Skip to content

Commit 7ed46c8

Browse files
SgtCoDFishSgtCoDFish
authored
Merge pull request #782 from jetstack/update-helm-secure
Add imageRegistry/imageNamespace to Helm chart image settings
2 parents 4e92632 + 1a85df9 commit 7ed46c8

13 files changed

Lines changed: 380 additions & 28 deletions

File tree

‎deploy/charts/disco-agent/README.md‎

Lines changed: 47 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -98,11 +98,54 @@ This will set the replicaset count more information can be found here: https://k
9898
> ```
9999
100100
Must be set to indicate that you have read and accepted the CyberArk Terms of Service. If false, the helm chart will fail to install and will print a message with instructions on how to accept the TOS.
101+
#### **imageRegistry** ~ `string`
102+
> Default value:
103+
> ```yaml
104+
> quay.io
105+
> ```
106+
107+
The container registry used for disco-agent images by default. This can include path prefixes (e.g. "artifactory.example.com/docker").
108+
109+
#### **imageNamespace** ~ `string`
110+
> Default value:
111+
> ```yaml
112+
> jetstack
113+
> ```
114+
115+
The repository namespace used for disco-agent images by default.
116+
Examples:
117+
- jetstack
118+
- custom-namespace
119+
120+
#### **image.registry** ~ `string`
121+
122+
Deprecated: per-component registry prefix.
123+
124+
If set, this value is *prepended* to the image repository that the chart would otherwise render. This applies both when `image.repository` is set and when the repository is computed from
125+
`imageRegistry` + `imageNamespace` + `image.name`.
126+
127+
This can produce "double registry" style references such as
128+
`legacy.example.io/quay.io/jetstack/...`. Prefer using the global
129+
`imageRegistry`/`imageNamespace` values.
130+
101131
#### **image.repository** ~ `string`
102132
> Default value:
103133
> ```yaml
104134
> ""
105135
> ```
136+
137+
Full repository override (takes precedence over `imageRegistry`, `imageNamespace`, and `image.name`).
138+
Example: quay.io/jetstack/disco-agent
139+
140+
#### **image.name** ~ `string`
141+
> Default value:
142+
> ```yaml
143+
> disco-agent
144+
> ```
145+
146+
The image name for the Discovery Agent.
147+
This is used (together with `imageRegistry` and `imageNamespace`) to construct the full image reference.
148+
106149
#### **image.pullPolicy** ~ `string`
107150
> Default value:
108151
> ```yaml
@@ -116,14 +159,14 @@ This sets the pull policy for images.
116159
> ""
117160
> ```
118161
119-
Overrides the image tag whose default is the chart appVersion.
162+
Override the image tag to deploy by setting this variable. If no value is set, the chart's appVersion is used.
120163
#### **image.digest** ~ `string`
121164
> Default value:
122165
> ```yaml
123166
> ""
124167
> ```
125168
126-
The image digest
169+
Override the image digest to deploy by setting this variable. If set together with `image.tag`, the rendered image will include both tag and digest.
127170
#### **imagePullSecrets** ~ `array`
128171
> Default value:
129172
> ```yaml
@@ -414,3 +457,5 @@ endpointAdditionalProperties:
414457
targetLabel: instance
415458
```
416459
460+
<!-- /AUTO-GENERATED -->
461+

‎deploy/charts/disco-agent/templates/_helpers.tpl‎

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -60,3 +60,61 @@ Create the name of the service account to use
6060
{{- default "default" .Values.serviceAccount.name }}
6161
{{- end }}
6262
{{- end }}
63+
64+
{{/*
65+
Util function for generating the image URL based on the provided options.
66+
IMPORTANT: This function is standardized across all charts in the cert-manager GH organization.
67+
Any changes to this function should also be made in cert-manager, trust-manager, approver-policy, ...
68+
See https://github.com/cert-manager/cert-manager/issues/6329 for a list of linked PRs.
69+
*/}}
70+
