registry - generate a DOSecret operator friendly secret manifest #966

varshavaradarajan · 2021-03-08T22:39:37Z

The Kubernetes secret manifest we generate makes it easy for users to pull private images into their DOKS cluster. Now that we have the dosecret-operator to make the secret available in all namespaces, generate operator friendly manifests for users to apply into their DOKS cluster. Applying the manifest generated here to a DOKS cluster is the same as doing:

doctl kubernetes cluster registry add

cc @adamwg , @timoreimann

andrewsomething

Looks like this integration test will need to be updated as well:

doctl/integration/registry_kubernetes_manifest_test.go

Lines 84 to 95 in 1cb9bf9

 registryKubernetesManifestOutput = ` 

  apiVersion: v1 

 data: 

  .dockerconfigjson: eyJhdXRocyI6eyJyZWdpc3RyeS5kaWdpdGFsb2NlYW4uY29tIjp7ImF1dGgiOiJZamRrTUROaE5qazBOMkl5TVRkbFptSTJaak5sWXpOaVpETTFNRFExT0RJNllqZGtNRE5oTmprME4ySXlNVGRsWm1JMlpqTmxZek5pWkRNMU1EUTFPRElLIn19fQ== 

 kind: Secret 

 metadata: 

  creationTimestamp: null 

  name: registry-my-registry 

  namespace: default 

 type: kubernetes.io/dockerconfigjson 

 ` 

 )

Unfortunately, it doesn't seem to have run in this PR. I've identified and fixed the issue preventing it from running in: #967

andrewsomething · 2021-03-09T18:37:08Z

If you rebase on main, you'll see the failure:

=== CONT  TestRun/doctl/registry/kubernetes-manifest/prints_a_kubernetes_manifest_for_a_secret_with_the_registry_credentials
    registry_kubernetes_manifest_test.go:78: 
        	Error Trace:	registry_kubernetes_manifest_test.go:78
        	            				spec.go:269
        	            				spec.go:262
        	            				parser.go:133
        	Error:      	Not equal: 
        	            	expected: map[string]interface {}{"apiVersion":"v1", "data":map[string]interface {}{".dockerconfigjson":"eyJhdXRocyI6eyJyZWdpc3RyeS5kaWdpdGFsb2NlYW4uY29tIjp7ImF1dGgiOiJZamRrTUROaE5qazBOMkl5TVRkbFptSTJaak5sWXpOaVpETTFNRFExT0RJNllqZGtNRE5oTmprME4ySXlNVGRsWm1JMlpqTmxZek5pWkRNMU1EUTFPRElLIn19fQ=="}, "kind":"Secret", "metadata":map[string]interface {}{"creationTimestamp":interface {}(nil), "name":"registry-my-registry", "namespace":"default"}, "type":"kubernetes.io/dockerconfigjson"}
        	            	actual  : map[string]interface {}{"apiVersion":"v1", "data":map[string]interface {}{".dockerconfigjson":"eyJhdXRocyI6eyJyZWdpc3RyeS5kaWdpdGFsb2NlYW4uY29tIjp7ImF1dGgiOiJZamRrTUROaE5qazBOMkl5TVRkbFptSTJaak5sWXpOaVpETTFNRFExT0RJNllqZGtNRE5oTmprME4ySXlNVGRsWm1JMlpqTmxZek5pWkRNMU1EUTFPRElLIn19fQ=="}, "kind":"Secret", "metadata":map[string]interface {}{"annotations":map[string]interface {}{"digitalocean.com/dosecret-identifier":"registry-my-registry"}, "creationTimestamp":interface {}(nil), "name":"registry-my-registry", "namespace":"kube-system"}, "type":"kubernetes.io/dockerconfigjson"}
        	            	
        	            	Diff:
        	            	--- Expected
        	            	+++ Actual
        	            	@@ -6,6 +6,9 @@
        	            	  (string) (len=4) "kind": (string) (len=6) "Secret",
        	            	- (string) (len=8) "metadata": (map[string]interface {}) (len=3) {
        	            	+ (string) (len=8) "metadata": (map[string]interface {}) (len=4) {
        	            	+  (string) (len=11) "annotations": (map[string]interface {}) (len=1) {
        	            	+   (string) (len=36) "digitalocean.com/dosecret-identifier": (string) (len=20) "registry-my-registry"
        	            	+  },
        	            	   (string) (len=17) "creationTimestamp": (interface {}) <nil>,
        	            	   (string) (len=4) "name": (string) (len=20) "registry-my-registry",
        	            	-  (string) (len=9) "namespace": (string) (len=7) "default"
        	            	+  (string) (len=9) "namespace": (string) (len=11) "kube-system"
        	            	  },
        	Test:       	TestRun/doctl/registry/kubernetes-manifest/prints_a_kubernetes_manifest_for_a_secret_with_the_registry_credentials

timoreimann

Grammar nit, otherwise looks good from a DOKS perspective (given it passes the integration tests that Andrew fixed).

commands/registry.go

andrewsomething

👍 Looks good!

