This is an automated email from the ASF dual-hosted git repository.
squakez pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/camel-k.git
The following commit(s) were added to refs/heads/main by this push:
new 264394a74 feat: explicit registry setting
264394a74 is described below
commit 264394a74815ae8c476b8aeae6d666e98322352f
Author: Pasquale Congiusti <[email protected]>
AuthorDate: Sat Aug 15 10:10:50 2026 +0200
feat: explicit registry setting
* Remove the older REGISTRY_SVC name and namespace env var
* Remove the related RBAC required
* Revert pull secret removal of platform secret usage, and provided a
deprecation notice instead
* Forcing the user to explicitly set the registry configuration
* E2E test to include an hardened registry (auth required)
* E2E test to automatically copy the operator registry secret into test
namespace and add a pull-secret conf
---
.github/actions/infra-setting/action.yml | 14 +--
.github/actions/registry-setting/action.yml | 47 +++++++++
.github/actions/registry-setting/registry.yaml | 93 ++++++++++++++++++
.github/workflows/common.yml | 47 ++++++++-
.github/workflows/gateway.yml | 9 +-
.github/workflows/install.yml | 11 +++
.github/workflows/kafka.yml | 9 +-
.github/workflows/knative.yml | 9 +-
.github/workflows/native.yml | 9 +-
.github/workflows/nightly-install-olm.yml | 11 +++
.github/workflows/nightly-multi.yml | 18 +++-
.github/workflows/telemetry.yml | 9 +-
.../ROOT/pages/installation/installation.adoc | 22 +++--
docs/modules/ROOT/pages/installation/registry.adoc | 12 +--
.../installation/registry/special/minikube.adoc | 21 +++-
.../pages/installation/registry/special/own.adoc | 3 +-
docs/modules/ROOT/partials/apis/camel-k-crds.adoc | 12 +--
docs/modules/traits/pages/pull-secret.adoc | 12 +--
e2e/common/misc/client_test.go | 69 -------------
e2e/common/traits/pull_secret_test.go | 86 ----------------
e2e/install/helm/setup_test.go | 37 ++++---
e2e/install/kustomize/multi_namespace_test.go | 8 +-
e2e/install/kustomize/single_namespace_test.go | 6 +-
e2e/install/upgrade/upgrade_test.go | 53 +++++++---
e2e/kafka/kafka_autoscale_keda_test.go | 20 ++--
e2e/kafka/kafka_binding_test.go | 21 ++--
e2e/knative/knative_pipes_test.go | 2 +
e2e/support/test_support.go | 108 ++++++++++++++++++++-
e2e/support/test_util.go | 5 +-
helm/camel-k/README.md | 19 +---
helm/camel-k/crds/camel-k-crds.yaml | 32 ++----
helm/camel-k/templates/operator-deployment.yaml | 14 ++-
helm/camel-k/templates/rbacs-common.yaml | 31 ------
pkg/apis/camel/v1/trait/pull_secret.go | 12 +--
pkg/builder/jib.go | 3 +-
pkg/builder/jib_test.go | 6 +-
pkg/cmd/operator/operator.go | 24 +++++
pkg/controller/build/build_pod.go | 28 +++++-
pkg/controller/integration/build.go | 10 --
pkg/install/optional.go | 18 ----
pkg/platform/env_platform.go | 9 +-
.../camel.apache.org_integrationplatforms.yaml | 8 +-
.../camel.apache.org_integrationprofiles.yaml | 8 +-
.../crd/bases/camel.apache.org_integrations.yaml | 8 +-
.../config/crd/bases/camel.apache.org_pipes.yaml | 8 +-
.../config/manager/add-registry-envvars.yaml | 40 --------
pkg/resources/config/manager/kustomization.yaml | 6 --
pkg/resources/config/rbac/kustomization.yaml | 2 -
.../config/rbac/registry-clusterrole-binding.yaml | 30 ------
.../config/rbac/registry-clusterrole.yaml | 28 ------
pkg/trait/pull_secret.go | 17 +++-
pkg/util/jib/configuration.go | 4 +
pkg/util/log/log.go | 8 +-
pkg/util/registry/registry.go | 30 +++++-
pkg/util/registry/registry_test.go | 38 ++++++++
script/Makefile | 16 ---
56 files changed, 678 insertions(+), 562 deletions(-)
diff --git a/.github/actions/infra-setting/action.yml
b/.github/actions/infra-setting/action.yml
index fda7dfe67..d734dcfc0 100644
--- a/.github/actions/infra-setting/action.yml
+++ b/.github/actions/infra-setting/action.yml
@@ -22,18 +22,13 @@ runs:
using: "composite"
steps:
- - id: setup-jdk
- name: Set up JDK
- uses: actions/setup-java@v5
- with:
- java-version: '17'
- distribution: 'temurin'
- id: setup-go
name: Set up Go
uses: actions/setup-go@v6
with:
go-version-file: 'go.mod'
check-latest: true
+
- id: setup-kubectl
name: Set up Kubectl
uses: azure/setup-kubectl@829323503d1be3d00ca8346e5391ca0b07a9ab0d
@@ -41,16 +36,15 @@ runs:
name: Start minikube
uses: medyagh/[email protected]
with:
- addons: registry
cpus: max
memory: max
+
- id: minikube-settings
name: Set docker-env
shell: bash
run: |
eval $(minikube -p minikube docker-env)
- echo "KAMEL_INSTALL_REGISTRY=$(kubectl -n kube-system get service
registry -o jsonpath='{.spec.clusterIP}')" >> $GITHUB_ENV
- echo "Setting registry as $KAMEL_INSTALL_REGISTRY which is required by
certain tests"
- echo "LAST_RELEASED_VERSION=$(make get-last-released-version)" >>
$GITHUB_ENV
+ LAST_RELEASED_VERSION=$(make get-last-released-version)
+ echo "LAST_RELEASED_VERSION=$LAST_RELEASED_VERSION" >> $GITHUB_ENV
echo "Setting last released version as as $LAST_RELEASED_VERSION which
is required by certain tests"
NOTEST=true make images
diff --git a/.github/actions/registry-setting/action.yml
b/.github/actions/registry-setting/action.yml
new file mode 100644
index 000000000..8b5bc36ed
--- /dev/null
+++ b/.github/actions/registry-setting/action.yml
@@ -0,0 +1,47 @@
+# ---------------------------------------------------------------------------
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+# ---------------------------------------------------------------------------
+
+name: registry-setting
+description: 'Setting registry'
+
+runs:
+ using: "composite"
+
+ steps:
+ - id: registry-settings
+ name: Create an auth secured registry
+ shell: bash
+ run: |
+ kubectl create ns registry
+ kubectl apply -f .github/actions/registry-setting/registry.yaml -n
registry
+ kubectl wait --for=condition=available deployment/registry -n registry
--timeout=60s
+ KAMEL_INSTALL_REGISTRY="$(kubectl -n registry get service registry -o
jsonpath='{.spec.clusterIP}')"
+ echo "KAMEL_INSTALL_REGISTRY=$KAMEL_INSTALL_REGISTRY" >> "$GITHUB_ENV"
+ echo "Setting registry as $KAMEL_INSTALL_REGISTRY which is required by
certain tests"
+ kubectl create secret docker-registry my-registry \
+ --docker-server $KAMEL_INSTALL_REGISTRY \
+ --docker-username admin \
+ --docker-password password \
+ -n camel-k
+ kubectl create configmap camel-k-operator-configmap-configuration \
+ --from-literal=REGISTRY_ADDRESS="$KAMEL_INSTALL_REGISTRY" \
+ --from-literal=REGISTRY_INSECURE="true" \
+ --from-literal=REGISTRY_SECRET="my-registry" \
+ -n camel-k
+ E2E_TEST_REGISTRY_SECRET_COPY=true
+ echo "E2E_TEST_REGISTRY_SECRET_COPY=$E2E_TEST_REGISTRY_SECRET_COPY" >>
$GITHUB_ENV
+ echo "Setting E2E_TEST_REGISTRY_SECRET_COPY=true in order to automate
the copy of the pull secret and the setting in each test"
diff --git a/.github/actions/registry-setting/registry.yaml
b/.github/actions/registry-setting/registry.yaml
new file mode 100644
index 000000000..257f0b510
--- /dev/null
+++ b/.github/actions/registry-setting/registry.yaml
@@ -0,0 +1,93 @@
+# ---------------------------------------------------------------------------
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+# ---------------------------------------------------------------------------
+
+---
+apiVersion: v1
+kind: Service
+metadata:
+ name: registry
+spec:
+ selector:
+ app: registry
+ ports:
+ - name: http
+ port: 80
+ protocol: TCP
+ targetPort: 5000
+ - name: https
+ port: 443
+ protocol: TCP
+ targetPort: 443
+
+---
+apiVersion: v1
+kind: Secret
+metadata:
+ name: registry-auth
+type: Opaque
+stringData:
+ htpasswd: |
+ admin:$2y$05$b8N7UpPbxfFRppWxO5bEXOrKdryg/DUPpQ9xXpKPsGKikeAMzrSHe
+
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+ name: registry
+spec:
+ selector:
+ matchLabels:
+ app: registry
+ template:
+ metadata:
+ labels:
+ app: registry
+ spec:
+ containers:
+ - name: registry
+ image: registry:3
+ env:
+ - name: REGISTRY_STORAGE_FILESYSTEM_ROOTDIRECTORY
+ value: /registry-data
+ - name: REGISTRY_AUTH
+ value: htpasswd
+ - name: REGISTRY_AUTH_HTPASSWD_REALM
+ value: Registry Realm
+ - name: REGISTRY_AUTH_HTPASSWD_PATH
+ value: /auth/htpasswd
+ ports:
+ - containerPort: 5000
+ name: registry
+ volumeMounts:
+ - name: registry-data
+ mountPath: /registry-data
+ - name: registry-auth
+ mountPath: /auth
+ readOnly: true
+ resources:
+ requests:
+ cpu: "100m"
+ memory: "128Mi"
+ limits:
+ cpu: "500m"
+ memory: "512Mi"
+ volumes:
+ - name: registry-data
+ emptyDir: {}
+ - name: registry-auth
+ secret:
+ secretName: registry-auth
