Ensure pull secrets exist for operator when deploying in Konflux mode (#171)

Co-authored-by: Moritz Clasmeier <mclasmeier@redhat.com>

Author: mclasmeier

internal/deployer/deploy_via_operator.go

@@ -117,7 +117,8 @@ func (d *Deployer) ensureOperatorDeployed(ctx context.Context) error {
 func (d *Deployer) deployCentralOperator(ctx context.Context, resources, exposure string) error {
 	d.logger.Info("🚀 Deploying Central via Operator...")
 
-	if err := d.prepareNamespace(ctx, d.centralNamespace); err != nil {
+	needPullSecrets := env.GetCurrentClusterType() != env.InfraOpenShift4
+	if err := d.prepareNamespace(ctx, d.centralNamespace, needPullSecrets); err != nil {
 		return fmt.Errorf("failed to prepare namespace: %w", err)
 	}
 
@@ -185,14 +186,14 @@ func (d *Deployer) getDeployedOperatorImage(ctx context.Context) (string, error)
 }
 
 // prepareNamespace creates pull secrets in the namespace if needed
-func (d *Deployer) prepareNamespace(ctx context.Context, namespace string) error {
+func (d *Deployer) prepareNamespace(ctx context.Context, namespace string, needPullSecrets bool) error {
 	d.logger.Infof("Preparing namespace %s", namespace)
 
 	if err := d.ensureNamespaceExists(namespace); err != nil {
 		return err
 	}
 
-	if env.GetCurrentClusterType() != env.InfraOpenShift4 {
+	if needPullSecrets {
 		if err := d.ensurePullSecretExists(ctx, namespace); err != nil {
 			return fmt.Errorf("ensuring image pull secret exists: %w", err)
 		}
@@ -202,9 +203,11 @@ func (d *Deployer) prepareNamespace(ctx context.Context, namespace string) error
 }
 
 func (d *Deployer) ensurePullSecretExists(ctx context.Context, namespace string) error {
-	// Assemble pull secret YAML from pre-verified credentials
-	pullSecretYAML := d.dockerAuth.CreatePullSecretYAMLFromCredentials(d.dockerCreds, namespace)
+	if d.dockerCreds == nil {
+		return errors.New("no pull secrets available to set up on the cluster")
+	}
 
+	pullSecretYAML := d.dockerAuth.CreatePullSecretYAMLFromCredentials(*d.dockerCreds, namespace)
 	_, err := d.runKubectl(ctx, k8s.KubectlOptions{
 		Args:  []string{"apply", "-f", "-"},
 		Stdin: strings.NewReader(pullSecretYAML),
@@ -647,7 +650,8 @@ func (d *Deployer) configureCentralEndpoint(ctx context.Context, exposure string
 func (d *Deployer) deploySecuredClusterOperator(ctx context.Context, resources string) error {
 	d.logger.Info("🚀 Deploying SecuredCluster via Operator...")
 
-	if err := d.prepareNamespace(ctx, d.sensorNamespace); err != nil {
+	needPullSecrets := env.GetCurrentClusterType() != env.InfraOpenShift4
+	if err := d.prepareNamespace(ctx, d.sensorNamespace, needPullSecrets); err != nil {
 		return fmt.Errorf("failed to prepare namespace: %w", err)
 	}
 

internal/deployer/deployer.go

@@ -77,6 +77,7 @@ type Deployer struct {
 	dockerCreds               *dockerauth.Credentials
 	clusterResourceKinds      map[string]struct{}
 	tempDir                   string
+	useOperatorPullSecrets    bool
 }
 
 type ResourceToDelete struct {

internal/deployer/operator.go

@@ -319,12 +319,14 @@ func (d *Deployer) deployOperatorFromCSV(ctx context.Context, bundleDir string)
 	}
 
 	serviceAccountName := deploymentSpec["service_account"].(string)
+	d.useOperatorPullSecrets = d.useKonflux && env.GetCurrentClusterType() != env.InfraOpenShift4
 
 	d.logger.Info("📋 Operator deployment plan:")
 	d.logger.Dim(fmt.Sprintf("  • Namespace: %s", operatorNamespace))
 	d.logger.Dim(fmt.Sprintf("  • ServiceAccount: %s", serviceAccountName))
+	d.logger.Dim(fmt.Sprintf("  • Setting up pull secrets: %v", d.useOperatorPullSecrets))
 
-	if err := d.createOperatorNamespace(ctx); err != nil {
+	if err := d.prepareNamespace(ctx, operatorNamespace, d.useOperatorPullSecrets); err != nil {
 		return err
 	}
 
@@ -392,24 +394,6 @@ func (d *Deployer) parseCSVDeploymentSpec(csvFile string) (map[string]interface{
 	return deploymentSpec, nil
 }
 
-// createOperatorNamespace creates the operator namespace
-func (d *Deployer) createOperatorNamespace(ctx context.Context) error {
-	nsYAML := fmt.Sprintf(`apiVersion: v1
-kind: Namespace
-metadata:
-  name: %s
-  labels:
-    name: %s
-    app.kubernetes.io/managed-by: roxie
-`, operatorNamespace, operatorNamespace)
-
-	_, err := d.runKubectl(ctx, k8s.KubectlOptions{
-		Args:  []string{"apply", "-f", "-"},
-		Stdin: strings.NewReader(nsYAML),
-	})
-	return err
-}
-
 // createServiceAccount creates a service account
 func (d *Deployer) createServiceAccount(ctx context.Context, namespace, name string) error {
 	sa := map[string]interface{}{
@@ -422,6 +406,12 @@ func (d *Deployer) createServiceAccount(ctx context.Context, namespace, name str
 		},
 	}
 
+	if d.useOperatorPullSecrets {
+		sa["imagePullSecrets"] = []map[string]string{
+			{"name": "stackrox"},
+		}
+	}
+
 	yamlData, err := yaml.Marshal(sa)
 	if err != nil {
 		return fmt.Errorf("failed to marshal ServiceAccount '%s/%s': %w", namespace, name, err)

internal/deployer/operator_olm.go

@@ -40,7 +40,7 @@ func (d *Deployer) deployOperatorViaOLM(ctx context.Context) error {
 	indexImage := d.getOperatorIndexImage()
 	d.logger.Infof("Index image: %s", indexImage)
 
-	if err := d.createOperatorNamespace(ctx); err != nil {
+	if err := d.prepareNamespace(ctx, operatorNamespace, false); err != nil {
 		return err
 	}
 

internal/dockerauth/dockerauth.go

@@ -216,7 +216,7 @@ func (d *DockerAuth) VerifyCredentials(username, password string) error {
 }
 
 // CreatePullSecretYAMLFromCredentials creates Kubernetes pull secret YAML from verified credentials.
-func (d *DockerAuth) CreatePullSecretYAMLFromCredentials(creds *Credentials, namespace string) string {
+func (d *DockerAuth) CreatePullSecretYAMLFromCredentials(creds Credentials, namespace string) string {
 	// Create auth string
 	authString := fmt.Sprintf("%s:%s", creds.Username, creds.Password)
 	encodedAuth := base64.StdEncoding.EncodeToString([]byte(authString))

internal/dockerauth/dockerauth_test.go

@@ -31,7 +31,7 @@ func TestGetAndVerifyCredentialsFromEnv(t *testing.T) {
 	}
 
 	// Test creating YAML from credentials
-	yamlText := da.CreatePullSecretYAMLFromCredentials(creds, "ns")
+	yamlText := da.CreatePullSecretYAMLFromCredentials(*creds, "ns")
 
 	// Verify YAML structure
 	if !strings.Contains(yamlText, "apiVersion: v1") {