Skip to content
This repository was archived by the owner on Apr 10, 2024. It is now read-only.

Commit da0e8e2

Browse files
author
Jiang Huan
committed
Add option to patch all service accounts
1 parent 204bb6f commit da0e8e2

File tree

5 files changed

+107
-49
lines changed

5 files changed

+107
-49
lines changed

Diff for: ‎README.md

+4-7
Original file line numberDiff line numberDiff line change
@@ -5,10 +5,12 @@
55
![GitHub tag (latest SemVer)](https://img.shields.io/github/v/tag/titansoft-pte-ltd/imagepullsecret-patcher)
66
![GitHub issues](https://img.shields.io/github/issues/titansoft-pte-ltd/imagepullsecret-patcher)
77

8-
A simple Kubernetes [client-go](https://github.com/kubernetes/client-go) application that creates and patches imagePullSecrets to default service accounts in all Kubernetes namespaces to allow cluster-wide authenticated access to private container registry.
8+
A simple Kubernetes [client-go](https://github.com/kubernetes/client-go) application that creates and patches imagePullSecrets to service accounts in all Kubernetes namespaces to allow cluster-wide authenticated access to private container registry.
99

1010
![screenshot](doc/screenshot.png)
1111

12+
A blog post: https://medium.com/titansoft-engineering/kubernetes-cluster-wide-access-to-private-container-registry-with-imagepullsecret-patcher-b8b8fb79f7e5
13+
1214
## Installation and configuration
1315

1416
To install imagepullsecret-patcher, can refer to [deploy-example](deploy-example) as a quick-start.
@@ -19,6 +21,7 @@ Below is a table of available configurations:
1921
|-|-|-|-|-|
2022
| force | CONFIG_FORCE | -force | true | overwrite secrets when not match |
2123
| debug | CONFIG_DEBUG | -debug | false | show DEBUG logs |
24+
| all service account | CONFIG_ALLSERVICEACCOUNT | -allserviceaccount | false | if false, patch just default service account; if true, list and patch all service accounts |
2225
| dockerconfigjson | CONFIG_DOCKERCONFIGJSON | -dockerconfigjson | "" | json credential for authenicating container registry |
2326
| secret name | CONFIG_SECRETNAME | -secretname | "image-pull-secret" | name of managed secrets |
2427

@@ -47,12 +50,6 @@ kubectl patch serviceaccount default \
4750

4851
And it could be automated with a simple program like imagepullsecret-patcher.
4952

50-
## How
51-
52-
The imagepullsecret-patcher does two things: create a secret called `image-pull-secret` in all namespaces, and patch the `default` service accounts to use those secrets as imagePullSecrets.
53-
54-
![flowchart](doc/IMAGEPULLSECRET-PATCHER-v0.x.png)
55-
5653
## Contribute
5754

5855
Development Environment

Diff for: ‎deploy-example/kubernetes-manifest/2_deployment.yaml

+3-1
Original file line numberDiff line numberDiff line change
@@ -27,12 +27,14 @@ spec:
2727
serviceAccountName: imagepullsecret-patcher
2828
containers:
2929
- name: imagepullsecret-patcher
30-
image: "quay.io/titansoft/imagepullsecret-patcher:v0.8"
30+
image: "quay.io/titansoft/imagepullsecret-patcher:v0.9"
3131
env:
3232
- name: CONFIG_FORCE
3333
value: "true"
3434
- name: CONFIG_DEBUG
3535
value: "false"
36+
- name: CONFIG_ALLSERVICEACCOUNT
37+
value: "true"
3638
- name: CONFIG_DOCKERCONFIGJSON
3739
valueFrom:
3840
secretKeyRef:

