+
76+
## Configuration
77+
78+
The following table lists the configurable parameters:
79+
80+
| Parameter | Description | Default |
81+
|-----------|-------------|---------|
82+
| `namespace` | Kubernetes namespace | `hyperfleet-system` |
83+
| `job.name` | Job name | `pullsecret-job` |
84+
| `job.backoffLimit` | Number of retries on failure | `3` |
85+
| `job.ttlSecondsAfterFinished` | Cleanup delay after completion | `3600` (1 hour) |
86+
| `image.repository` | Container image repository | `quay.io/hyperfleet/pull-secret` |
87+
| `image.tag` | Container image tag | `latest` |
88+
| `image.pullPolicy` | Image pull policy | `Always` |
89+
| `serviceAccount.name` | Kubernetes ServiceAccount name | `pullsecret-adapter` |
90+
| `serviceAccount.gcpServiceAccount` | GCP service account for Workload Identity | `your-service-account@your-project.iam.gserviceaccount.com` |
91+
| `env.gcpProjectId` | GCP project ID | `your-gcp-project` |
92+
| `env.clusterId` | Cluster identifier | `your-cluster-id` |
93+
| `env.secretName` | Secret name in GCP Secret Manager | `hyperfleet-your-cluster-id-pull-secret` |
94+
| `env.pullSecretData` | Pull secret JSON data (required) | `{"auths":{...}}` |
95+
| `resources.requests.cpu` | CPU request | `100m` |
96+
| `resources.requests.memory` | Memory request | `128Mi` |
97+
| `resources.limits.cpu` | CPU limit | `500m` |
98+
| `resources.limits.memory` | Memory limit | `512Mi` |
99+
100+
## Usage
101+
102+
### Monitoring
103+
104+
Check job status:
105+
```bash
106+
helm status pullsecret-job -n hyperfleet-system
107+
kubectl get job pullsecret-job -n hyperfleet-system
108+
```
109+
110+
View logs:
111+
```bash
112+
kubectl logs -f job/pullsecret-job -n hyperfleet-system
113+
```
114+
115+
### Upgrading
116+
117+
Upgrade the deployment with new values:
118+
```bash
119+
helm upgrade pullsecret-job ./charts/pull-secret \
120+
--namespace hyperfleet-system \
121+
--set image.tag=v1.1.0
122+
```
123+
124+
### Uninstalling
125+
126+
Remove the job:
127+
```bash
128+
helm uninstall pullsecret-job -n hyperfleet-system
129+
```
130+
131+
## Dry Run Mode
132+
133+
Test without creating secrets:
134+
```bash
135+
helm install pullsecret-job ./charts/pull-secret \
136+
--namespace hyperfleet-system \
137+
--dry-run --debug
138+
```
139+
140+
## Troubleshooting
141+
142+
### View rendered templates
143+
```bash
144+
helm template pullsecret-job ./charts/pull-secret
145+
```
146+
147+
### Check deployment issues
148+
```bash
149+
kubectl describe job pullsecret-job -n hyperfleet-system
150+
kubectl get events -n hyperfleet-system --sort-by='.lastTimestamp'
151+
```
152+
153+
### Authentication errors
154+
155+
Verify Workload Identity binding:
156+
```bash
157+
# Check ServiceAccount
158+
kubectl get sa pullsecret-adapter -n hyperfleet-system -o yaml
159+
160+
# Check GCP IAM binding
161+
gcloud iam service-accounts get-iam-policy \
162+
your-service-account@your-project.iam.gserviceaccount.com \
163+
--project=your-project
164+
```
165+
166+
## Development
167+
168+
### Linting
169+
170+
Lint the chart:
171+
```bash
172+
helm lint ./charts/pull-secret
173+
```
174+
175+
### Testing
176+
177+
Test template rendering:
178+
```bash
179+
helm template test-release ./charts/pull-secret --debug
180+
```
181+
182+
### Packaging
183+
184+
Package the chart:
185+
```bash
186+
helm package ./charts/pull-secret
187+
```
188+
189+
## References
190+
191+
- [Helm Documentation](https://helm.sh/docs/)
192+
- [GKE Workload Identity](https://cloud.google.com/kubernetes-engine/docs/how-to/workload-identity)
193+
- [Kubernetes Jobs](https://kubernetes.io/docs/concepts/workloads/controllers/job/)

