DEVOPS-2693-lightrun-k-8-s-operator-add-ability-to-set-image-pull-policy-for-init-container

api/v1beta/lightrunjavaagent_types.go

@@ -17,6 +17,7 @@ limitations under the License.
 package v1beta
 
 import (
+	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 )
 
@@ -30,6 +31,8 @@ type InitContainer struct {
 	SharedVolumeMountPath string `json:"sharedVolumeMountPath"`
 	// Image of the init container. Image name and tag will define platform and version of the agent
 	Image string `json:"image"`
+	// Pull policy for the init container. Can be one of: Always, IfNotPresent, or Never.
+	ImagePullPolicy *corev1.PullPolicy `json:"imagePullPolicy,omitempty"`
 }
 
 // LightrunJavaAgentSpec defines the desired state of LightrunJavaAgent

charts/lightrun-agents/README.md

@@ -33,6 +33,7 @@ The values.yaml file includes the following configurable parameters for each Jav
 | `javaAgents[].containerSelector`                   | Selector for containers within the deployment to inject the Lightrun Java Agent.                                                                                                                                                                | Required                                                        |
 | `javaAgents[].deploymentName`                      | Name of the Kubernetes deployment to attach the Lightrun Java Agent.                                                                                                                                                                            | Required                                                        |
 | `javaAgents[].initContainer.image`                 | Image for the Lightrun Java Agent init container.                                                                                                                                                                                               | Required                                                        |
+| `javaAgents[].initContainer.imagePullPolicy`       | Image pull policy for the init container. Can be one of: Always, IfNotPresent, or Never.                                                                                                                                                        | Optional (if not provided, defaults to `"IfNotPresent"`)        |
 | `javaAgents[].initContainer.sharedVolumeMountPath` | Mount path for the shared volume in the init container.                                                                                                                                                                                         | Optional (if not provided, defaults to `"/lightrun"`"           |
 | `javaAgents[].initContainer.sharedVolumeName`      | Name of the shared volume for the init container.                                                                                                                                                                                               | Optional (if not provided, defaults to `"lightrun-agent-init"`" |
 | `javaAgents[].name`                                | Name of the Lightrun Java Agent custom resource.                                                                                                                                                                                                | Required                                                        |
@@ -91,6 +92,7 @@ javaAgents:
     serverHostname: 'lightrun.example.com'
     initContainer:
       image: "lightruncom/k8s-operator-init-java-agent-linux:latest"
+      imagePullPolicy: "IfNotPresent"
     agentPoolCredentials:
       existingSecret: ""
       apiKey: "xxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
@@ -104,6 +106,7 @@ javaAgents:
     namespace: 'my-namespace-2'
     initContainer:
       image: "lightruncom/k8s-operator-init-java-agent-linux:latest"
+      imagePullPolicy: "IfNotPresent"
     deploymentName: "my-deployment-2"
     containerSelector:
       - my-container-2
@@ -139,6 +142,7 @@ javaAgents:
     agentCliFlags: "--lightrun_extra_class_path=<PATH_TO_JAR>:<PATH_TO_JAR>,lightrun_init_wait_time_ms"
     initContainer:
       image: "lightruncom/k8s-operator-init-java-agent-linux:latest"
+      imagePullPolicy: "IfNotPresent"
       sharedVolumeName: 'my-shared-volume'
       sharedVolumeMountPath: '/mypath'
     agentPoolCredentials:
@@ -154,6 +158,7 @@ javaAgents:
     namespace: 'my-namespace-2'
     initContainer:
       image: "lightruncom/k8s-operator-init-java-agent-linux:latest"
+      imagePullPolicy: "IfNotPresent"
       sharedVolumeName: 'my-shared-volume'
       sharedVolumeMountPath: '/mypath'
     deploymentName: "my-deployment-2"

charts/lightrun-agents/templates/java-agent-cr.yaml

@@ -8,6 +8,7 @@ metadata:
 spec:
   initContainer:
     image: {{ .initContainer.image }}
+    imagePullPolicy: {{ .initContainer.imagePullPolicy | default "IfNotPresent" }}
     sharedVolumeName: {{ .initContainer.sharedVolumeName | default "lightrun-agent-init" }}
     sharedVolumeMountPath: {{ .initContainer.sharedVolumeMountPath | default "/lightrun" }}
   deploymentName: {{ .deploymentName }}