Diff for: ‎go.sum

+15
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,7 @@ github.com/elazarl/goproxy v0.0.0-20170405201442-c4fc26588b6e/go.mod h1:/Zj4wYkg
2323
github.com/emicklei/go-restful v0.0.0-20170410110728-ff4f55a20633/go.mod h1:otzb+WCGbkyDHkqmQmT5YD2WR4BBwUdeQoFo8l/7tVs=
2424
github.com/evanphx/json-patch v4.2.0+incompatible h1:fUDGZCv/7iAN7u0puUVhvKCcsR6vRfwrJatElLBEf0I=
2525
github.com/evanphx/json-patch v4.2.0+incompatible/go.mod h1:50XU6AFN0ol/bzJsmQLiYLvXMP4fmwYFNcr97nuDLSk=
26+
github.com/fsnotify/fsnotify v1.4.7 h1:IXs+QLmnXW2CcXuY+8Mzv/fWEsPGWxqefPtCP5CnV9I=
2627
github.com/fsnotify/fsnotify v1.4.7/go.mod h1:jwhsz4b93w/PPRr/qN1Yymfu8t87LnFCMoQvtojpjFo=
2728
github.com/ghodss/yaml v0.0.0-20150909031657-73d445a93680/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04=
2829
github.com/go-logr/logr v0.1.0/go.mod h1:ixOQHD9gLJUVQQ2ZOR7zLEifBX6tGkNJF4QyIY7sIas=
@@ -43,6 +44,7 @@ github.com/golang/protobuf v1.3.2/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5y
4344
github.com/google/btree v0.0.0-20180813153112-4030bb1f1f0c/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ=
4445
github.com/google/btree v1.0.0/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ=
4546
github.com/google/go-cmp v0.2.0/go.mod h1:oXzfMopK8JAjlY9xF4vHSVASa0yLyX7SntLO5aqRK0M=
47+
github.com/google/go-cmp v0.3.0 h1:crn/baboCvb5fXaQ0IJ1SGTsTVrWpDsCWC8EGETZijY=
4648
github.com/google/go-cmp v0.3.0/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
4749
github.com/google/gofuzz v0.0.0-20161122191042-44d81051d367/go.mod h1:HP5RmnzzSNb993RKQDq4+1A4ia9nllfqcQFTQJedwGI=
4850
github.com/google/gofuzz v1.0.0 h1:A8PeW59pxE9IoFRqBp37U+mSNaQoZ46F1f0f863XSXw=
@@ -57,6 +59,7 @@ github.com/gophercloud/gophercloud v0.1.0/go.mod h1:vxM41WHh5uqHVBMZHzuwNOHh8XEo
5759
github.com/gregjones/httpcache v0.0.0-20180305231024-9cad4c3443a7/go.mod h1:FecbI9+v66THATjSRHfNgh1IVFe/9kFxbXtjV0ctIMA=
5860
github.com/hashicorp/golang-lru v0.5.0/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
5961
github.com/hashicorp/golang-lru v0.5.1/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
62+
github.com/hpcloud/tail v1.0.0 h1:nfCOvKYfkgYP8hkirhJocXT2+zOD8yUNjXaWfTlyFKI=
6063
github.com/hpcloud/tail v1.0.0/go.mod h1:ab1qPbhIpdTxEkNHXyeSf5vhxWSCs/tWer42PpOxQnU=
6164
github.com/imdario/mergo v0.3.5/go.mod h1:2EnlNZ0deacrJVfApfmtdGgDfMuh/nq6Ok1EcJh5FfA=
6265
github.com/json-iterator/go v0.0.0-20180612202835-f2b4162afba3/go.mod h1:+SdeFBvtyEkXs7REEP0seUULqWtbJapLOCVDaaPEHmU=
@@ -65,9 +68,12 @@ github.com/json-iterator/go v1.1.8/go.mod h1:KdQUCv79m/52Kvf8AW2vK1V8akMuk1QjK/u
6568
github.com/jstemmer/go-junit-report v0.0.0-20190106144839-af01ea7f8024/go.mod h1:6v2b51hI/fHJwM22ozAgKL4VKDeJcHhJFhtBdhmNjmU=
6669
github.com/kisielk/errcheck v1.2.0/go.mod h1:/BMXB+zMLi60iA8Vv6Ksmxu/1UDYcXs4uQLJ+jE2L00=
6770
github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
71+
github.com/konsorten/go-windows-terminal-sequences v1.0.1 h1:mweAR1A6xJ3oS2pRaGiHgQ4OO8tzTaLawm8vnODuwDk=
6872
github.com/konsorten/go-windows-terminal-sequences v1.0.1/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
73+
github.com/kr/pretty v0.1.0 h1:L/CwN0zerZDmRFUapSPitk6f+Q3+0za1rQkzVuMiMFI=
6974
github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
7075
github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
76+
github.com/kr/text v0.1.0 h1:45sCR5RtlFHMR4UwH9sdQ5TC8v0qDQCHnXt+kaKSTVE=
7177
github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
7278
github.com/mailru/easyjson v0.0.0-20160728113105-d5b7844b561a/go.mod h1:C1wdFJiN94OJF2b5HbByQZoLdCWB1Yqtg26g4irojpc=
7379
github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
@@ -81,22 +87,27 @@ github.com/munnerz/goautoneg v0.0.0-20120707110453-a547fc61f48d/go.mod h1:+n7T8m
8187
github.com/mxk/go-flowrate v0.0.0-20140419014527-cca7078d478f/go.mod h1:ZdcZmHo+o7JKHSa8/e818NopupXU1YMK5fe1lsApnBw=
8288
github.com/onsi/ginkgo v0.0.0-20170829012221-11459a886d9c/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
8389