{{- define "image" -}}
71+
{{- /*
72+
Calling convention:
73+
- (tuple <imageValues> <imageRegistry> <imageNamespace> <defaultReference>)
74+
We intentionally pass imageRegistry/imageNamespace as explicit arguments rather than reading
75+
from `.Values` inside this helper, because `helm-tool lint` does not reliably track `.Values.*`
76+
usage through tuple/variable indirection.
77+
*/ -}}
78+
{{- if ne (len .) 4 -}}
79+
{{- fail (printf "ERROR: template \"image\" expects (tuple <imageValues> <imageRegistry> <imageNamespace> <defaultReference>), got %d arguments" (len .)) -}}
80+
{{- end -}}
81+
{{- $image := index . 0 -}}
82+
{{- $imageRegistry := index . 1 | default "" -}}
83+
{{- $imageNamespace := index . 2 | default "" -}}
84+
{{- $defaultReference := index . 3 -}}
85+
{{- $repository := "" -}}
86+
{{- if $image.repository -}}
87+
{{- $repository = $image.repository -}}
88+
{{- /*
89+
Backwards compatibility: if image.registry is set, additionally prefix the repository with this registry.
90+
*/ -}}
91+
{{- if $image.registry -}}
92+
{{- $repository = printf "%s/%s" $image.registry $repository -}}
93+
{{- end -}}
94+
{{- else -}}
95+
{{- $name := required "ERROR: image.name must be set when image.repository is empty" $image.name -}}
96+
{{- $repository = $name -}}
97+
{{- if $imageNamespace -}}
98+
{{- $repository = printf "%s/%s" $imageNamespace $repository -}}
99+
{{- end -}}
100+
{{- if $imageRegistry -}}
101+
{{- $repository = printf "%s/%s" $imageRegistry $repository -}}
102+
{{- end -}}
103+
{{- /*
104+
Backwards compatibility: if image.registry is set, additionally prefix the repository with this registry.
105+
*/ -}}
106+
{{- if $image.registry -}}
107+
{{- $repository = printf "%s/%s" $image.registry $repository -}}
108+
{{- end -}}
109+
{{- end -}}
110+
{{- $repository -}}
111+
{{- if and $image.tag $image.digest -}}
112+
{{- printf ":%s@%s" $image.tag $image.digest -}}
113+
{{- else if $image.tag -}}
114+
{{- printf ":%s" $image.tag -}}
115+
{{- else if $image.digest -}}
116+
{{- printf "@%s" $image.digest -}}
117+
{{- else -}}
118+
{{- printf "%s" $defaultReference -}}
119+
{{- end -}}
120+
{{- end }}

‎deploy/charts/disco-agent/templates/deployment.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -39,7 +39,7 @@ spec:
3939
securityContext:
4040
{{- toYaml . | nindent 12 }}
4141
{{- end }}
42-
image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}{{- with .Values.image.digest }}@{{ . }}{{- end }}"
42+
image: "{{ template "image" (tuple .Values.image .Values.imageRegistry .Values.imageNamespace (printf ":%s" .Chart.AppVersion)) }}"
4343
imagePullPolicy: {{ .Values.image.pullPolicy }}
4444
env:
4545
- name: POD_NAMESPACE

‎deploy/charts/disco-agent/values.schema.json‎

Lines changed: 34 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -33,9 +33,15 @@
3333
"image": {
3434
"$ref": "#/$defs/helm-values.image"
3535
},
36+
"imageNamespace": {
37+
"$ref": "#/$defs/helm-values.imageNamespace"
38+
},
3639
"imagePullSecrets": {
3740
"$ref": "#/$defs/helm-values.imagePullSecrets"
3841
},
42+
"imageRegistry": {
43+
"$ref": "#/$defs/helm-values.imageRegistry"
44+
},
3945
"metrics": {
4046
"$ref": "#/$defs/helm-values.metrics"
4147
},
@@ -191,9 +197,15 @@
191197
"digest": {
192198
"$ref": "#/$defs/helm-values.image.digest"
193199
},
200+
"name": {
201+
"$ref": "#/$defs/helm-values.image.name"
202+
},
194203
"pullPolicy": {
195204
"$ref": "#/$defs/helm-values.image.pullPolicy"
196205
},
206+
"registry": {
207+
"$ref": "#/$defs/helm-values.image.registry"
208+
},
197209
"repository": {
198210
"$ref": "#/$defs/helm-values.image.repository"
199211
},
@@ -205,21 +217,36 @@
205217
},
206218
"helm-values.image.digest": {
207219
"default": "",
208-
"description": "The image digest",
220+
"description": "Override the image digest to deploy by setting this variable. If set together with `image.tag`, the rendered image will include both tag and digest.",