diff --git a/.github/workflows/common.yml b/.github/workflows/common.yml
index 6cd6037fa..bd4aa8268 100644
--- a/.github/workflows/common.yml
+++ b/.github/workflows/common.yml
@@ -70,12 +70,35 @@ jobs:
- name: Infra setting
uses: ./.github/actions/infra-setting
- - name: Install operator
+ - name: Create operator namespace
shell: bash
run: |
kubectl create ns camel-k
+
+ - name: Registry setting
+ uses: ./.github/actions/registry-setting
+
+ - name: Install operator
+ shell: bash
+ run: |
make install-k8s-global
- make install-registry
+
+ cat <<EOF | kubectl apply -f -
+ apiVersion: camel.apache.org/v1
+ kind: IntegrationPlatform
+ metadata:
+ name: camel-k
+ namespace: camel-k
+ labels:
+ app: "camel-k"
+ spec:
+ build:
+ registry:
+ address: $KAMEL_INSTALL_REGISTRY
+ secret: my-registry
+ insecure: true
+ EOF
+
kubectl wait --for=jsonpath='{.status.phase}'=Ready itp camel-k -n
camel-k --timeout=60s
- name: Run test
@@ -97,10 +120,17 @@ jobs:
- name: Infra setting
uses: ./.github/actions/infra-setting
- - name: Install operator
+ - name: Create operator namespace
shell: bash
run: |
kubectl create ns camel-k
+
+ - name: Registry setting
+ uses: ./.github/actions/registry-setting
+
+ - name: Install operator
+ shell: bash
+ run: |
kubectl apply -k install/overlays/all-namespaces/ --server-side
--force-conflicts
kubectl wait --for=condition=available deployment/camel-k-operator -n
camel-k --timeout=60s
# Install Apache Kamelets catalog
@@ -124,6 +154,17 @@ jobs:
- name: Infra setting
uses: ./.github/actions/infra-setting
+ - name: Create registry secret namespace
+ shell: bash
+ run: |
+ kubectl create ns camel-k
+ E2E_TEST_REGISTRY_CONFIG_COPY=true
+ echo "E2E_TEST_REGISTRY_CONFIG_COPY=$E2E_TEST_REGISTRY_CONFIG_COPY" >>
$GITHUB_ENV
+ echo "Setting E2E_TEST_REGISTRY_CONFIG_COPY=true in order to automate
the copy of the registry config for operator install"
+
+ - name: Registry setting
+ uses: ./.github/actions/registry-setting
+
- name: Install CRDs
shell: bash
run: |
diff --git a/.github/workflows/gateway.yml b/.github/workflows/gateway.yml
index 56d3d6790..e3f29074f 100644
--- a/.github/workflows/gateway.yml
+++ b/.github/workflows/gateway.yml
@@ -72,10 +72,17 @@ jobs:
run: |
./e2e/gateway/setup/setup.sh
- - name: Install operator
+ - name: Create operator namespace
shell: bash
run: |
kubectl create ns camel-k
+
+ - name: Registry setting
+ uses: ./.github/actions/registry-setting
+
+ - name: Install operator
+ shell: bash
+ run: |
make install-k8s-global
- name: Run test
diff --git a/.github/workflows/install.yml b/.github/workflows/install.yml
index 4bba6055c..88ca48c9a 100644
--- a/.github/workflows/install.yml
+++ b/.github/workflows/install.yml
@@ -85,6 +85,17 @@ jobs:
run: |
make release-helm
+ - name: Create registry secret namespace
+ shell: bash
+ run: |
+ kubectl create ns camel-k
+ E2E_TEST_REGISTRY_CONFIG_COPY=true
+ echo "E2E_TEST_REGISTRY_CONFIG_COPY=$E2E_TEST_REGISTRY_CONFIG_COPY" >>
$GITHUB_ENV
+ echo "Setting E2E_TEST_REGISTRY_CONFIG_COPY=true in order to automate
the copy of the registry config for operator install"
+
+ - name: Registry setting
+ uses: ./.github/actions/registry-setting
+
- name: Run tests
shell: bash
run: |
diff --git a/.github/workflows/kafka.yml b/.github/workflows/kafka.yml
index ac8dd82dd..1481627e1 100644
--- a/.github/workflows/kafka.yml
+++ b/.github/workflows/kafka.yml
@@ -72,10 +72,17 @@ jobs:
run: |
./e2e/kafka/setup/setup.sh
- - name: Install operator
+ - name: Create operator namespace
shell: bash
run: |
kubectl create ns camel-k
+
+ - name: Registry setting
+ uses: ./.github/actions/registry-setting
+
+ - name: Install operator
+ shell: bash
+ run: |
make install-k8s-global
- name: Run test
diff --git a/.github/workflows/knative.yml b/.github/workflows/knative.yml
index 6520d0ed1..acbe222c4 100644
--- a/.github/workflows/knative.yml
+++ b/.github/workflows/knative.yml
@@ -72,10 +72,17 @@ jobs:
run: |
./e2e/knative/files/setup.sh
- - name: Install operator
+ - name: Create operator namespace
shell: bash
run: |
kubectl create ns camel-k
+
+ - name: Registry setting
+ uses: ./.github/actions/registry-setting
+
+ - name: Install operator
+ shell: bash
+ run: |
make install-k8s-global
# Install Apache Kamelets catalog
mvn -q dependency:copy
-Dartifact=org.apache.camel.kamelets:camel-kamelets:4.18.1:jar
-Dmdep.useBaseVersion=true -DoutputDirectory=/tmp
diff --git a/.github/workflows/native.yml b/.github/workflows/native.yml
index e61fd0ae3..ab1b80de9 100644
--- a/.github/workflows/native.yml
+++ b/.github/workflows/native.yml
@@ -73,10 +73,17 @@ jobs:
- name: Infra setting
uses: ./.github/actions/infra-setting
- - name: Install operator
+ - name: Create operator namespace
shell: bash
run: |
kubectl create ns camel-k
+
+ - name: Registry setting
+ uses: ./.github/actions/registry-setting
+
+ - name: Install operator
+ shell: bash
+ run: |
make install-k8s-global
# Install Apache Kamelets catalog
mvn -q dependency:copy
-Dartifact=org.apache.camel.kamelets:camel-kamelets:4.18.1:jar
-Dmdep.useBaseVersion=true -DoutputDirectory=/tmp
diff --git a/.github/workflows/nightly-install-olm.yml
b/.github/workflows/nightly-install-olm.yml
index eaaee18a0..9f5682223 100644
--- a/.github/workflows/nightly-install-olm.yml
+++ b/.github/workflows/nightly-install-olm.yml
@@ -73,6 +73,17 @@ jobs:
echo "Setting bundle image name as as $BUNDLE_IMAGE_NAME which is
required by OLM tests"
BUNDLE_IMAGE_NAME=docker.io/testcamelk/camel-k-bundle make bundle-push
+ - name: Create registry secret namespace
+ shell: bash
+ run: |
+ kubectl create ns camel-k
+ E2E_TEST_REGISTRY_CONFIG_COPY=true
+ echo "E2E_TEST_REGISTRY_CONFIG_COPY=$E2E_TEST_REGISTRY_CONFIG_COPY" >>
$GITHUB_ENV
+ echo "Setting E2E_TEST_REGISTRY_CONFIG_COPY=true in order to automate
the copy of the registry config for operator install"
+
+ - name: Registry setting
+ uses: ./.github/actions/registry-setting
+
- name: Run tests
shell: bash
run: |
diff --git a/.github/workflows/nightly-multi.yml
b/.github/workflows/nightly-multi.yml
index 329282b4d..921e7b3e4 100644
--- a/.github/workflows/nightly-multi.yml
+++ b/.github/workflows/nightly-multi.yml
@@ -48,13 +48,20 @@ jobs:
- name: Infra setting
uses: ./.github/actions/infra-setting
+ - name: Create operator namespace
+ shell: bash
+ run: |
+ kubectl create ns camel-k
+
+ - name: Registry setting
+ uses: ./.github/actions/registry-setting
+
- name: Install operator
shell: bash
run: |
THIS_VERSION="$(make get-version)"
VERSION="$(make get-version | sed s/-SNAPSHOT//)-nightly"
sed -i "s#apache/camel-k:$THIS_VERSION#testcamelk/camel-k:$VERSION#g"
install/base/config/manager/operator-deployment.yaml
- kubectl create ns camel-k
kubectl apply -k install/overlays/all-namespaces/ --server-side
--force-conflicts
kubectl wait --for=condition=available deployment/camel-k-operator -n
camel-k --timeout=60s
# Install Apache Kamelets catalog
@@ -86,12 +93,19 @@ jobs:
- name: Infra setting
uses: ./.github/actions/infra-setting
+ - name: Create operator namespace
+ shell: bash
+ run: |
+ kubectl create ns camel-k
+
+ - name: Registry setting
+ uses: ./.github/actions/registry-setting
+
- name: Install operator
shell: bash
run: |
VERSION="$(make get-version | sed s/-SNAPSHOT//)-nightly-21-jdk"
CUSTOM_IMAGE=testcamelk/camel-k CUSTOM_VERSION=$VERSION make bundle
- kubectl create ns camel-k
kubectl apply -k install/overlays/all-namespaces/ --server-side
--force-conflicts
kubectl wait --for=condition=available deployment/camel-k-operator -n
camel-k --timeout=60s
# Install Apache Kamelets catalog
diff --git a/.github/workflows/telemetry.yml b/.github/workflows/telemetry.yml
index dc6e7c706..cd0d5fc18 100644
--- a/.github/workflows/telemetry.yml
+++ b/.github/workflows/telemetry.yml
@@ -67,10 +67,17 @@ jobs:
- name: Infra setting
uses: ./.github/actions/infra-setting
- - name: Install operator
+ - name: Create operator namespace
shell: bash
run: |
kubectl create ns camel-k
+
+ - name: Registry setting
+ uses: ./.github/actions/registry-setting
+
+ - name: Install operator
+ shell: bash
+ run: |
make install-k8s-global
- name: Install OTLP Collector
diff --git a/docs/modules/ROOT/pages/installation/installation.adoc
b/docs/modules/ROOT/pages/installation/installation.adoc
index 5859aed40..13dba2dd0 100644
--- a/docs/modules/ROOT/pages/installation/installation.adoc
+++ b/docs/modules/ROOT/pages/installation/installation.adoc
@@ -3,7 +3,20 @@
Camel K allows us to run Camel integrations directly on a Kubernetes cluster.