github.com/onsi/ginkgo v1.6.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
90+
github.com/onsi/ginkgo v1.10.1 h1:q/mM8GF/n0shIN8SaAZ0V+jnLPzen6WIVZdiwrRlMlo=
8491
github.com/onsi/ginkgo v1.10.1/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
8592
github.com/onsi/gomega v0.0.0-20170829124025-dcabb60a477c/go.mod h1:C1qb7wdrVGGVU+Z6iS04AVkA3Q65CEZX59MT0QO5uiA=
93+
github.com/onsi/gomega v1.7.0 h1:XPnZz8VVBHjVsy1vzJmRwIcSwiUO+JFfrv/xGiigmME=
8694
github.com/onsi/gomega v1.7.0/go.mod h1:ex+gbHU/CVuBBDIJjb2X0qEXbFg53c61hWP/1CpauHY=
8795
github.com/peterbourgon/diskv v2.0.1+incompatible/go.mod h1:uqqh8zWWbv1HBMNONnaR/tNboyR3/BZd58JJSHlUSCU=
8896
github.com/pmezard/go-difflib v0.0.0-20151028094244-d8ed2627bdf0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
97+
github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
8998
github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
9099
github.com/sirupsen/logrus v1.4.2 h1:SPIRibHv4MatM3XXNO2BJeFLZwZ2LvZgfQ5+UNI2im4=
91100
github.com/sirupsen/logrus v1.4.2/go.mod h1:tLMulIdttU9McNUspp0xgXVQah82FyeX6MwdIuYE2rE=
92101
github.com/spf13/afero v1.2.2/go.mod h1:9ZxEEn6pIJ8Rxe320qSDBk6AsU0r9pR7Q4OcevTdifk=
93102
github.com/spf13/pflag v0.0.0-20170130214245-9ff6c6923cff/go.mod h1:DYY7MBk1bdzusC3SYhjObp+wFpr4gzcvqqNjLnInEg4=
103+
github.com/spf13/pflag v1.0.5 h1:iy+VFUOCP1a+8yFto/drg2CJ5u0yRoB7fZw3DKv/JXA=
94104
github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
95105
github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
96106
github.com/stretchr/objx v0.1.1/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
97107
github.com/stretchr/testify v0.0.0-20151208002404-e3a8ff8ce365/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
98108
github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
99109
github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
110+
github.com/stretchr/testify v1.4.0 h1:2E4SXV/wtOkTonXsotYi4li6zVWxYlZuYNCXe9XRJyk=
100111
github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
101112
go.opencensus.io v0.21.0/go.mod h1:mSImk1erAIZhrmZN+AvHh14ztQfjbGwt4TtuofqLduU=
102113
golang.org/x/crypto v0.0.0-20190211182817-74369b46fc67/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
@@ -151,16 +162,20 @@ golang.org/x/tools v0.0.0-20190312170243-e65039ee4138/go.mod h1:LCzVGOaR6xXOjkQ3
151162
google.golang.org/api v0.4.0/go.mod h1:8k5glujaEP+g9n7WNsDg8QP6cUVNI86fCNMcbazEtwE=
152163
google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
153164
google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
165+
google.golang.org/appengine v1.5.0 h1:KxkO13IPW4Lslp2bz+KHP2E3gtFlrIGNThxkZQ3g+4c=
154166
google.golang.org/appengine v1.5.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
155167
google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc=
156168
google.golang.org/genproto v0.0.0-20190307195333-5fe7a883aa19/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE=
157169
google.golang.org/genproto v0.0.0-20190418145605-e7d98fc518a7/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE=
158170
google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
159171
gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
172+
gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127 h1:qIbj1fsPNlZgppZ+VLlY7N33q108Sa+fhmuc+sWQYwY=
160173
gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
174+
gopkg.in/fsnotify.v1 v1.4.7 h1:xOHLXZwVvI9hhs+cLKq5+I5onOuwQLhQwiu63xxlHs4=
161175
gopkg.in/fsnotify.v1 v1.4.7/go.mod h1:Tz8NjZHkW78fSQdbUxIjBTcgA1z1m8ZHf0WmKUhAMys=
162176
gopkg.in/inf.v0 v0.9.1 h1:73M5CoZyi3ZLMOyDlQh031Cx6N9NDJ2Vvfl76EDAgDc=
163177
gopkg.in/inf.v0 v0.9.1/go.mod h1:cWUDdTG/fYaXco+Dcufb5Vnc6Gp2YChqWtbxRZE0mXw=
178+
gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7 h1:uRGJdciOHaEIrze2W8Q3AKkepLTh2hOroT7a+7czfdQ=
164179
gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7/go.mod h1:dt/ZhP58zS4L8KSrWDmTeBkI65Dw0HsyUHuEVlX15mw=
165180
gopkg.in/yaml.v2 v2.2.1/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
166181
gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=