221+
"type": "string"
222+
},
223+
"helm-values.image.name": {
224+
"default": "disco-agent",
225+
"description": "The image name for the Discovery Agent.\nThis is used (together with `imageRegistry` and `imageNamespace`) to construct the full image reference.",
209226
"type": "string"
210227
},
211228
"helm-values.image.pullPolicy": {
212229
"default": "IfNotPresent",
213230
"description": "This sets the pull policy for images.",
214231
"type": "string"
215232
},
233+
"helm-values.image.registry": {
234+
"description": "Deprecated: per-component registry prefix.\n\nIf set, this value is *prepended* to the image repository that the chart would otherwise render. This applies both when `image.repository` is set and when the repository is computed from\n`imageRegistry` + `imageNamespace` + `image.name`.\n\nThis can produce \"double registry\" style references such as\n`legacy.example.io/quay.io/jetstack/...`. Prefer using the global\n`imageRegistry`/`imageNamespace` values.",
235+
"type": "string"
236+
},
216237
"helm-values.image.repository": {
217238
"default": "",
239+
"description": "Full repository override (takes precedence over `imageRegistry`, `imageNamespace`, and `image.name`).\nExample: quay.io/jetstack/disco-agent",
218240
"type": "string"
219241
},
220242
"helm-values.image.tag": {
221243
"default": "",
222-
"description": "Overrides the image tag whose default is the chart appVersion.",
244+
"description": "Override the image tag to deploy by setting this variable. If no value is set, the chart's appVersion is used.",
245+
"type": "string"
246+
},
247+
"helm-values.imageNamespace": {
248+
"default": "jetstack",
249+
"description": "The repository namespace used for disco-agent images by default.\nExamples:\n- jetstack\n- custom-namespace",
223250
"type": "string"
224251
},
225252
"helm-values.imagePullSecrets": {
@@ -228,6 +255,11 @@
228255
"items": {},
229256
"type": "array"
230257
},
258+
"helm-values.imageRegistry": {
259+
"default": "quay.io",
260+
"description": "The container registry used for disco-agent images by default. This can include path prefixes (e.g. \"artifactory.example.com/docker\").",
261+
"type": "string"
262+
},
231263
"helm-values.metrics": {
232264
"additionalProperties": false,
233265
"properties": {

‎deploy/charts/disco-agent/values.yaml‎

Lines changed: 41 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -8,14 +8,53 @@ replicaCount: 1
88
# Must be set to indicate that you have read and accepted the CyberArk Terms of Service. If false, the helm chart will fail to install and will print a message with instructions on how to accept the TOS.
99
acceptTerms: false
1010

11+
# The container registry used for disco-agent images by default.
12+
# This can include path prefixes (e.g. "artifactory.example.com/docker").
13+
# +docs:property
14+
imageRegistry: "quay.io"
15+
16+
# The repository namespace used for disco-agent images by default.
17+
# Examples:
18+
# - jetstack
19+
# - custom-namespace
20+
# +docs:property
21+
imageNamespace: "jetstack"
22+
1123
# This sets the container image more information can be found here: https://kubernetes.io/docs/concepts/containers/images/
1224
image:
25+
# Deprecated: per-component registry prefix.
26+
#
27+
# If set, this value is *prepended* to the image repository that the chart would otherwise render.
28+
# This applies both when `image.repository` is set and when the repository is computed from
29+
# `imageRegistry` + `imageNamespace` + `image.name`.
30+
#
31+
# This can produce "double registry" style references such as
32+
# `legacy.example.io/quay.io/jetstack/...`. Prefer using the global
33+
# `imageRegistry`/`imageNamespace` values.
34+
# +docs:property
35+
# registry: quay.io
36+
37+