To use it, you need to be connected to a cloud environment or to a local
cluster created for development purposes (ie, Minikube or Kind).
-The first step is to install and run the Camel K operator. You can do it via
any of the following methodologies:
+[[registry]]
+== Container registry configuration
+
+You will need a container registry available in order to push and pull the
generated Camel applications. The easiest way to configure it is to store the
configuration on a Configmap which will be used by the operator:
+
+```
+kubectl create configmap camel-k-operator-configmap-configuration \
+ --from-literal=REGISTRY_ADDRESS="docker.io" \
+ --from-literal=REGISTRY_SECRET="my-docker-secret"
+```
+
+Have a further look at the xref:installation/registry.adoc[production ready
registry configuration documentation].
+
+You can now install and run the Camel K operator. You can do it via any of the
following methodologies:
[[kustomize]]
== Installation via Kustomize
@@ -64,13 +77,6 @@ NOTE: RBAC custom configuration may vary depending on the
installation methodolo
Each installation method have its proper way to setup configuration. A common
one is the creation of a `Configmap` named
`camel-k-operator-configmap-configuration` and a `Secret` named
`camel-k-operator-secret-configuration` in the same namespace where the
operator is installed. If available, the operator will read the environment
variable from these resources.
-[[container-registry]]
-== Setup the container registry
-
-The only configuration you may want to change is the container registry which
the operator need to use in order to store the container images used to run the
Camel applications built. The default installation expects a container registry
available in the `kube-system` namespace exposed by a `Service` named
`registry` (this is the location where development environment Minikube install
the registry via `minikube addons enable registry`).
-
-Have a further look at the xref:installation/registry.adoc[production ready
registry configuration documentation].
-
[[verify]]
== Verify that the operator is up and running
diff --git a/docs/modules/ROOT/pages/installation/registry.adoc
b/docs/modules/ROOT/pages/installation/registry.adoc
index 9b31cf29a..6ea10eb47 100644
--- a/docs/modules/ROOT/pages/installation/registry.adoc
+++ b/docs/modules/ROOT/pages/installation/registry.adoc
@@ -20,14 +20,6 @@ You will need to add or edit any existing registry
environment variable configur
| Address (URL, hostname or IP address) of the container registry.
|
-| REGISTRY_SVC_NAMESPACE
-| Kubernetes namespace where the container registry service is deployed.
-|
-
-| REGISTRY_SVC_NAME
-| Name of the Kubernetes service exposing the container registry.
-|
-
| REGISTRY_INSECURE
| Whether to allow insecure (non-TLS) connections to the registry.
| false
@@ -46,9 +38,7 @@ You will need to add or edit any existing registry
environment variable configur
|===
-You need to provide at least the `REGISTRY_ADDRESS` parameter or
`REGISTRY_SVC_NAME` (and additionally `REGISTRY_SVC_NAMESPACE` if the registry
is in a namespace different from the operator namespace).
-
-NOTE: if you configure `REGISTRY_SVC_NAME` you need to make sure the the
Service with the given name can be read by the operator, assigning the proper
RBAC privileges.
+You need to provide at least the `REGISTRY_ADDRESS` parameter with a domain or
an IP reachable by your cluster.
[[how-to-configure]]
== How to configure Camel K container registry
diff --git
a/docs/modules/ROOT/pages/installation/registry/special/minikube.adoc
b/docs/modules/ROOT/pages/installation/registry/special/minikube.adoc
index 6793af8b8..564895d74 100644
--- a/docs/modules/ROOT/pages/installation/registry/special/minikube.adoc
+++ b/docs/modules/ROOT/pages/installation/registry/special/minikube.adoc
@@ -19,10 +19,25 @@ Alternatively, you can also start an instance with the
`registry` addon in one c
minikube start --addons registry
```
-Once the registry is available, you can reference the namespace and service
registry as:
+Once the registry is available, you can get the internal IP:
+
+```
+$ kubectl -n kube-system get service registry -o jsonpath='{.spec.clusterIP}'
+10.102.190.238
+```
+
+And populate properly the environment variables:
```
REGISTRY_INSECURE: true
-REGISTRY_SVC_NAMESPACE: kube-system
-REGISTRY_SVC_NAME: registry
+REGISTRY_ADDRESS: 10.102.190.238
+```
+
+You can also provide those configuration in the Camel K configmap:
+
+```
+kubectl create configmap camel-k-operator-configmap-configuration \
+ --from-literal=REGISTRY_ADDRESS="10.102.190.238" \
+ --from-literal=REGISTRY_INSECURE="true" \
+ -n camel-k
```
\ No newline at end of file
diff --git a/docs/modules/ROOT/pages/installation/registry/special/own.adoc
b/docs/modules/ROOT/pages/installation/registry/special/own.adoc
index 7e196e680..33d86f571 100644
--- a/docs/modules/ROOT/pages/installation/registry/special/own.adoc
+++ b/docs/modules/ROOT/pages/installation/registry/special/own.adoc
@@ -67,8 +67,7 @@ Now you can use such value into your environment variable
configuration:
```
REGISTRY_INSECURE: true
-REGISTRY_SVC_NAMESPACE: <the namespace where the pod is running>
-REGISTRY_SVC_NAME: registry
+REGISTRY_ADDRESS: 10.96.112.40
```
The above installation should be able to push and pull Integration images
correctly.
diff --git a/docs/modules/ROOT/partials/apis/camel-k-crds.adoc
b/docs/modules/ROOT/partials/apis/camel-k-crds.adoc
index ac08ea3c1..522453b51 100644
--- a/docs/modules/ROOT/partials/apis/camel-k-crds.adoc
+++ b/docs/modules/ROOT/partials/apis/camel-k-crds.adoc
@@ -9183,13 +9183,11 @@ The `PodMonitor` resource labels, applicable when
`pod-monitor` is `true`.
* <<#_camel_apache_org_v1_Traits, Traits>>
-The Pull Secret trait sets a pull secret on the pod,
-to allow Kubernetes to retrieve the container image from an external registry.
+The Pull Secret trait sets a pull secret on the pod to allow Kubernetes to
retrieve
+the container image from an external registry.
-It's enabled by default whenever you configure authentication for an external
container registry,
-so it assumes that external registries are private.
-
-If your registry does not need authentication for pulling images, you can
disable this trait.
+In a production environment it is highly advisable to provide such
authentication
+and ensure the secret exists in the Integration namespace.
[cols="2,2a",options="header"]
@@ -9209,7 +9207,7 @@ string
|
-The pull secret name to set on the Pod. If left empty this is automatically
taken from the platform registry configuration.
+The pull secret name to set on the Pod.
|`imagePullerDelegation` +
bool
diff --git a/docs/modules/traits/pages/pull-secret.adoc
b/docs/modules/traits/pages/pull-secret.adoc
index 9790dbb39..f77260ccd 100755
--- a/docs/modules/traits/pages/pull-secret.adoc
+++ b/docs/modules/traits/pages/pull-secret.adoc
@@ -3,13 +3,11 @@
// Start of autogenerated code - DO NOT EDIT! (badges)
// End of autogenerated code - DO NOT EDIT! (badges)
// Start of autogenerated code - DO NOT EDIT! (description)
-The Pull Secret trait sets a pull secret on the pod,
-to allow Kubernetes to retrieve the container image from an external registry.
+The Pull Secret trait sets a pull secret on the pod to allow Kubernetes to
retrieve
+the container image from an external registry.
-It's enabled by default whenever you configure authentication for an external
container registry,
-so it assumes that external registries are private.
-
-If your registry does not need authentication for pulling images, you can
disable this trait.
+In a production environment it is highly advisable to provide such
authentication
+and ensure the secret exists in the Integration namespace.
This trait is available in the following profiles: **Kubernetes, Knative,
OpenShift**.
@@ -35,7 +33,7 @@ The following configuration options are available:
| pull-secret.secretName
| string
-| The pull secret name to set on the Pod. If left empty this is automatically
taken from the platform registry configuration.
+| The pull secret name to set on the Pod.
| pull-secret.imagePullerDelegation
| bool
diff --git a/e2e/common/misc/client_test.go b/e2e/common/misc/client_test.go
deleted file mode 100644
index 5351d82a0..000000000
--- a/e2e/common/misc/client_test.go
+++ /dev/null
@@ -1,69 +0,0 @@
-//go:build integration
-// +build integration
-
-// To enable compilation of this file in Goland, go to "Settings -> Go ->
Vendoring & Build Tags -> Custom Tags" and add "integration"
-
-/*
-Licensed to the Apache Software Foundation (ASF) under one or more
-contributor license agreements. See the NOTICE file distributed with
-this work for additional information regarding copyright ownership.