charts/lightrun-agents/values.yaml

@@ -17,6 +17,7 @@ javaAgents: []
 #    serverHostname: 'lightrun.example.com'
 #    initContainer:
 #      image: "lightruncom/k8s-operator-init-java-agent-linux:latest"
+#      imagePullPolicy: "IfNotPresent"
 #    agentPoolCredentials:
 #      existingSecret: ""
 #      apiKey: "xxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
@@ -30,6 +31,7 @@ javaAgents: []
 #    namespace: 'my-namespace-2'
 #    initContainer:
 #      image: "lightruncom/k8s-operator-init-java-agent-linux:latest"
+#      imagePullPolicy: "IfNotPresent"
 #    deploymentName: "my-deployment-2"
 #    containerSelector:
 #      - my-container-2
@@ -63,6 +65,7 @@ javaAgents: []
 #    agentCliFlags: "--lightrun_extra_class_path=<PATH_TO_JAR>:<PATH_TO_JAR>,lightrun_init_wait_time_ms"
 #    initContainer:
 #      image: "lightruncom/k8s-operator-init-java-agent-linux:latest"
+#      imagePullPolicy: "IfNotPresent"
 #      sharedVolumeName: 'my-shared-volume'
 #      sharedVolumeMountPath: '/mypath'
 #    agentPoolCredentials:
@@ -78,6 +81,7 @@ javaAgents: []
 #    namespace: 'my-namespace-2'
 #    initContainer:
 #      image: "lightruncom/k8s-operator-init-java-agent-linux:latest"
+#      imagePullPolicy: "IfNotPresent"
 #      sharedVolumeName: 'my-shared-volume'
 #      sharedVolumeMountPath: '/mypath'
 #    deploymentName: "my-deployment-2"

charts/lightrun-operator/crds/lightrunjavaagent_crd.yaml

@@ -93,6 +93,10 @@ spec:
                     description: Image of the init container. Image name and tag will
                       define platform and version of the agent
                     type: string
+                  imagePullPolicy:
+                    description: 'Pull policy for the init container. Can be one of:
+                      Always, IfNotPresent, or Never.'
+                    type: string
                   sharedVolumeMountPath:
                     description: Path in the app container where volume with agent
                       will be mounted

config/crd/bases/agents.lightrun.com_lightrunjavaagents.yaml

@@ -94,6 +94,10 @@ spec:
                     description: Image of the init container. Image name and tag will
                       define platform and version of the agent
                     type: string
+                  imagePullPolicy:
+                    description: 'Pull policy for the init container. Can be one of:
+                      Always, IfNotPresent, or Never.'
+                    type: string
                   sharedVolumeMountPath:
                     description: Path in the app container where volume with agent
                       will be mounted

config/samples/operator.yaml

@@ -105,6 +105,10 @@ spec:
                     description: Image of the init container. Image name and tag will
                       define platform and version of the agent
                     type: string
+                  imagePullPolicy:
+                    description: 'Pull policy for the init container. Can be one of:
+                      Always, IfNotPresent, or Never.'
+                    type: string
                   sharedVolumeMountPath:
                     description: Path in the app container where volume with agent
                       will be mounted

docs/custom_resource.md

@@ -16,6 +16,8 @@ spec:
     # Mount path where volume will be parked. Various distributions may have it's limitations.
     # For example you can't mount volumes to any path except `/tmp` when using AWS Fargate
     sharedVolumeMountPath: "/lightrun"
+    # imagePullPolicy for the init container. Can be one of: Always, IfNotPresent, or Never.
+    imagePullPolicy: "IfNotPresent"
   # Name of the deployment that you are going to patch.
   # Has to be in the same namespace
   deploymentName: app  

examples/operator.yaml

@@ -95,6 +95,10 @@ spec:
                     description: Image of the init container. Image name and tag will
                       define platform and version of the agent
                     type: string
+                  imagePullPolicy:
+                    description: 'Pull policy for the init container. Can be one of:
+                      Always, IfNotPresent, or Never.'
+                    type: string
                   sharedVolumeMountPath:
                     description: Path in the app container where volume with agent
                       will be mounted

internal/controller/patch_funcs.go

@@ -100,53 +100,57 @@ func (r *LightrunJavaAgentReconciler) addVolume(deploymentApplyConfig *appsv1ac.
 
 func (r *LightrunJavaAgentReconciler) addInitContainer(deploymentApplyConfig *appsv1ac.DeploymentApplyConfiguration, lightrunJavaAgent *agentv1beta.LightrunJavaAgent, secret *corev1.Secret) {
 