‎charts/pull-secret/templates/_helpers.tpl‎

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
{{/*
2+
Expand the name of the chart.
3+
*/}}
4+
{{- define "pull-secret.name" -}}
5+
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
6+
{{- end }}
7+
8+
{{/*
9+
Create a default fully qualified app name.
10+
*/}}
11+
{{- define "pull-secret.fullname" -}}
12+
{{- if .Values.fullnameOverride }}
13+
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
14+
{{- else }}
15+
{{- $name := default .Chart.Name .Values.nameOverride }}
16+
{{- if contains $name .Release.Name }}
17+
{{- .Release.Name | trunc 63 | trimSuffix "-" }}
18+
{{- else }}
19+
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
20+
{{- end }}
21+
{{- end }}
22+
{{- end }}
23+
24+
{{/*
25+
Create chart name and version as used by the chart label.
26+
*/}}
27+
{{- define "pull-secret.chart" -}}
28+
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
29+
{{- end }}
30+
31+
{{/*
32+
Common labels
33+
*/}}
34+
{{- define "pull-secret.labels" -}}
35+
helm.sh/chart: {{ include "pull-secret.chart" . }}
36+
{{ include "pull-secret.selectorLabels" . }}
37+
{{- if .Chart.AppVersion }}
38+
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
39+
{{- end }}
40+
app.kubernetes.io/managed-by: {{ .Release.Service }}
41+
{{- end }}
42+
43+
{{/*
44+
Selector labels
45+
*/}}
46+
{{- define "pull-secret.selectorLabels" -}}
47+
app.kubernetes.io/name: {{ include "pull-secret.name" . }}
48+
app.kubernetes.io/instance: {{ .Release.Name }}
49+
app: {{ .Values.labels.app }}
50+
{{- end }}
51+
52+
{{/*
53+
Create the name of the service account to use
54+
*/}}
55+
{{- define "pull-secret.serviceAccountName" -}}
56+
{{- default "pullsecret-adapter" .Values.serviceAccount.name }}
57+
{{- end }}

‎charts/pull-secret/templates/job.yaml‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
apiVersion: batch/v1
2+
kind: Job
3+
metadata:
4+
name: {{ .Values.job.name }}
5+
namespace: {{ .Values.namespace }}
6+
labels:
7+
{{- include "pull-secret.labels" . | nindent 4 }}
8+
job-type: {{ .Values.labels.jobType }}
9+
spec:
10+
backoffLimit: {{ .Values.job.backoffLimit }}
11+
ttlSecondsAfterFinished: {{ .Values.job.ttlSecondsAfterFinished }}
12+
template:
13+
metadata:
14+
labels:
15+
{{- include "pull-secret.selectorLabels" . | nindent 8 }}
16+
spec:
17+
serviceAccountName: {{ include "pull-secret.serviceAccountName" . }}
18+
restartPolicy: {{ .Values.job.restartPolicy }}
19+
containers:
20+
- name: pull-secret
21+
image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
22+
imagePullPolicy: {{ .Values.image.pullPolicy }}
23+
env:
24+
- name: GCP_PROJECT_ID
25+
value: {{ .Values.env.gcpProjectId | quote }}
26+
- name: CLUSTER_ID
27+
value: {{ .Values.env.clusterId | quote }}
28+
- name: SECRET_NAME
29+
value: {{ .Values.env.secretName | quote }}
30+
- name: PULL_SECRET_DATA
31+
value: {{ .Values.env.pullSecretData | quote }}
32+
resources:
33+
{{- toYaml .Values.resources | nindent 10 }}
34+
securityContext:
35+
{{- toYaml .Values.securityContext | nindent 10 }}

‎charts/pull-secret/templates/serviceaccount.yaml‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
apiVersion: v1
2+
kind: ServiceAccount
3+
metadata:
4+
name: {{ include "pull-secret.serviceAccountName" . }}
5+
namespace: {{ .Values.namespace }}
6+
labels:
7+
{{- include "pull-secret.labels" . | nindent 4 }}
8+
annotations:
9+
iam.gke.io/gcp-service-account: {{ .Values.serviceAccount.gcpServiceAccount }}

0 commit comments

Comments
 (0)