-The ASF licenses this file to You under the Apache License, Version 2.0
-(the "License"); you may not use this file except in compliance with
-the License. You may obtain a copy of the License at
-
- http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package common
-
-import (
- "context"
- "testing"
-
- "github.com/stretchr/testify/assert"
- "github.com/stretchr/testify/require"
-
- metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-
- "sigs.k8s.io/controller-runtime/pkg/client/config"
-
- . "github.com/apache/camel-k/v2/e2e/support"
- v1 "github.com/apache/camel-k/v2/pkg/apis/camel/v1"
- "github.com/apache/camel-k/v2/pkg/client/camel/clientset/versioned"
- . "github.com/onsi/gomega"
-)
-
-func TestClientFunctionalities(t *testing.T) {
- t.Parallel()
- WithNewTestNamespace(t, func(ctx context.Context, g *WithT, ns string) {
- cfg, err := config.GetConfig()
- require.NoError(t, err)
- camel, err := versioned.NewForConfig(cfg)
- require.NoError(t, err)
-
- lst, err := camel.CamelV1().Integrations(ns).List(ctx,
metav1.ListOptions{})
- require.NoError(t, err)
- assert.Empty(t, lst.Items)
-
- integration, err :=
camel.CamelV1().Integrations(ns).Create(ctx, &v1.Integration{
- ObjectMeta: metav1.ObjectMeta{
- Name: "dummy",
- },
- }, metav1.CreateOptions{})
- require.NoError(t, err)
-
- lst, err = camel.CamelV1().Integrations(ns).List(ctx,
metav1.ListOptions{})
- require.NoError(t, err)
- assert.NotEmpty(t, lst.Items)
- assert.Equal(t, lst.Items[0].Name, integration.Name)
-
- err = camel.CamelV1().Integrations(ns).Delete(ctx, "dummy",
metav1.DeleteOptions{})
- require.NoError(t, err)
- })
-}
diff --git a/e2e/common/traits/pull_secret_test.go
b/e2e/common/traits/pull_secret_test.go
deleted file mode 100644
index e0d7bead8..000000000
--- a/e2e/common/traits/pull_secret_test.go
+++ /dev/null
@@ -1,86 +0,0 @@
-//go:build integration
-// +build integration
-
-// To enable compilation of this file in Goland, go to "Settings -> Go ->
Vendoring & Build Tags -> Custom Tags" and add "integration"
-
-/*
-Licensed to the Apache Software Foundation (ASF) under one or more
-contributor license agreements. See the NOTICE file distributed with
-this work for additional information regarding copyright ownership.
-The ASF licenses this file to You under the Apache License, Version 2.0
-(the "License"); you may not use this file except in compliance with
-the License. You may obtain a copy of the License at
-
- http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package common
-
-import (
- "context"
- "testing"
-
- . "github.com/onsi/gomega"
-
- corev1 "k8s.io/api/core/v1"
-
- . "github.com/apache/camel-k/v2/e2e/support"
- v1 "github.com/apache/camel-k/v2/pkg/apis/camel/v1"
- "github.com/apache/camel-k/v2/pkg/util/openshift"
-)
-
-func TestPullSecretTrait(t *testing.T) {
- t.Parallel()
- WithNewTestNamespace(t, func(ctx context.Context, g *WithT, ns string) {
- ocp, err := openshift.IsOpenShift(TestClient(t))
- g.Expect(err).To(BeNil())
-
- t.Run("Image pull secret is set on pod", func(t *testing.T) {
- name := RandomizedSuffixName("java1")
- g.Expect(KamelRun(t, ctx, ns, "files/Java.java",
"--name", name, "-t", "pull-secret.enabled=true", "-t",
"pull-secret.secret-name=dummy-secret").Execute()).To(Succeed())
- // pod may not run because the pull secret is dummy
- g.Eventually(IntegrationPodPhase(t, ctx, ns, name),
TestTimeoutLong).Should(Or(Equal(corev1.PodRunning), Equal(corev1.PodPending)))
-
- pod := IntegrationPod(t, ctx, ns, name)()
- g.Expect(pod.Spec.ImagePullSecrets).NotTo(BeEmpty())
-
g.Expect(pod.Spec.ImagePullSecrets[0].Name).To(Equal("dummy-secret"))
- })
-
- t.Run("Explicitly disable image pull secret", func(t
*testing.T) {
- name := RandomizedSuffixName("java2")
- g.Expect(KamelRun(t, ctx, ns, "files/Java.java",
"--name", name, "-t", "pull-secret.enabled=false").Execute()).To(Succeed())
- g.Eventually(IntegrationPodPhase(t, ctx, ns, name),
TestTimeoutLong).Should(Equal(corev1.PodRunning))
- g.Eventually(IntegrationConditionStatus(t, ctx, ns,
name, v1.IntegrationConditionReady),
TestTimeoutShort).Should(Equal(corev1.ConditionTrue))
- g.Eventually(IntegrationLogs(t, ctx, ns, name),
TestTimeoutShort).Should(ContainSubstring("Magicstring!"))
-
- pod := IntegrationPod(t, ctx, ns, name)()
- if ocp {
- // OpenShift `default` service account has
imagePullSecrets so it's always set
-
g.Expect(pod.Spec.ImagePullSecrets).NotTo(BeEmpty())
- } else {
- g.Expect(pod.Spec.ImagePullSecrets).To(BeNil())
- }
- })
-
- if ocp {
- // OpenShift always has an internal registry so image
pull secret is set by default
- t.Run("Image pull secret is automatically set by
default", func(t *testing.T) {
- name := RandomizedSuffixName("java3")
- g.Expect(KamelRun(t, ctx, ns,
"files/Java.java", "--name", name).Execute()).To(Succeed())
- g.Eventually(IntegrationPodPhase(t, ctx, ns,
name), TestTimeoutLong).Should(Equal(corev1.PodRunning))
- g.Eventually(IntegrationConditionStatus(t, ctx,
ns, name, v1.IntegrationConditionReady),
TestTimeoutShort).Should(Equal(corev1.ConditionTrue))
- g.Eventually(IntegrationLogs(t, ctx, ns, name),
TestTimeoutShort).Should(ContainSubstring("Magicstring!"))
-
- pod := IntegrationPod(t, ctx, ns, name)()
-
g.Expect(pod.Spec.ImagePullSecrets).NotTo(BeEmpty())
-
g.Expect(pod.Spec.ImagePullSecrets[0].Name).To(HavePrefix("default-dockercfg-"))
- })
- }
- })
-}
diff --git a/e2e/install/helm/setup_test.go b/e2e/install/helm/setup_test.go
index de913954f..f43dd1f07 100644
--- a/e2e/install/helm/setup_test.go
+++ b/e2e/install/helm/setup_test.go
@@ -32,15 +32,20 @@ import (
corev1 "k8s.io/api/core/v1"
. "github.com/apache/camel-k/v2/e2e/support"
+ v1 "github.com/apache/camel-k/v2/pkg/apis/camel/v1"
"github.com/apache/camel-k/v2/pkg/util/defaults"
. "github.com/onsi/gomega"
)
func TestHelmInstallation(t *testing.T) {
- WithNewTestNamespace(t, func(ctx context.Context, g *WithT, ns string) {
+ WithNewTestNamespace(t, func(ctx context.Context, g *WithT, operatorNs
string) {
// Let's make sure no CRD is yet available in the cluster
// as we must make the procedure to install them accordingly
- g.Eventually(CRDs(t)).Should(BeNil(), "No Camel K CRDs should
be previously installed for this test")
+ g.Expect(CRDs(t)()).Should(BeNil(), "No Camel K CRDs should be
previously installed for this test")
+
+ registry := os.Getenv("KAMEL_INSTALL_REGISTRY")
+ g.Expect(registry).NotTo(BeEmpty(), "KAMEL_INSTALL_REGISTRY env
var must not be empty")
+
operatorID := "helm-ck"
os.Setenv("CAMEL_K_TEST_MAKE_DIR", "../../../")
ExpectExecSucceed(t, g,
@@ -49,23 +54,25 @@ func TestHelmInstallation(t *testing.T) {
"install",
"camel-k",
fmt.Sprintf("../../../docs/charts/camel-k-%s.tgz", defaults.Version),
- "--set",
"operator.env[0].name=REGISTRY_SVC_NAMESPACE",
- "--set", "operator.env[0].value=kube-system",
- "--set",
"operator.env[1].name=REGISTRY_SVC_NAME",
- "--set", "operator.env[1].value=registry",
+ "--set",
"operator.env[0].name=REGISTRY_ADDRESS",
+ "--set", "operator.env[0].value="+registry,
+ // We expect the testing infra to make it
available a secret
+ // named "my-registry" in the installation
namespace
+ "--set", "operator.env[1].name=REGISTRY_SECRET",
+ "--set", "operator.env[1].value=my-registry",
"--set",
"operator.env[2].name=REGISTRY_INSECURE",
"--set-string", "operator.env[2].value=true",
"--set", fmt.Sprintf("operator.operatorId=%s",
operatorID),
- "-n", ns,
+ "-n", operatorNs,
"--force",
),
)
// Refresh the test client to account for the newly installed
CRDs
RefreshClient(t)
- g.Eventually(OperatorPod(t, ctx, ns)).ShouldNot(BeNil())
+ g.Eventually(OperatorPod(t, ctx, operatorNs)).ShouldNot(BeNil())
// Check if restricted security context has been applied
- operatorPod := OperatorPod(t, ctx, ns)()
+ operatorPod := OperatorPod(t, ctx, operatorNs)()
g.Expect(operatorPod.Spec.Containers[0].SecurityContext.RunAsNonRoot).To(Equal(DefaultOperatorSecurityContext().RunAsNonRoot))
g.Expect(operatorPod.Spec.Containers[0].SecurityContext.Capabilities).To(Equal(DefaultOperatorSecurityContext().Capabilities))
g.Expect(operatorPod.Spec.Containers[0].SecurityContext.SeccompProfile).To(Equal(DefaultOperatorSecurityContext().SeccompProfile))
@@ -73,9 +80,11 @@ func TestHelmInstallation(t *testing.T) {
// Test a simple route
t.Run("simple route", func(t *testing.T) {
- g.Expect(KamelRunWithID(t, ctx, operatorID, ns,
"files/yaml.yaml").Execute()).To(Succeed())
- g.Eventually(IntegrationPodPhase(t, ctx, ns, "yaml"),
TestTimeoutMedium).Should(Equal(corev1.PodRunning))
- g.Eventually(IntegrationLogs(t, ctx, ns, "yaml"),
TestTimeoutShort).Should(ContainSubstring("Magicstring!"))
