Repository navigation
feat(atelet): pull actor images with dockerconfigjson Secrets - #540
Merged
Merged
Conversation
atelet pulls an actor's image itself, with the kubelet credential
providers of its node or anonymously. A registry that hands out static
credentials, as most private registries do, needs a provider binary on
every node just to read a username and a password, and a cluster whose
node image cannot be changed has no way to pull from it at all.
atelet now also reads .dockerconfigjson files, the content of a
kubernetes.io/dockerconfigjson Secret, through the repeatable
--image-pull-secret-file flag. Their credentials are matched to an image
like the kubelet matches a Pod's imagePullSecrets (the same URL globbing,
most specific key first, Docker Hub's aliases folded onto index.docker.io)
and are tried before the credential providers', as the kubelet tries a
Pod's pull secrets before the node's credentials. Every lookup reads the
files again, so a rotated Secret takes effect without a restart; a file
that does not parse at start-up is fatal, one that goes bad later is
logged and skipped.
The chart's atelet.imagePullSecrets takes the Secrets by name
([{name: ...}]), mounts each one read-only and passes its file. It is
separate from imagePullSecrets, which pull the chart's own pods.
Signed-off-by: Timo Derstappen <teemow@gmail.com>
(cherry picked from commit 999409c)
Signed-off-by: Timo Derstappen <teemow@gmail.com>
Signed-off-by: Timo Derstappen <teemow@gmail.com>
teemow
force-pushed
the
fork/atelet-dockerconfig-keychain
branch
from
October 23, 2026 09:55
efefc7f to
0cc0a45
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
atelet pulls an actor's image itself, with the kubelet credential providers of its node (
--image-credential-provider-config) or anonymously. There is noimagePullSecretpath: a registry that hands out static credentials needs a provider binary on every node just to read a username and a password, and a cluster whose node image cannot change cannot pull a session's private tool images at all.Proposed solution
The cherry-pick (
-x) of the upstream-ready commit on branchupstream/atelet-dockerconfig-keychain:.dockerconfigjsonfiles (akubernetes.io/dockerconfigjsonSecret's content) through the repeatable--image-pull-secret-fileflag. Credentials are matched like the kubelet matches a Pod'simagePullSecrets(the same URL globbing, most specific key first, Docker Hub's aliases folded ontoindex.docker.io) and tried before the credential providers', as the kubelet tries pull secrets before the node's credentials (credentialprovider.Chain).atelet.imagePullSecrets([{name: <secret>}], release namespace): each Secret mounted read-only at/run/image-pull-secrets/<name>(nosubPath, so rotation reaches the pod) and passed as a flag. Separate fromimagePullSecrets, which pull the chart's own pods.Acceptance criteria
go test -race ./cmd/atelet/internal/credentialprovider/(matching,authdecoding, file order and dedup, colliding keys, rotation, bad files, chain order) andgo test -run TestHelm ./cmd/atelet/(flags, mounts, volumes, a nameless entry refused).substratechart is byte-identical togiantswarm's: inert until a consumer sets the value../cmd/atelet/....fork/atelet-dockerconfig-keychain.md(to-file, branchupstream/atelet-dockerconfig-keychain);ledger-header.sh --completeclean.