Skip to content

Add calico-pull-secret #9868

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
openshift-merge-robot merged 1 commit into from
Sep 25, 2018
Merged

Add calico-pull-secret #9868

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
29 changes: 29 additions & 0 deletions roles/calico_master/tasks/main.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,6 +37,35 @@
set_fact:
node_version: "{{ calico_node_image | regex_replace('^.*node:v?(.*)$', '\\1') }}"
cnx: "{{ calico_node_image | regex_replace('^.*/(.*)-node:.*$', '\\1') }}"
use_calico_credentials: "{{ calico_image_credentials is defined | bool }}"

- name: Calico | Encode Docker Credentials
shell: >
cat {{ calico_image_credentials }} | openssl base64 -A
register: calico_encoded_credentials_output
failed_when: "calico_encoded_credentials_output.rc != 0 or calico_encoded_credentials_output.stdout == ''"
when: use_calico_credentials

- name: Calico | Set Encoded Docker Credentials Fact
set_fact:
calico_encoded_credentials: "{{ calico_encoded_credentials_output.stdout }}"
when: use_calico_credentials

- name: Calico | Write Calico Pull Secret
template:
dest: "{{ mktemp.stdout }}/calico-pull-secret.yml"
src: calico-pull-secret.yml.j2
when: use_calico_credentials

- name: Calico | Create Calico Pull Secret
when: use_calico_credentials
command: >
{{ openshift_client_binary }} apply
-f {{ mktemp.stdout }}/calico-pull-secret.yml
--config={{ openshift.common.config_base }}/master/admin.kubeconfig
register: calico_pull_secret_create_output
failed_when: "calico_pull_secret_create_output.rc != 0"
Copy link
Contributor

@vrutkovs vrutkovs Sep 21, 2018

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This should exclude cases where stdout has Already exists - so that the playbook could be rerun several times and work properly on multi-master setup

Copy link
Contributor Author

@mgleung mgleung Sep 21, 2018

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I might be misunderstanding, but I thought the apply command has an exit code of 0 when it modifies a resource, creates a resource, or leaves a resource unchanged?

Here are the results of testing it in my own environment:

$ oc apply -f test-ps.yaml
secret "test-calico-pull-secret" created
$ echo $?
0
$ oc apply -f test-ps.yaml
secret "test-calico-pull-secret" unchanged
$ echo $?
0
$ vim test-ps.yaml
$ oc apply -f test-ps.yaml
secret "test-calico-pull-secret" configured
$ echo $?
0

Am I looking at the right values?

Copy link
Contributor

@vrutkovs vrutkovs Sep 24, 2018

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ah, right, we're using apply here, it would error only when create is used

changed_when: "('created' in calico_pull_secret_create_output.stdout) or ('configured' in calico_pull_secret_create_output.stdout)"

- name: Calico Master | Write Calico v2
template:
Expand Down
8 changes: 8 additions & 0 deletions roles/calico_master/templates/calico-pull-secret.yml.j2
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,8 @@
apiVersion: v1
kind: Secret
metadata:
name: calico-pull-secret
namespace: kube-system
data:
.dockerconfigjson: {{ calico_encoded_credentials }}
type: kubernetes.io/dockerconfigjson
4 changes: 4 additions & 0 deletions roles/calico_master/templates/calicov3.yml.j2
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -181,6 +181,10 @@ spec:
annotations:
scheduler.alpha.kubernetes.io/critical-pod: ''
spec:
{% if calico_image_credentials is defined %}
imagePullSecrets:
- name: calico-pull-secret
{% endif %}
nodeSelector:
projectcalico.org/ds-ready: "true"
hostNetwork: true
Expand Down