+ g.Expect(KamelRunWithID(t, ctx, operatorID, operatorNs,
"files/yaml.yaml").Execute()).To(Succeed())
+ g.Eventually(IntegrationConditionStatus(t, ctx,
operatorNs, "yaml", v1.IntegrationConditionReady),
+
TestTimeoutMedium).Should(Equal(corev1.ConditionTrue))
+ g.Eventually(IntegrationPodPhase(t, ctx, operatorNs,
"yaml")).Should(Equal(corev1.PodRunning))
+ g.Eventually(IntegrationLogs(t, ctx, operatorNs,
"yaml")).Should(ContainSubstring("Magicstring!"))
})
ExpectExecSucceed(t, g,
@@ -84,11 +93,11 @@ func TestHelmInstallation(t *testing.T) {
"uninstall",
"camel-k",
"-n",
- ns,
+ operatorNs,
),
)
- g.Eventually(OperatorPod(t, ctx, ns)).Should(BeNil())
+ g.Eventually(OperatorPod(t, ctx, operatorNs)).Should(BeNil())
// Test CRD uninstall (will remove Integrations as well)
UninstallCRDs(t, ctx, g, "../../../")
diff --git a/e2e/install/kustomize/multi_namespace_test.go
b/e2e/install/kustomize/multi_namespace_test.go
index 735d4b3e0..042a8d6e3 100644
--- a/e2e/install/kustomize/multi_namespace_test.go
+++ b/e2e/install/kustomize/multi_namespace_test.go
@@ -62,7 +62,7 @@ func TestKustomizeMultiNamespace(t *testing.T) {
// Test a simple integration in
"tenant-z" is not reconciled
g.Expect(KamelRun(t, ctx, tenantNs,
"files/yaml.yaml").Execute()).To(Succeed())
g.Consistently(IntegrationPhase(t, ctx,
tenantNs, "yaml"), 30*time.Second).Should(BeEmpty())
- }, "tenant-z")
+ }, "tenant-z", true)
// Test a simple integration in "tenant-a" is
reconciled and runs correctly
g.Expect(KamelRun(t, ctx, tenantANs,
"files/yaml.yaml").Execute()).To(Succeed())
@@ -92,7 +92,7 @@ func TestKustomizeMultiNamespace(t *testing.T) {
g.Eventually(OperatorPod(t, ctx,
operatorNs)).Should(BeNil())
g.Eventually(CRDs(t)).Should(BeNil())
- }, "tenant-b")
- }, "tenant-a")
- }, "operators")
+ }, "tenant-b", true)
+ }, "tenant-a", true)
+ }, "operators", true)
}
diff --git a/e2e/install/kustomize/single_namespace_test.go
b/e2e/install/kustomize/single_namespace_test.go
index 158401a6f..7a8ab9a1f 100644
--- a/e2e/install/kustomize/single_namespace_test.go
+++ b/e2e/install/kustomize/single_namespace_test.go
@@ -61,7 +61,7 @@ func TestKustomizeSingleNamespace(t *testing.T) {
// Test a simple integration in "tenant-b" is
not reconciled
g.Expect(KamelRun(t, ctx, tenantNs,
"files/yaml.yaml").Execute()).To(Succeed())
g.Consistently(IntegrationPhase(t, ctx,
tenantNs, "yaml"), 30*time.Second).Should(BeEmpty())
- }, "tenant-b")
+ }, "tenant-b", true)
// Test a simple integration in "tenant-a" is
reconciled and runs correctly
g.Expect(KamelRun(t, ctx, tenantNs,
"files/yaml.yaml").Execute()).To(Succeed())
@@ -82,6 +82,6 @@ func TestKustomizeSingleNamespace(t *testing.T) {
g.Eventually(OperatorPod(t, ctx,
operatorNs)).Should(BeNil())
g.Eventually(CRDs(t)).Should(BeNil())
- }, "tenant-a")
- }, "operators")
+ }, "tenant-a", true)
+ }, "operators", true)
}
diff --git a/e2e/install/upgrade/upgrade_test.go
b/e2e/install/upgrade/upgrade_test.go
index 6522791ac..b5b6f90bc 100644
--- a/e2e/install/upgrade/upgrade_test.go
+++ b/e2e/install/upgrade/upgrade_test.go
@@ -27,6 +27,8 @@ import (
"fmt"
"os"
"os/exec"
+ "path/filepath"
+ "regexp"
"testing"
"time"
@@ -41,13 +43,18 @@ import (
)
func TestUpgrade(t *testing.T) {
- WithNewTestNamespace(t, func(ctx context.Context, g *WithT, ns string) {
+ t.Skip("This test requires to be reworked in 2.12. It cannot work as it
is since the older registry is not compatible" +
+ " (secret registry) with the one introduced in the last
version.")
+
+ WithNewTestNamespace(t, func(ctx context.Context, g *WithT, operatorNs
string) {
// Let's make sure no CRD is yet available in the cluster
// as we must make the procedure to install them accordingly
- g.Eventually(CRDs(t)).Should(BeNil(), "No Camel K CRDs should
be previously installed for this test")
+ g.Expect(CRDs(t)()).Should(BeNil(), "No Camel K CRDs should be
previously installed for this test")
// We start the test by installing previous version operator
lastVersion, ok := os.LookupEnv("LAST_RELEASED_VERSION")
g.Expect(ok).To(BeTrue(), "Missing last released version: you
need to set it into LAST_RELEASED_VERSION env var")
+ registry := os.Getenv("KAMEL_INSTALL_REGISTRY")
+ g.Expect(registry).NotTo(BeEmpty(), "KAMEL_INSTALL_REGISTRY env
var must not be empty")
// Install previous version
@@ -74,10 +81,28 @@ func TestUpgrade(t *testing.T) {
)
checkoutCmd.Dir = lastVersionDir
ExpectExecSucceed(t, g, checkoutCmd)
+
+ // Change /install/overlays/platform/integration-platform.yaml
on the fly
+ // to include the secret copied in this ns into the ITP
+ filename := filepath.Join(lastVersionDir, "install",
"overlays", "platform", "integration-platform.yaml")
+ data, err := os.ReadFile(filename)
+ if err != nil {
+ t.Fatal(err)
+ }
+ re := regexp.MustCompile(`(?m)^(\s*)insecure: true$`)
+ updated := re.ReplaceAllString(
+ string(data),
+ "${1}insecure: true\n${1}secret: my-registry",
+ )
+ if err := os.WriteFile(filename, []byte(updated), 0644); err !=
nil {
+ t.Fatal(err)
+ }
+
installPrevCmd := exec.Command(
"make",
"install-k8s-global",
- fmt.Sprintf("NAMESPACE=%s", ns),
+ fmt.Sprintf("NAMESPACE=%s", operatorNs),
+ fmt.Sprintf("REGISTRY=%s", registry),
)
installPrevCmd.Dir = lastVersionDir
ExpectExecSucceed(t, g, installPrevCmd)
@@ -110,9 +135,9 @@ func TestUpgrade(t *testing.T) {
// Refresh the test client to account for the newly installed
CRDs
RefreshClient(t)
// Check the operator image is the previous one
- g.Eventually(OperatorImage(t, ctx,
ns)).Should(ContainSubstring(lastVersion))
+ g.Eventually(OperatorImage(t, ctx,
operatorNs)).Should(ContainSubstring(lastVersion))
// Check the operator pod is running
- g.Eventually(OperatorPodPhase(t, ctx, ns),
TestTimeoutMedium).Should(Equal(corev1.PodRunning))
+ g.Eventually(OperatorPodPhase(t, ctx, operatorNs),
TestTimeoutMedium).Should(Equal(corev1.PodRunning))
// We need a different namespace from the global operator
WithNewTestNamespace(t, func(ctx context.Context, g *WithT,
nsIntegration string) {
@@ -131,7 +156,7 @@ func TestUpgrade(t *testing.T) {
installNextCmd := exec.Command(
"make",
"install-k8s-global",
- fmt.Sprintf("NAMESPACE=%s", ns),
+ fmt.Sprintf("NAMESPACE=%s", operatorNs),
)
installNextCmd.Dir = "../../.."
ExpectExecSucceed(t, g, installNextCmd)
@@ -139,14 +164,14 @@ func TestUpgrade(t *testing.T) {
RefreshClient(t)
// Check the operator image is the current built one
- g.Eventually(OperatorImage(t, ctx,
ns)).Should(ContainSubstring(defaults.Version))
+ g.Eventually(OperatorImage(t, ctx,
operatorNs)).Should(ContainSubstring(defaults.Version))
// Check the operator pod is running
- g.Eventually(OperatorPodPhase(t, ctx, ns),
TestTimeoutMedium).Should(Equal(corev1.PodRunning))
+ g.Eventually(OperatorPodPhase(t, ctx, operatorNs),
TestTimeoutMedium).Should(Equal(corev1.PodRunning))
// TODO: In 2.12 we should remove the
IntegrationPlatform removal
// which was still default in 2.10 and installed and it
is required
// for this test to complete. Also remove the
DeleteIntegrationPlatform func
- g.Expect(DeleteIntegrationPlatform(t, ctx, ns,
"camel-k")).To(Succeed())
+ g.Expect(DeleteIntegrationPlatform(t, ctx, operatorNs,
"camel-k")).To(Succeed())
// Check the Integration hasn't been upgraded
g.Consistently(IntegrationVersion(t, ctx,
nsIntegration, name), 15*time.Second, 3*time.Second).