-	deploymentApplyConfig.Spec.Template.Spec.WithInitContainers(
-		corev1ac.Container().
-			WithName(initContainerName).
-			WithImage(lightrunJavaAgent.Spec.InitContainer.Image).
-			WithVolumeMounts(
-				corev1ac.VolumeMount().WithName(lightrunJavaAgent.Spec.InitContainer.SharedVolumeName).WithMountPath("/tmp/"),
-				corev1ac.VolumeMount().WithName(cmVolumeName).WithMountPath("/tmp/cm/"),
-			).WithEnv(
-			corev1ac.EnvVar().WithName("LIGHTRUN_KEY").WithValueFrom(
-				corev1ac.EnvVarSource().WithSecretKeyRef(
-					corev1ac.SecretKeySelector().WithName(secret.Name).WithKey("lightrun_key"),
-				),
+	icac := corev1ac.Container().
+		WithName(initContainerName).
+		WithImage(lightrunJavaAgent.Spec.InitContainer.Image).
+		WithVolumeMounts(
+			corev1ac.VolumeMount().WithName(lightrunJavaAgent.Spec.InitContainer.SharedVolumeName).WithMountPath("/tmp/"),
+			corev1ac.VolumeMount().WithName(cmVolumeName).WithMountPath("/tmp/cm/"),
+		).WithEnv(
+		corev1ac.EnvVar().WithName("LIGHTRUN_KEY").WithValueFrom(
+			corev1ac.EnvVarSource().WithSecretKeyRef(
+				corev1ac.SecretKeySelector().WithName(secret.Name).WithKey("lightrun_key"),
 			),
-			corev1ac.EnvVar().WithName("PINNED_CERT").WithValueFrom(
-				corev1ac.EnvVarSource().WithSecretKeyRef(
-					corev1ac.SecretKeySelector().WithName(secret.Name).WithKey("pinned_cert_hash"),
-				),
+		),
+		corev1ac.EnvVar().WithName("PINNED_CERT").WithValueFrom(
+			corev1ac.EnvVarSource().WithSecretKeyRef(
+				corev1ac.SecretKeySelector().WithName(secret.Name).WithKey("pinned_cert_hash"),
 			),
-			corev1ac.EnvVar().WithName("LIGHTRUN_SERVER").WithValue(lightrunJavaAgent.Spec.ServerHostname),
-		).
-			WithResources(
-				corev1ac.ResourceRequirements().
-					WithLimits(
-						corev1.ResourceList{
-							corev1.ResourceCPU:    *resource.NewMilliQuantity(int64(50), resource.BinarySI),
-							corev1.ResourceMemory: *resource.NewScaledQuantity(int64(64), resource.Scale(6)), // 500 * 10^6 = 500M
-						},
-					).WithRequests(
+		),
+		corev1ac.EnvVar().WithName("LIGHTRUN_SERVER").WithValue(lightrunJavaAgent.Spec.ServerHostname),
+	).
+		WithResources(
+			corev1ac.ResourceRequirements().
+				WithLimits(
 					corev1.ResourceList{
 						corev1.ResourceCPU:    *resource.NewMilliQuantity(int64(50), resource.BinarySI),
-						corev1.ResourceMemory: *resource.NewScaledQuantity(int64(64), resource.Scale(6)),
+						corev1.ResourceMemory: *resource.NewScaledQuantity(int64(64), resource.Scale(6)), // 500 * 10^6 = 500M
 					},
-				),
-			).
-			WithSecurityContext(
-				corev1ac.SecurityContext().
-					WithCapabilities(
-						corev1ac.Capabilities().WithDrop(corev1.Capability("ALL")),
-					).
-					WithAllowPrivilegeEscalation(false).
-					WithRunAsNonRoot(true).
-					WithSeccompProfile(
-						corev1ac.SeccompProfile().
-							WithType(corev1.SeccompProfileTypeRuntimeDefault),
-					),
+				).WithRequests(
+				corev1.ResourceList{
+					corev1.ResourceCPU:    *resource.NewMilliQuantity(int64(50), resource.BinarySI),
+					corev1.ResourceMemory: *resource.NewScaledQuantity(int64(64), resource.Scale(6)),
+				},
 			),
-	)
+		).
+		WithSecurityContext(
+			corev1ac.SecurityContext().
+				WithCapabilities(
+					corev1ac.Capabilities().WithDrop(corev1.Capability("ALL")),
+				).
+				WithAllowPrivilegeEscalation(false).
+				WithRunAsNonRoot(true).
+				WithSeccompProfile(
+					corev1ac.SeccompProfile().
+						WithType(corev1.SeccompProfileTypeRuntimeDefault),
+				),
+		)
+
+	if lightrunJavaAgent.Spec.InitContainer.ImagePullPolicy != nil {
+		icac.WithImagePullPolicy(*lightrunJavaAgent.Spec.InitContainer.ImagePullPolicy)
+	}
+
+	deploymentApplyConfig.Spec.Template.Spec.WithInitContainers(icac)
 }
 
 func (r *LightrunJavaAgentReconciler) patchAppContainers(lightrunJavaAgent *agentv1beta.LightrunJavaAgent, origDeployment *appsv1.Deployment, deploymentApplyConfig *appsv1ac.DeploymentApplyConfiguration) error {