Skip to content

Commit 37ecd7b

Browse files
lexfreilexfrei
committed
feat(kubernetes): make wait-for-kubeconfig image overridable for air-gapped registries
Operators in air-gapped or rate-limited environments cannot reach docker.io and the bundled busybox digest pin gives them no escape hatch. Add an optional images.waitForKubeconfig chart value that, when set, replaces the helper's image reference with any registry path kubelet can pull. Empty value falls back to images/busybox.tag, so the prior digest-pinned default is preserved. Assisted-By: Claude <[email protected]> Signed-off-by: Aleksei Sviridkin <[email protected]>
1 parent 39b8f02 commit 37ecd7b

7 files changed

Lines changed: 87 additions & 32 deletions

File tree

‎api/apps/v1alpha1/kubernetes/types.go‎

Lines changed: 9 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎packages/apps/kubernetes/README.md‎

Lines changed: 27 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -145,31 +145,33 @@ See the reference for components utilized in this service:
145145
146146
### Kubernetes Control Plane Configuration
147147
148-
| Name | Description | Type | Value |
149-
| --------------------------------------------------- | ------------------------------------------------ | ---------- | ------- |
150-
| `controlPlane` | Kubernetes control-plane configuration. | `object` | `{}` |
151-
| `controlPlane.replicas` | Number of control-plane replicas. | `int` | `2` |
152-
| `controlPlane.apiServer` | API Server configuration. | `object` | `{}` |
153-
| `controlPlane.apiServer.resources` | CPU and memory resources for API Server. | `object` | `{}` |
154-
| `controlPlane.apiServer.resources.cpu` | CPU available. | `quantity` | `""` |
155-
| `controlPlane.apiServer.resources.memory` | Memory (RAM) available. | `quantity` | `""` |
156-
| `controlPlane.apiServer.resourcesPreset` | Preset if `resources` omitted. | `string` | `large` |
157-
| `controlPlane.controllerManager` | Controller Manager configuration. | `object` | `{}` |
158-
| `controlPlane.controllerManager.resources` | CPU and memory resources for Controller Manager. | `object` | `{}` |
159-
| `controlPlane.controllerManager.resources.cpu` | CPU available. | `quantity` | `""` |
160-
| `controlPlane.controllerManager.resources.memory` | Memory (RAM) available. | `quantity` | `""` |
161-
| `controlPlane.controllerManager.resourcesPreset` | Preset if `resources` omitted. | `string` | `micro` |
162-
| `controlPlane.scheduler` | Scheduler configuration. | `object` | `{}` |
163-
| `controlPlane.scheduler.resources` | CPU and memory resources for Scheduler. | `object` | `{}` |
164-
| `controlPlane.scheduler.resources.cpu` | CPU available. | `quantity` | `""` |
165-
| `controlPlane.scheduler.resources.memory` | Memory (RAM) available. | `quantity` | `""` |
166-
| `controlPlane.scheduler.resourcesPreset` | Preset if `resources` omitted. | `string` | `micro` |
167-
| `controlPlane.konnectivity` | Konnectivity configuration. | `object` | `{}` |
168-
| `controlPlane.konnectivity.server` | Konnectivity Server configuration. | `object` | `{}` |
169-
| `controlPlane.konnectivity.server.resources` | CPU and memory resources for Konnectivity. | `object` | `{}` |
170-
| `controlPlane.konnectivity.server.resources.cpu` | CPU available. | `quantity` | `""` |
171-
| `controlPlane.konnectivity.server.resources.memory` | Memory (RAM) available. | `quantity` | `""` |
172-
| `controlPlane.konnectivity.server.resourcesPreset` | Preset if `resources` omitted. | `string` | `micro` |
148+
| Name | Description | Type | Value |
149+
| --------------------------------------------------- | --------------------------------------------------------------------------------------------- | ---------- | ------- |
150+
| `controlPlane` | Kubernetes control-plane configuration. | `object` | `{}` |
151+
| `controlPlane.replicas` | Number of control-plane replicas. | `int` | `2` |
152+
| `controlPlane.apiServer` | API Server configuration. | `object` | `{}` |
153+
| `controlPlane.apiServer.resources` | CPU and memory resources for API Server. | `object` | `{}` |
154+
| `controlPlane.apiServer.resources.cpu` | CPU available. | `quantity` | `""` |
155+
| `controlPlane.apiServer.resources.memory` | Memory (RAM) available. | `quantity` | `""` |
156+
| `controlPlane.apiServer.resourcesPreset` | Preset if `resources` omitted. | `string` | `large` |
157+
| `controlPlane.controllerManager` | Controller Manager configuration. | `object` | `{}` |
158+
| `controlPlane.controllerManager.resources` | CPU and memory resources for Controller Manager. | `object` | `{}` |
159+
| `controlPlane.controllerManager.resources.cpu` | CPU available. | `quantity` | `""` |
160+
| `controlPlane.controllerManager.resources.memory` | Memory (RAM) available. | `quantity` | `""` |
161+
| `controlPlane.controllerManager.resourcesPreset` | Preset if `resources` omitted. | `string` | `micro` |
162+
| `controlPlane.scheduler` | Scheduler configuration. | `object` | `{}` |
163+
| `controlPlane.scheduler.resources` | CPU and memory resources for Scheduler. | `object` | `{}` |
164+
| `controlPlane.scheduler.resources.cpu` | CPU available. | `quantity` | `""` |
165+
| `controlPlane.scheduler.resources.memory` | Memory (RAM) available. | `quantity` | `""` |
166+
| `controlPlane.scheduler.resourcesPreset` | Preset if `resources` omitted. | `string` | `micro` |
167+
| `controlPlane.konnectivity` | Konnectivity configuration. | `object` | `{}` |
168+
| `controlPlane.konnectivity.server` | Konnectivity Server configuration. | `object` | `{}` |
169+
| `controlPlane.konnectivity.server.resources` | CPU and memory resources for Konnectivity. | `object` | `{}` |
170+
| `controlPlane.konnectivity.server.resources.cpu` | CPU available. | `quantity` | `""` |
171+
| `controlPlane.konnectivity.server.resources.memory` | Memory (RAM) available. | `quantity` | `""` |
172+
| `controlPlane.konnectivity.server.resourcesPreset` | Preset if `resources` omitted. | `string` | `micro` |
173+
| `images` | Optional image overrides for air-gapped or rate-limited registries. | `object` | `{}` |
174+
| `images.waitForKubeconfig` | Image used by the wait-for-kubeconfig init container. Empty falls back to images/busybox.tag. | `string` | `""` |
173175
174176
175177
## Parameter examples and reference