@@ -160,19 +185,19 @@ func TestUpgrade(t *testing.T) {
g.Expect(Kamel(t, ctx, "rebuild", name, "-n",
nsIntegration).Execute()).To(Succeed())
// A catalog should be created with the new
configuration
- g.Eventually(DefaultCamelCatalogPhase(t, ctx, ns),
TestTimeoutMedium).Should(Equal(v1.CamelCatalogPhaseReady))
+ g.Eventually(DefaultCamelCatalogPhase(t, ctx,
operatorNs), TestTimeoutMedium).Should(Equal(v1.CamelCatalogPhaseReady))
// Check the Integration version has been upgraded
g.Eventually(IntegrationVersion(t, ctx, nsIntegration,
name), TestTimeoutMedium).Should(Equal(defaults.Version))
// Check the previous kit is not garbage collected
- g.Eventually(Kits(t, ctx, ns,
KitWithRuntimeVersion(lastRuntimeVersion))).Should(HaveLen(1))
+ g.Eventually(Kits(t, ctx, operatorNs,
KitWithRuntimeVersion(lastRuntimeVersion))).Should(HaveLen(1))
// Check a new kit is created with the current version
- g.Eventually(Kits(t, ctx, ns,
KitWithRuntimeVersion(defaults.DefaultRuntimeVersion))).Should(HaveLen(1))
+ g.Eventually(Kits(t, ctx, operatorNs,
KitWithRuntimeVersion(defaults.DefaultRuntimeVersion))).Should(HaveLen(1))
// Check the new kit is ready
- g.Eventually(Kits(t, ctx, ns,
KitWithRuntimeVersion(defaults.DefaultRuntimeVersion),
KitWithPhase(v1.IntegrationKitPhaseReady)),
+ g.Eventually(Kits(t, ctx, operatorNs,
KitWithRuntimeVersion(defaults.DefaultRuntimeVersion),
KitWithPhase(v1.IntegrationKitPhaseReady)),
TestTimeoutMedium).Should(HaveLen(1))
- kit := Kits(t, ctx, ns,
KitWithRuntimeVersion(defaults.DefaultRuntimeVersion))()[0]
+ kit := Kits(t, ctx, operatorNs,
KitWithRuntimeVersion(defaults.DefaultRuntimeVersion))()[0]
// Check the Integration uses the new image
g.Eventually(IntegrationKitName(t, ctx, nsIntegration,
name), TestTimeoutMedium).Should(Equal(kit.Name))
diff --git a/e2e/kafka/kafka_autoscale_keda_test.go
b/e2e/kafka/kafka_autoscale_keda_test.go
index 91adf24e6..5e1c25474 100644
--- a/e2e/kafka/kafka_autoscale_keda_test.go
+++ b/e2e/kafka/kafka_autoscale_keda_test.go
@@ -35,7 +35,7 @@ import (
)
func TestKafkaKedaAutoscale(t *testing.T) {
- WithNewTestNamespace(t, func(ctx context.Context, g *WithT, ns string) {
+ WithExistingNamedTestNamespace(t, func(ctx context.Context, g *WithT,
ns string) {
// NOTE: all resources are local to kafka namespace
// The scenario is the following:
@@ -44,7 +44,6 @@ func TestKafkaKedaAutoscale(t *testing.T) {
// 3. Stop the Kafka producer and verify the consumer scales to
0 accordingly
t.Run("Serverless Kafka", func(t *testing.T) {
ExpectExecSucceed(t, g, Kubectl("apply", "-f",
"files/keda-kafkatopic-to-log.yaml"))
- ns := "kafka"
consumerName := "keda-kafkatopic-to-log"
// Start consumer
g.Eventually(IntegrationConditionStatus(t, ctx, ns,
consumerName, v1.IntegrationConditionReady), TestTimeoutMedium).
@@ -71,14 +70,13 @@ func TestKafkaKedaAutoscale(t *testing.T) {
Should(gstruct.PointTo(BeNumerically("==", 0)))
g.Expect(Kamel(t, ctx, "delete", "--all", "-n",
ns).Execute()).To(Succeed())
})
- })
+ }, "kafka")
}
func TestKafkaKedaAutoDiscovery(t *testing.T) {
- WithNewTestNamespace(t, func(ctx context.Context, g *WithT, ns string) {
+ WithExistingNamedTestNamespace(t, func(ctx context.Context, g *WithT,
ns string) {
t.Run("Auto-discovery Kafka", func(t *testing.T) {
ExpectExecSucceed(t, g, Kubectl("apply", "-f",
"files/keda-it-kafkatopic-to-log-auto.yaml"))
- ns := "kafka"
integrationName := "keda-kafka-auto-discovery"
// Wait for ScaledObject
@@ -96,14 +94,13 @@ func TestKafkaKedaAutoDiscovery(t *testing.T) {
g.Expect(Kamel(t, ctx, "delete", integrationName, "-n",
ns).Execute()).To(Succeed())
})
- })
+ }, "kafka")
}
func TestKafkaKedaAutoDiscoveryWithManualTrigger(t *testing.T) {
- WithNewTestNamespace(t, func(ctx context.Context, g *WithT, ns string) {
+ WithExistingNamedTestNamespace(t, func(ctx context.Context, g *WithT,
ns string) {
t.Run("Auto-discovery with manual trigger (Case 2)", func(t
*testing.T) {
ExpectExecSucceed(t, g, Kubectl("apply", "-f",
"files/keda-kafka-auto-discovery-with-manual.yaml"))
- ns := "kafka"
integrationName :=
"keda-kafka-auto-discovery-with-manual"
g.Eventually(ScaledObject(t, ctx, ns, integrationName),
TestTimeoutMedium).
@@ -127,14 +124,13 @@ func TestKafkaKedaAutoDiscoveryWithManualTrigger(t
*testing.T) {
g.Expect(Kamel(t, ctx, "delete", integrationName, "-n",
ns).Execute()).To(Succeed())
})
- })
+ }, "kafka")
}
func TestKafkaKedaAutoMetadata(t *testing.T) {
- WithNewTestNamespace(t, func(ctx context.Context, g *WithT, ns string) {
+ WithExistingNamedTestNamespace(t, func(ctx context.Context, g *WithT,
ns string) {
t.Run("Auto-discovery with autoMetadata merge (Case 3)", func(t
*testing.T) {
ExpectExecSucceed(t, g, Kubectl("apply", "-f",
"files/keda-kafka-auto-metadata.yaml"))
- ns := "kafka"
integrationName := "keda-kafka-auto-metadata"
g.Eventually(ScaledObject(t, ctx, ns, integrationName),
TestTimeoutMedium).
@@ -155,5 +151,5 @@ func TestKafkaKedaAutoMetadata(t *testing.T) {
g.Expect(Kamel(t, ctx, "delete", integrationName, "-n",
ns).Execute()).To(Succeed())
})
- })
+ }, "kafka")
}
diff --git a/e2e/kafka/kafka_binding_test.go b/e2e/kafka/kafka_binding_test.go
index 18b96bf42..75f200ed9 100644
--- a/e2e/kafka/kafka_binding_test.go
+++ b/e2e/kafka/kafka_binding_test.go
@@ -34,34 +34,33 @@ import (
)
func TestKafka(t *testing.T) {
- WithNewTestNamespace(t, func(ctx context.Context, g *WithT, ns string) {
- // NOTE: all resources are local to kafka namespace
+ WithExistingNamedTestNamespace(t, func(ctx context.Context, g *WithT,
kafkaNs string) {
t.Run("Strimzi Kafka resource", func(t *testing.T) {
ExpectExecSucceed(t, g, Kubectl("apply", "-f",
"files/timer-to-kafka.yaml"))
// Wait for the readiness of the Integration
- g.Eventually(IntegrationConditionStatus(t, ctx,
"kafka", "timer-to-kafka", v1.IntegrationConditionReady), TestTimeoutMedium).
+ g.Eventually(IntegrationConditionStatus(t, ctx,
kafkaNs, "timer-to-kafka", v1.IntegrationConditionReady), TestTimeoutMedium).
Should(Equal(corev1.ConditionTrue))
ExpectExecSucceed(t, g, Kubectl("apply", "-f",
"files/kafka-to-log.yaml"))
- g.Eventually(IntegrationConditionStatus(t, ctx,
"kafka", "kafka-to-log", v1.IntegrationConditionReady), TestTimeoutMedium).
+ g.Eventually(IntegrationConditionStatus(t, ctx,
kafkaNs, "kafka-to-log", v1.IntegrationConditionReady), TestTimeoutMedium).
Should(Equal(corev1.ConditionTrue))
// Verify we are consuming some record (the body is
null as the timer is pushing nothing)
- g.Eventually(IntegrationLogs(t, ctx, "kafka",
"kafka-to-log")).Should(ContainSubstring("Body is null"))
+ g.Eventually(IntegrationLogs(t, ctx, kafkaNs,
"kafka-to-log")).Should(ContainSubstring("Body is null"))
- g.Expect(Kamel(t, ctx, "delete", "--all", "-n",
"kafka").Execute()).To(Succeed())
+ g.Expect(Kamel(t, ctx, "delete", "--all", "-n",
kafkaNs).Execute()).To(Succeed())
})
t.Run("Strimzi KafkaTopic resource", func(t *testing.T) {
ExpectExecSucceed(t, g, Kubectl("apply", "-f",
"files/timer-to-kafkatopic.yaml"))
// Wait for the readiness of the Integration
- g.Eventually(IntegrationConditionStatus(t, ctx,
"kafka", "timer-to-kafkatopic", v1.IntegrationConditionReady),
TestTimeoutMedium).
+ g.Eventually(IntegrationConditionStatus(t, ctx,
kafkaNs, "timer-to-kafkatopic", v1.IntegrationConditionReady),
TestTimeoutMedium).
Should(Equal(corev1.ConditionTrue))
ExpectExecSucceed(t, g, Kubectl("apply", "-f",
"files/kafkatopic-to-log.yaml"))
- g.Eventually(IntegrationConditionStatus(t, ctx,
"kafka", "kafkatopic-to-log", v1.IntegrationConditionReady), TestTimeoutMedium).
+ g.Eventually(IntegrationConditionStatus(t, ctx,
kafkaNs, "kafkatopic-to-log", v1.IntegrationConditionReady), TestTimeoutMedium).