# Full repository override (takes precedence over `imageRegistry`, `imageNamespace`,
38+
# and `image.name`).
39+
# Example: quay.io/jetstack/disco-agent
40+
# +docs:property
1341
repository: ""
42+
43+
# The image name for the Discovery Agent.
44+
# This is used (together with `imageRegistry` and `imageNamespace`) to construct the full
45+
# image reference.
46+
# +docs:property
47+
name: disco-agent
48+
1449
# This sets the pull policy for images.
1550
pullPolicy: IfNotPresent
16-
# Overrides the image tag whose default is the chart appVersion.
51+
52+
# Override the image tag to deploy by setting this variable.
53+
# If no value is set, the chart's appVersion is used.
1754
tag: ""
18-
# The image digest
55+
56+
# Override the image digest to deploy by setting this variable.
57+
# If set together with `image.tag`, the rendered image will include both tag and digest.
1958
digest: ""
2059

2160
# This is for the secrets for pulling an image from a private repository more information can be found here: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/

‎deploy/charts/venafi-kubernetes-agent/README.md‎

Lines changed: 51 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -99,13 +99,53 @@ endpointAdditionalProperties:
9999
> ```
100100
101101
default replicas, do not scale up
102+
#### **imageRegistry** ~ `string`
103+
> Default value:
104+
> ```yaml
105+
> registry.venafi.cloud
106+
> ```
107+
108+
The container registry used for venafi-kubernetes-agent images by default. This can include path prefixes (e.g. "artifactory.example.com/docker").
109+
110+
#### **imageNamespace** ~ `string`
111+
> Default value:
112+
> ```yaml
113+
> venafi-agent
114+
> ```
115+
116+
The repository namespace used for venafi-kubernetes-agent images by default.
117+
Examples:
118+
- venafi-agent
119+
- custom-namespace
120+
121+
#### **image.registry** ~ `string`
122+
123+
Deprecated: per-component registry prefix.
124+
125+
If set, this value is *prepended* to the image repository that the chart would otherwise render. This applies both when `image.repository` is set and when the repository is computed from
126+
`imageRegistry` + `imageNamespace` + `image.name`.
127+
128+
This can produce "double registry" style references such as
129+
`legacy.example.io/registry.venafi.cloud/venafi-agent/...`. Prefer using the global
130+
`imageRegistry`/`imageNamespace` values.
131+
102132
#### **image.repository** ~ `string`
103133
> Default value:
104134
> ```yaml
105-
> registry.venafi.cloud/venafi-agent/venafi-agent
135+
> ""
106136
> ```
107137
108-
The container image for the Discovery Agent.
138+
Full repository override (takes precedence over `imageRegistry`, `imageNamespace`, and `image.name`). Example: registry.venafi.cloud/venafi-agent/venafi-agent
139+
140+
#### **image.name** ~ `string`
141+
> Default value:
142+
> ```yaml
143+
> venafi-agent
144+
> ```
145+
146+
The image name for the Discovery Agent.
147+
This is used (together with `imageRegistry` and `imageNamespace`) to construct the full image reference.
148+
109149
#### **image.pullPolicy** ~ `string`
110150
> Default value:
111151
> ```yaml
@@ -116,10 +156,17 @@ Kubernetes imagePullPolicy on Deployment.
116156
#### **image.tag** ~ `string`
117157
> Default value:
118158
> ```yaml
119-
> v0.0.0
159+
> ""
160+
> ```
161+
162+
Override the image tag to deploy by setting this variable. If no value is set, the chart's appVersion is used.
163+
#### **image.digest** ~ `string`
164+
> Default value:
165+
> ```yaml
166+
> ""
120167
> ```
121168
122-
Overrides the image tag whose default is the chart appVersion.
169+
Override the image digest to deploy by setting this variable. If set together with `image.tag`, the rendered image will include both tag and digest.
123170
#### **imagePullSecrets** ~ `array`
124171
> Default value:
125172
> ```yaml

0 commit comments

Comments
 (0)