Question: Is the operator being back-filled onto existing clusters? Do we need any caveats about cluster versions in the help text?

varshavaradarajan · 2021-03-10T00:37:19Z

@andrewsomething - Good point! We have backfilled the operator until 1.15.12-do.2. Since this command is cluster-agnostic, what do you suggest we do? The manifest that this change generates for kube-system namespace or by default will trigger the operator in versions > 1.15.12-do.2. For unsupported versions, the manifest is harmless. For other namespaces, the manifest will be generated same as before.

andrewsomething · 2021-03-10T16:29:01Z

Maybe add something like this to the help for the command?

By default, the secret manifest will be applied to all the namespaces for the Kubernetes cluster using the DOSecret operator. The DOSecret operator is available on clusters running version 1.15.12-do.2 or greater. For older clusters or to restrict the secret to a specific namespace, use the --namespace flag.

andrewsomething

👍

varshavaradarajan force-pushed the varsha/make-manifest-dosecret-operator-friendly branch 2 times, most recently from d8f267f to 8097b50 Compare Mar 8, 2021

andrewsomething mentioned this pull request Mar 9, 2021

Fix integration test focus. #967

Merged

andrewsomething requested changes Mar 9, 2021

View changes

timoreimann previously approved these changes Mar 9, 2021

View changes

commands/registry.go Outdated Show resolved Hide resolved

varshavaradarajan dismissed timoreimann’s stale review via 48c5c4e Mar 9, 2021

varshavaradarajan force-pushed the varsha/make-manifest-dosecret-operator-friendly branch 2 times, most recently from 48c5c4e to 3be8cc6 Compare Mar 9, 2021

andrewsomething self-requested a review Mar 9, 2021

andrewsomething previously approved these changes Mar 9, 2021

View changes

registry - generate a DOSecret operator friendly secret manifest

b4c7c8c

varshavaradarajan dismissed andrewsomething’s stale review via b4c7c8c Mar 12, 2021

varshavaradarajan force-pushed the varsha/make-manifest-dosecret-operator-friendly branch from 3be8cc6 to b4c7c8c Compare Mar 12, 2021

Move string from short description to long description.

ddd6c3f

andrewsomething self-requested a review Mar 16, 2021

andrewsomething approved these changes Mar 16, 2021

View changes

andrewsomething merged commit 552c32c into digitalocean:main Mar 16, 2021
5 checks passed

digitalocean / doctl Public

registry - generate a DOSecret operator friendly secret manifest #966

registry - generate a DOSecret operator friendly secret manifest #966

varshavaradarajan commented Mar 8, 2021

andrewsomething left a comment

andrewsomething commented Mar 9, 2021

timoreimann left a comment

andrewsomething left a comment

varshavaradarajan commented Mar 10, 2021

andrewsomething commented Mar 10, 2021

andrewsomething left a comment

	registryKubernetesManifestOutput = `
	apiVersion: v1
	data:
	.dockerconfigjson: eyJhdXRocyI6eyJyZWdpc3RyeS5kaWdpdGFsb2NlYW4uY29tIjp7ImF1dGgiOiJZamRrTUROaE5qazBOMkl5TVRkbFptSTJaak5sWXpOaVpETTFNRFExT0RJNllqZGtNRE5oTmprME4ySXlNVGRsWm1JMlpqTmxZek5pWkRNMU1EUTFPRElLIn19fQ==
	kind: Secret
	metadata:
	creationTimestamp: null
	name: registry-my-registry
	namespace: default
	type: kubernetes.io/dockerconfigjson
	`
	)

digitalocean / doctl Public

registry - generate a DOSecret operator friendly secret manifest #966

registry - generate a DOSecret operator friendly secret manifest #966

Conversation

varshavaradarajan commented Mar 8, 2021

andrewsomething left a comment

andrewsomething commented Mar 9, 2021

timoreimann left a comment

andrewsomething left a comment

varshavaradarajan commented Mar 10, 2021

andrewsomething commented Mar 10, 2021

andrewsomething left a comment