Diff for: ‎main.go

+26-18
Original file line numberDiff line numberDiff line change
@@ -14,10 +14,11 @@ import (
1414
)
1515

1616
var (
17-
configForce bool = true
18-
configDebug bool = false
19-
configDockerconfigjson string = ""
20-
configSecretName string = "image-pull-secret" // default to image-pull-secret
17+
configForce bool = true
18+
configDebug bool = false
19+
configAllServiceAccount bool = false
20+
configDockerconfigjson string = ""
21+
configSecretName string = "image-pull-secret" // default to image-pull-secret
2122
)
2223

2324
type k8sClient struct {
@@ -28,6 +29,7 @@ func main() {
2829
// parse flags
2930
flag.BoolVar(&configForce, "force", LookUpEnvOrBool("CONFIG_FORCE", configForce), "force to overwrite secrets when not match")
3031
flag.BoolVar(&configDebug, "debug", LookUpEnvOrBool("CONFIG_DEBUG", configDebug), "show DEBUG logs")
32+
flag.BoolVar(&configAllServiceAccount, "allserviceaccount", LookUpEnvOrBool("CONFIG_ALLSERVICEACCOUNT", configAllServiceAccount), "if false, patch just default service account; if true, list and patch all service accounts")
3133
flag.StringVar(&configDockerconfigjson, "dockerconfigjson", LookupEnvOrString("CONFIG_DOCKERCONFIGJSON", configDockerconfigjson), "json credential for authenicating container registry")
3234
flag.StringVar(&configSecretName, "secretname", LookupEnvOrString("CONFIG_SECRETNAME", configSecretName), "set name of managed secrets")
3335
flag.Parse()
@@ -120,22 +122,28 @@ func processSecret(k8s *k8sClient, namespace string) error {
120122
}
121123