‎packages/apps/kubernetes/templates/_helpers.tpl‎

Lines changed: 7 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -65,18 +65,20 @@ release.cozystack.io/helm-install-timeout annotation) so the
6565
CrashLoopBackOff surfaces before flux remediation fires and uninstalls
6666
the Cluster CR.
6767
68-
The pinned busybox image in images/busybox.tag points directly at
68+
The default image lives in images/busybox.tag and points directly at
6969
docker.io by digest (not mirrored to ghcr.io like the other .tag files
70-
here): the payload is a one-shot sh loop, the digest pin makes the
71-
pull immutable, and the cost of maintaining a private mirror of a tiny
72-
upstream image that does not move often is not worth it.
70+
here): the payload is a one-shot sh loop and the digest pin makes the
71+
pull immutable. Operators in air-gapped or rate-limited environments
72+
can override it via .Values.images.waitForKubeconfig (any registry
73+
reference kubelet can pull). When the value is empty the chart falls
74+
back to the bundled digest pin, preserving the prior default.
7375
7476
Call site owns the surrounding volumes block; the kubeconfig volume
7577
must exist on the pod and mount at /etc/kubernetes/kubeconfig.
7678
*/}}
7779
{{- define "kubernetes.waitForAdminKubeconfig" -}}
7880
- name: wait-for-kubeconfig
79-
image: "{{ .Files.Get "images/busybox.tag" | trim }}"
81+
image: "{{ default (.Files.Get "images/busybox.tag" | trim) .Values.images.waitForKubeconfig }}"
8082
command:
8183
- sh
8284
- -c

‎packages/apps/kubernetes/tests/admin_kubeconfig_wait_test.yaml‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -95,6 +95,29 @@ tests:
9595
mountPath: /etc/kubernetes/kubeconfig
9696
readOnly: true
9797

98+
- it: wait-for-kubeconfig defaults to bundled busybox digest pin
99+
template: templates/cluster-autoscaler/deployment.yaml
100+
documentSelector:
101+
path: kind
102+
value: Deployment
103+
asserts:
104+
- matchRegex:
105+
path: spec.template.spec.initContainers[0].image
106+
pattern: '^docker\.io/library/busybox:[^@]+@sha256:[0-9a-f]{64}$'
107+
108+
- it: wait-for-kubeconfig honours images.waitForKubeconfig override
109+
template: templates/cluster-autoscaler/deployment.yaml
110+
documentSelector:
111+
path: kind
112+
value: Deployment
113+
set:
114+
images:
115+
waitForKubeconfig: "registry.example.test/library/busybox:1.37.0@sha256:0000000000000000000000000000000000000000000000000000000000000000"
116+
asserts:
117+
- equal:
118+
path: spec.template.spec.initContainers[0].image
119+
value: "registry.example.test/library/busybox:1.37.0@sha256:0000000000000000000000000000000000000000000000000000000000000000"
120+
98121
- it: cluster.yaml renders and wires dataStoreName when tenant has etcd
99122
template: templates/cluster.yaml
100123
documentSelector:

‎packages/apps/kubernetes/values.schema.json‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -630,6 +630,18 @@
630630
}
631631
}
632632
}
633+
},
634+
"images": {
635+
"description": "Optional image overrides for air-gapped or rate-limited registries.",
636+
"type": "object",
637+
"default": {},
638+
"properties": {
639+
"waitForKubeconfig": {
640+
"description": "Image used by the wait-for-kubeconfig init container. Empty falls back to images/busybox.tag.",
641+
"type": "string",
642+
"default": ""
643+
}
644+
}
633645
}
634646
}
635647
}

‎packages/apps/kubernetes/values.yaml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -197,3 +197,10 @@ controlPlane:
197197
server:
198198
resources: {}
199199
resourcesPreset: "micro"
200+
201+
## @typedef {struct} Images - Optional image overrides for chart-internal helpers.
202+
## @field {string} [waitForKubeconfig] - Image used by the wait-for-kubeconfig init container. Empty falls back to images/busybox.tag.
203+
204+
## @param {Images} images - Optional image overrides for air-gapped or rate-limited registries.
205+
images:
206+
waitForKubeconfig: ""

0 commit comments

Comments
 (0)