Should(Equal(corev1.ConditionTrue))
// Verify we are consuming some record (the body is
null as the timer is pushing nothing)
- g.Eventually(IntegrationLogs(t, ctx, "kafka",
"kafkatopic-to-log")).Should(ContainSubstring("Body is null"))
+ g.Eventually(IntegrationLogs(t, ctx, kafkaNs,
"kafkatopic-to-log")).Should(ContainSubstring("Body is null"))
- g.Expect(Kamel(t, ctx, "delete", "--all", "-n",
"kafka").Execute()).To(Succeed())
+ g.Expect(Kamel(t, ctx, "delete", "--all", "-n",
kafkaNs).Execute()).To(Succeed())
})
- })
+ }, "kafka")
}
diff --git a/e2e/knative/knative_pipes_test.go
b/e2e/knative/knative_pipes_test.go
index e1621ff8b..7880ca978 100644
--- a/e2e/knative/knative_pipes_test.go
+++ b/e2e/knative/knative_pipes_test.go
@@ -136,6 +136,8 @@ func TestKnativePipes(t *testing.T) {
}
func TestRunBroker(t *testing.T) {
+ t.Skip("This test is skipped as it will be removed by another incoming
PR.")
+
WithNewTestNamespaceWithKnativeBroker(t, func(ctx context.Context, g
*WithT, ns string) {
// This test require an adhoc operator to run properly
operatorID := fmt.Sprintf("camel-k-%s", ns)
diff --git a/e2e/support/test_support.go b/e2e/support/test_support.go
index 09bd670ae..d87b52649 100644
--- a/e2e/support/test_support.go
+++ b/e2e/support/test_support.go
@@ -215,6 +215,9 @@ func KamelRunWithID(t *testing.T, ctx context.Context,
operatorID string, namesp
}
func kamelRunWithContext(t *testing.T, ctx context.Context, operatorID string,
namespace string, args ...string) *cobra.Command {
+ if os.Getenv("E2E_TEST_REGISTRY_SECRET_COPY") == "true" {
+ args = append(args, "-t", "pull-secret.secret-name=my-registry")
+ }
return kamelCommandWithContext(t, ctx, "run", operatorID, namespace,
args...)
}
@@ -1957,13 +1960,29 @@ func WithNewTestNamespace(t *testing.T, doRun
func(context.Context, *gomega.With
invokeUserTestCode(t, testContext, ns.GetName(), doRun)
}
-func WithNamedTestNamespace(t *testing.T, doRun func(context.Context,
*gomega.WithT, string), namespace string) {
+func WithNamedTestNamespace(t *testing.T, doRun func(context.Context,
*gomega.WithT, string), namespace string, deleteOnCompletion bool) {
ns := NewNamedTestNamespace(t, testContext, namespace, false)
- defer deleteTestNamespace(t, testContext, ns)
+ if deleteOnCompletion {
+ defer deleteTestNamespace(t, testContext, ns)
+ }
invokeUserTestCode(t, testContext, ns.GetName(), doRun)
}
+func WithExistingNamedTestNamespace(t *testing.T, doRun func(context.Context,
*gomega.WithT, string), namespace string) {
+ // Required to copy the registry secret previously set on the camel-k
namespace
+ if os.Getenv("E2E_TEST_REGISTRY_SECRET_COPY") == "true" {
+ copySecret(t, testContext, TestClient(t), "my-registry",
"camel-k", namespace)
+ }
+ // Required to copy the registry config previously set on the camel-k
namespace
+ // This is used by "advanced" tests which are installing the operator
on their own
+ if os.Getenv("E2E_TEST_REGISTRY_CONFIG_COPY") == "true" {
+ copyConfigMap(t, testContext, TestClient(t),
"camel-k-operator-configmap-configuration", "camel-k", namespace)
+ }
+
+ invokeUserTestCode(t, testContext, namespace, doRun)
+}
+
func WithNewTestNamespaceWithKnativeBroker(t *testing.T, doRun
func(context.Context, *gomega.WithT, string)) {
ns := NewTestNamespace(t, testContext, true)
defer deleteTestNamespace(t, testContext, ns)
@@ -2098,6 +2117,8 @@ func NewNamedTestNamespace(t *testing.T, ctx
context.Context, name string, injec
brokerLabel := "eventing.knative.dev/injection"
c := TestClient(t)
+ var namespaceOrProject ctrl.Object
+
if oc, err := openshift.IsOpenShift(TestClient(t)); err != nil {
failTest(t, err)
} else if oc {
@@ -2150,7 +2171,7 @@ func NewNamedTestNamespace(t *testing.T, ctx
context.Context, name string, injec
}
}
}
- return project
+ namespaceOrProject = project
} else {
namespace := &corev1.Namespace{
TypeMeta: metav1.TypeMeta{
@@ -2169,10 +2190,87 @@ func NewNamedTestNamespace(t *testing.T, ctx
context.Context, name string, injec
if err := TestClient(t).Create(ctx, namespace); err != nil {
failTest(t, err)
}
- return namespace
+ namespaceOrProject = namespace
}
- return nil
+ // Required to copy the registry secret previously set on the camel-k
namespace
+ if os.Getenv("E2E_TEST_REGISTRY_SECRET_COPY") == "true" {
+ copySecret(t, ctx, c, "my-registry", "camel-k", name)
+ }
+ // Required to copy the registry config previously set on the camel-k
namespace
+ // This is used by "advanced" tests which are installing the operator
on their own
+ if os.Getenv("E2E_TEST_REGISTRY_CONFIG_COPY") == "true" {
+ copyConfigMap(t, ctx, c,
"camel-k-operator-configmap-configuration", "camel-k", name)
+ }
+
+ return namespaceOrProject
+}
+
+func copySecret(
+ t *testing.T,
+ ctx context.Context,
+ c client.Client,
+ secretName string,
+ sourceNamespace string,
+ targetNamespace string,
+) {
+ source := &corev1.Secret{}
+ if err := c.Get(
+ ctx,
+ types.NamespacedName{
+ Name: secretName,
+ Namespace: sourceNamespace,
+ },
+ source,
+ ); err != nil {
+ failTest(t, err)
+ }
+
+ target := &corev1.Secret{
+ ObjectMeta: metav1.ObjectMeta{
+ Name: source.Name,
+ Namespace: targetNamespace,
+ },
+ Type: source.Type,
+ Data: source.Data,
+ }
+
+ if err := c.Create(ctx, target); err != nil {
+ fmt.Println("Warning, the secret creation failed: ",
err.Error())
+ }
+}
+
+func copyConfigMap(
+ t *testing.T,
+ ctx context.Context,
+ c client.Client,
+ cmName string,
+ sourceNamespace string,
+ targetNamespace string,
+) {
+ source := &corev1.ConfigMap{}
+ if err := c.Get(
+ ctx,
+ types.NamespacedName{
+ Name: cmName,
+ Namespace: sourceNamespace,
+ },
+ source,
+ ); err != nil {
+ failTest(t, err)
+ }
+
+ target := &corev1.ConfigMap{
+ ObjectMeta: metav1.ObjectMeta{
+ Name: source.Name,
+ Namespace: targetNamespace,
+ },
+ Data: source.Data,
+ }
+
+ if err := c.Create(ctx, target); err != nil {
+ failTest(t, err)
+ }
}
func GetOutputString(command *cobra.Command) string {
diff --git a/e2e/support/test_util.go b/e2e/support/test_util.go
index 3fa70301d..da3cb9572 100644
--- a/e2e/support/test_util.go
+++ b/e2e/support/test_util.go
@@ -75,11 +75,8 @@ func InstallOperator(t *testing.T, ctx context.Context, g
*WithT, ns string) {
func InstallOperatorWithConf(t *testing.T, ctx context.Context, g *WithT, ns,
operatorID string, global bool, envs map[string]string) {
lock.Lock()
defer lock.Unlock()
- KAMEL_INSTALL_REGISTRY := os.Getenv("KAMEL_INSTALL_REGISTRY")
args := []string{fmt.Sprintf("NAMESPACE=%s", ns)}
- if KAMEL_INSTALL_REGISTRY != "" {
- args = append(args, fmt.Sprintf("REGISTRY=%s",
KAMEL_INSTALL_REGISTRY))
- }
+
if operatorID != "" {
fmt.Printf("Setting operator ID property as %s\n", operatorID)
args = append(args, fmt.Sprintf("OPERATOR_ID=%s", operatorID))
diff --git a/helm/camel-k/README.md b/helm/camel-k/README.md
index 88ad176b1..2ca0f4cac 100644
--- a/helm/camel-k/README.md
+++ b/helm/camel-k/README.md
@@ -13,9 +13,12 @@ Minikube offers a container registry addon, which it makes
very well suited for
```bash
$ minikube addons enable registry
+...
+$ kubectl -n kube-system get service registry -o jsonpath='{.spec.clusterIP}'
+a.b.c.d
```
-You can use the container registry Service `registry` in namespace
`kube-system` to configure in Camel K.
+You can use the container registry ClusterIP result `a.b.c.d` as
`REGISTRY_ADDRESS` configuration.
## Installation procedure
@@ -37,19 +40,7 @@ $ helm install camel-k camel-k/camel-k --set global=true \
--set operator.env[1].value=<my-registry-secret>
```
-In the case of a local registry available (for example, in Minikube):
-
-```bash
-$ helm install camel-k camel-k/camel-k --set global=true \
- --set operator.env[0].name=REGISTRY_SVC_NAMESPACE \
- --set operator.env[0].value=kube-system \
- --set operator.env[1].name=REGISTRY_SVC_NAME \
- --set operator.env[1].value=registry \
- --set operator.env[2].name=REGISTRY_INSECURE \
- --set-string operator.env[2].value=true
-```
-
-> **Note**: the installation RBAC provide the setting to access the Service in
the namespace, you need to provide the specific RBAC if using another Service.
+**Note**: if you're running a local Minikube installation, you can use the
registry ClusterIP as `REGISTRY_ADDRESS`, skip the `REGISTRY_SECRET` and add
`REGISTRY_INSECURE=true` environment variables.
## Test your installation
diff --git a/helm/camel-k/crds/camel-k-crds.yaml
b/helm/camel-k/crds/camel-k-crds.yaml
index 6930c372c..bce4b9e72 100644
--- a/helm/camel-k/crds/camel-k-crds.yaml
+++ b/helm/camel-k/crds/camel-k-crds.yaml
@@ -5533,9 +5533,7 @@ spec:
Deprecated: may be removed in future releases.
type: boolean
secretName:
- description: The pull secret name to set on the Pod.