122124
func processServiceAccount(k8s *k8sClient, namespace string) error {
123-
sa, err := k8s.clientset.CoreV1().ServiceAccounts(namespace).Get(defaultServiceAccountName, metav1.GetOptions{})
125+
sas, err := k8s.clientset.CoreV1().ServiceAccounts(namespace).List(metav1.ListOptions{})
124126
if err != nil {
125-
return fmt.Errorf("[%s] Failed to get service account [%s]: %v", namespace, defaultServiceAccountName, err)
127+
return fmt.Errorf("[%s] Failed to list service accounts: %v", namespace, err)
126128
}
127-
if includeImagePullSecret(sa, configSecretName) {
128-
log.Debugf("[%s] ImagePullSecrets found", namespace)
129-
return nil
130-
}
131-
patch, err := getPatchString(sa, configSecretName)
132-
if err != nil {
133-
return fmt.Errorf("[%s] Failed to get patch string: %v", namespace, err)
134-
}
135-
_, err = k8s.clientset.CoreV1().ServiceAccounts(namespace).Patch(defaultServiceAccountName, types.StrategicMergePatchType, patch)
136-
if err != nil {
137-
return fmt.Errorf("[%s] Failed to patch imagePullSecrets to service account [%s]: %v", namespace, defaultServiceAccountName, err)
129+
for _, sa := range sas.Items {
130+
if !configAllServiceAccount && sa.Name != defaultServiceAccountName {
131+
log.Debugf("[%s] Skip non-default service account [%s]", namespace, sa.Name)
132+
continue
133+
}
134+
if includeImagePullSecret(&sa, configSecretName) {
135+
log.Debugf("[%s] ImagePullSecrets found", namespace)
136+
continue
137+
}
138+
patch, err := getPatchString(&sa, configSecretName)
139+
if err != nil {
140+
return fmt.Errorf("[%s] Failed to get patch string: %v", namespace, err)
141+
}
142+
_, err = k8s.clientset.CoreV1().ServiceAccounts(namespace).Patch(sa.Name, types.StrategicMergePatchType, patch)
143+
if err != nil {
144+
return fmt.Errorf("[%s] Failed to patch imagePullSecrets to service account [%s]: %v", namespace, sa.Name, err)
145+
}
146+
log.Infof("[%s] Patched imagePullSecrets to service account [%s]", namespace, sa.Name)
138147
}
139-
log.Infof("[%s] Patched imagePullSecrets to service account [%s]", namespace, defaultServiceAccountName)
140148
return nil
141149
}

Diff for: ‎main_test.go

+59-23
Original file line numberDiff line numberDiff line change
@@ -65,36 +65,60 @@ var testCasesProcessServiceAccount = []testCase{
6565
{
6666
name: "no image pull secret",
6767
prepSteps: []step{
68-
helperCreateServiceAccountWithoutImagePullSecret,
69-
assertHasError(assertHasImagePullSecret(configSecretName)),
68+
helperCreateServiceAccountWithoutImagePullSecret(defaultServiceAccountName),
69+
assertHasError(assertHasImagePullSecret(configSecretName, defaultServiceAccountName)),
7070
},
7171
testSteps: []step{
7272
processServiceAccountDefault,
73-
assertHasImagePullSecret(configSecretName),
73+
assertHasImagePullSecret(configSecretName, defaultServiceAccountName),
7474
},
7575
},
7676
{
7777
name: "has same image pull secret",
7878
prepSteps: []step{
79-
helperCreateServiceAccountWithImagePullSecret(configSecretName),
80-
assertHasImagePullSecret(configSecretName),
79+
helperCreateServiceAccountWithImagePullSecret(configSecretName, defaultServiceAccountName),
80+
assertHasImagePullSecret(configSecretName, defaultServiceAccountName),
8181
},
8282
testSteps: []step{
8383
processServiceAccountDefault,
84-
assertHasImagePullSecret(configSecretName),
84+
assertHasImagePullSecret(configSecretName, defaultServiceAccountName),
8585
},
8686
},
8787
{
8888
name: "has different image pull secret",
8989
prepSteps: []step{
90-
helperCreateServiceAccountWithImagePullSecret("other-secret"),
91-
assertHasImagePullSecret("other-secret"),
92-
assertHasError(assertHasImagePullSecret(configSecretName)),
90+
helperCreateServiceAccountWithImagePullSecret("other-secret", defaultServiceAccountName),
91+
assertHasImagePullSecret("other-secret", defaultServiceAccountName),
92+
assertHasError(assertHasImagePullSecret(configSecretName, defaultServiceAccountName)),
9393
},
9494
testSteps: []step{
9595
processServiceAccountDefault,
96-
assertHasImagePullSecret("other-secret"),
97-
assertHasImagePullSecret(configSecretName),
96+
assertHasImagePullSecret("other-secret", defaultServiceAccountName),
97+
assertHasImagePullSecret(configSecretName, defaultServiceAccountName),
98+
},
99+
},
100+
{
101+
name: "non-default service account - skip when allServiceAccount off",
102+
prepSteps: []step{
103+
helperAllServiceAccountOff,
104+
helperCreateServiceAccountWithoutImagePullSecret("other-service-account"),
105+
assertHasError(assertHasImagePullSecret(configSecretName, "other-service-account")),
106+
},
107+
testSteps: []step{
108+
processServiceAccountDefault,
109+
assertHasError(assertHasImagePullSecret(configSecretName, "other-service-account")),
110+
},
111+
},
112+
{
113+
name: "non-default service account - patch when allServiceAccount on",
114+
prepSteps: []step{
115+
helperAllServiceAccountOn,
116+
helperCreateServiceAccountWithoutImagePullSecret("other-service-account"),
117+
assertHasError(assertHasImagePullSecret(configSecretName, "other-service-account")),
118+
},
119+
testSteps: []step{
120+
processServiceAccountDefault,
121+
assertHasImagePullSecret(configSecretName, "other-service-account"),
98122
},
99123
},
100124
}
@@ -170,21 +194,23 @@ func helperCreateOpaqueSecret(k8s *k8sClient) error {
170194
return err
171195
}
172196

173-
func helperCreateServiceAccountWithoutImagePullSecret(k8s *k8sClient) error {
174-
_, err := k8s.clientset.CoreV1().ServiceAccounts(v1.NamespaceDefault).Create(&v1.ServiceAccount{
175-
ObjectMeta: metav1.ObjectMeta{
176-
Name: defaultServiceAccountName,
177-
Namespace: v1.NamespaceDefault,
178-
},
179-
})
180-
return err
197+
func helperCreateServiceAccountWithoutImagePullSecret(serviceAccountName string) step {
198+
return func(k8s *k8sClient) error {
199+
_, err := k8s.clientset.CoreV1().ServiceAccounts(v1.NamespaceDefault).Create(&v1.ServiceAccount{
200+
ObjectMeta: metav1.ObjectMeta{
201+
Name: serviceAccountName,
202+
Namespace: v1.NamespaceDefault,
203+
},
204+
})
205+
return err
206+
}
181207
}
182208

183-
func helperCreateServiceAccountWithImagePullSecret(secretName string) step {
209+
func helperCreateServiceAccountWithImagePullSecret(secretName, serviceAccountName string) step {
184210
return func(k8s *k8sClient) error {
185211
_, err := k8s.clientset.CoreV1().ServiceAccounts(v1.NamespaceDefault).Create(&v1.ServiceAccount{
186212
ObjectMeta: metav1.ObjectMeta{
187-
Name: defaultServiceAccountName,
213+
Name: serviceAccountName,
188214
Namespace: v1.NamespaceDefault,
189215
},
190216
ImagePullSecrets: []v1.LocalObjectReference{
@@ -207,6 +233,16 @@ func helperForceOff(_ *k8sClient) error {
207233
return nil
208234
}
209235

236+
func helperAllServiceAccountOn(_ *k8sClient) error {
237+
configAllServiceAccount = true
238+
return nil
239+
}
240+
241+
func helperAllServiceAccountOff(_ *k8sClient) error {
242+
configAllServiceAccount = false
243+
return nil
244+
}
245+
210246
// a set of assertion functions
211247
func assertNoSecret(k8s *k8sClient) error {
212248
_, err := k8s.clientset.CoreV1().Secrets(v1.NamespaceDefault).Get(configSecretName, metav1.GetOptions{})
@@ -250,9 +286,9 @@ func assertHasError(fn step) step {
250286
}
251287
}
252288

253-
func assertHasImagePullSecret(secretName string) step {
289+
func assertHasImagePullSecret(secretName, serviceAccountName string) step {
254290
return func(k8s *k8sClient) error {
255-
sa, err := k8s.clientset.CoreV1().ServiceAccounts(v1.NamespaceDefault).Get(defaultServiceAccountName, metav1.GetOptions{})
291+
sa, err := k8s.clientset.CoreV1().ServiceAccounts(v1.NamespaceDefault).Get(serviceAccountName, metav1.GetOptions{})
256292
if err != nil {
257293
return err
258294
}

0 commit comments

Comments
 (0)