If left
- empty this is automatically taken from the platform
registry
- configuration.
+ description: The pull secret name to set on the Pod.
type: string
type: object
quarkus:
@@ -8086,9 +8084,7 @@ spec:
Deprecated: may be removed in future releases.
type: boolean
secretName:
- description: The pull secret name to set on the Pod.
If left
- empty this is automatically taken from the platform
registry
- configuration.
+ description: The pull secret name to set on the Pod.
type: string
type: object
quarkus:
@@ -10533,9 +10529,7 @@ spec:
Deprecated: may be removed in future releases.
type: boolean
secretName:
- description: The pull secret name to set on the Pod.
If left
- empty this is automatically taken from the platform
registry
- configuration.
+ description: The pull secret name to set on the Pod.
type: string
type: object
quarkus:
@@ -12966,9 +12960,7 @@ spec:
Deprecated: may be removed in future releases.
type: boolean
secretName:
- description: The pull secret name to set on the Pod.
If left
- empty this is automatically taken from the platform
registry
- configuration.
+ description: The pull secret name to set on the Pod.
type: string
type: object
quarkus:
@@ -22261,9 +22253,7 @@ spec:
Deprecated: may be removed in future releases.
type: boolean
secretName:
- description: The pull secret name to set on the Pod.
If left
- empty this is automatically taken from the platform
registry
- configuration.
+ description: The pull secret name to set on the Pod.
type: string
type: object
quarkus:
@@ -24655,9 +24645,7 @@ spec:
Deprecated: may be removed in future releases.
type: boolean
secretName:
- description: The pull secret name to set on the Pod.
If left
- empty this is automatically taken from the platform
registry
- configuration.
+ description: The pull secret name to set on the Pod.
type: string
type: object
quarkus:
@@ -35317,9 +35305,7 @@ spec:
Deprecated: may be removed in future releases.
type: boolean
secretName:
- description: The pull secret name to set on the
Pod. If
- left empty this is automatically taken from the
platform
- registry configuration.
+ description: The pull secret name to set on the
Pod.
type: string
type: object
quarkus:
@@ -37629,9 +37615,7 @@ spec:
Deprecated: may be removed in future releases.
type: boolean
secretName:
- description: The pull secret name to set on the Pod.
If left
- empty this is automatically taken from the platform
registry
- configuration.
+ description: The pull secret name to set on the Pod.
type: string
type: object
quarkus:
diff --git a/helm/camel-k/templates/operator-deployment.yaml
b/helm/camel-k/templates/operator-deployment.yaml
index cf74f6fee..57944ddfe 100644
--- a/helm/camel-k/templates/operator-deployment.yaml
+++ b/helm/camel-k/templates/operator-deployment.yaml
@@ -63,12 +63,16 @@ spec:
value: {{ .Values.operator.logLevel }}
- name: OPERATOR_NAME
value: camel-k
- # NOTE: this value must be changed properly with a real
- # container registry value. In development Minikube environment
- # you can use constant "MINIKUBE" to dynamically look and load the
- # registry add-on which has to be installed previously on the
cluster.
+
+ # Registry vars
- name: REGISTRY_ADDRESS
- value: MINIKUBE
+ value: ""
+ - name: REGISTRY_SECRET
+ value: ""
+ # Set true only for testing purposes
+ - name: REGISTRY_INSECURE
+ value: "false"
+
- name: POD_NAME
valueFrom:
fieldRef:
diff --git a/helm/camel-k/templates/rbacs-common.yaml
b/helm/camel-k/templates/rbacs-common.yaml
index 58f22d5b0..41b426201 100644
--- a/helm/camel-k/templates/rbacs-common.yaml
+++ b/helm/camel-k/templates/rbacs-common.yaml
@@ -116,22 +116,6 @@ rules:
- watch
---
apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
- labels:
- app: camel-k
- name: registry-reader
-rules:
-- apiGroups:
- - ""
- resourceNames:
- - registry
- resources:
- - services
- verbs:
- - get
----
-apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
labels:
@@ -173,18 +157,3 @@ subjects:
- apiGroup: rbac.authorization.k8s.io
kind: Group
name: system:authenticated
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
- labels:
- app: camel-k
- name: registry-reader-binding
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: registry-reader
-subjects:
-- kind: ServiceAccount
- name: {{ include "camel-k.fullname" . }}-operator
- namespace: '{{ .Release.Namespace }}'
diff --git a/pkg/apis/camel/v1/trait/pull_secret.go
b/pkg/apis/camel/v1/trait/pull_secret.go
index c55c9f43a..c6232b3aa 100644
--- a/pkg/apis/camel/v1/trait/pull_secret.go
+++ b/pkg/apis/camel/v1/trait/pull_secret.go
@@ -17,13 +17,11 @@ limitations under the License.
package trait
-// The Pull Secret trait sets a pull secret on the pod,
-// to allow Kubernetes to retrieve the container image from an external
registry.
+// The Pull Secret trait sets a pull secret on the pod to allow Kubernetes to
retrieve
+// the container image from an external registry.
//
-// It's enabled by default whenever you configure authentication for an
external container registry,
-// so it assumes that external registries are private.
-//
-// If your registry does not need authentication for pulling images, you can
disable this trait.
+// In a production environment it is highly advisable to provide such
authentication
+// and ensure the secret exists in the Integration namespace.
//
// +camel-k:trait=pull-secret.
//
@@ -31,7 +29,7 @@ package trait
type PullSecretTrait struct {
Trait `json:",inline" property:",squash"`
- // The pull secret name to set on the Pod. If left empty this is
automatically taken from the platform registry configuration.
+ // The pull secret name to set on the Pod.
SecretName string `json:"secretName,omitempty" property:"secret-name"`
// When using a global operator with a shared platform, this enables
delegation of the `system:image-puller`
// cluster role on the operator namespace to the integration service
account.
diff --git a/pkg/builder/jib.go b/pkg/builder/jib.go
index e41fa9ca0..9cf6fc952 100644
--- a/pkg/builder/jib.go
+++ b/pkg/builder/jib.go
@@ -84,10 +84,10 @@ func (t *jibTask) Do(ctx context.Context) v1.BuildStatus {
registryConfigDir := ""
if t.task.Registry.Secret != "" {
registryConfigDir, err =
registry.MountSecretRegistryConfig(ctx, t.c, t.build.Namespace, "jib-secret-",
t.task.Registry.Secret)
- os.Setenv(jib.JibRegistryConfigEnvVar, registryConfigDir)
if err != nil {
return status.Failed(err)
}
+ os.Setenv(jib.JibRegistryConfigEnvVar, registryConfigDir)
}
mavenArgs := buildJibMavenArgs(mavenDir, t.task.Image,
status.BaseImage, t.task.Registry.Insecure, t.task.Configuration.ImagePlatforms)
@@ -160,6 +160,7 @@ func buildJibMavenArgs(mavenDir, image, baseImage string,
insecureRegistry bool,
if insecureRegistry {
mavenArgs = append(mavenArgs,
jib.JibMavenInsecureRegistries+"true")
+ mavenArgs = append(mavenArgs,
jib.JibMavenSendCredentialsOverHTTP+"true")
}
return mavenArgs
diff --git a/pkg/builder/jib_test.go b/pkg/builder/jib_test.go
index 342e104d5..6bc8f662b 100644
--- a/pkg/builder/jib_test.go
+++ b/pkg/builder/jib_test.go
@@ -35,7 +35,8 @@ func TestJibBuildMavenArgs(t *testing.T) {
args := buildJibMavenArgs(tmpMvnCtxDir, "my-image", "my-base-image",
true, nil)
expectedParams := strings.Split(
fmt.Sprintf("jib:build -Djib.disableUpdateChecks=true -P jib
-Djib.to.image=my-image "+
- "-Djib.from.image=my-base-image -Djib.baseImageCache=%s
-Djib.container.user=1000 -Djib.allowInsecureRegistries=true",
tmpMvnCtxDir+"/jib"),
+ "-Djib.from.image=my-base-image -Djib.baseImageCache=%s
-Djib.container.user=1000 "+
+ "-Djib.allowInsecureRegistries=true
-DsendCredentialsOverHttp=true", tmpMvnCtxDir+"/jib"),
" ")
assert.Equal(t, expectedParams, args)
}
@@ -45,7 +46,8 @@ func TestJibBuildMavenArgsWithPlatforms(t *testing.T) {
args := buildJibMavenArgs(tmpMvnCtxDir, "my-image", "my-base-image",
true, []string{"amd64", "arm64"})
expectedParams := strings.Split(
fmt.Sprintf("jib:build -Djib.disableUpdateChecks=true -P jib
-Djib.to.image=my-image "+
- "-Djib.from.image=my-base-image -Djib.baseImageCache=%s
-Djib.container.user=1000 -Djib.from.platforms=amd64,arm64
-Djib.allowInsecureRegistries=true",
+ "-Djib.from.image=my-base-image -Djib.baseImageCache=%s
-Djib.container.user=1000 -Djib.from.platforms=amd64,arm64 "+
+ "-Djib.allowInsecureRegistries=true
-DsendCredentialsOverHttp=true",
tmpMvnCtxDir+"/jib"),
" ")
assert.Equal(t, expectedParams, args)
diff --git a/pkg/cmd/operator/operator.go b/pkg/cmd/operator/operator.go
index 1ed9c5760..c108aa573 100644
--- a/pkg/cmd/operator/operator.go
+++ b/pkg/cmd/operator/operator.go
@@ -223,6 +223,8 @@ func Run(healthPort, monitoringPort int32, leaderElection
bool, leaderElectionID
exitOnError(err, "")
log.Info("Configuring manager")
+ // Verify the environment platform configuration
+ checkRegistry()
exitOnError(mgr.AddHealthzCheck("health-probe", healthz.Ping), "Unable
add liveness check")
exitOnError(apis.AddToScheme(mgr.GetScheme()), "")
ctrlClient, err := client.FromManager(mgr)
@@ -244,6 +246,28 @@ func Run(healthPort, monitoringPort int32, leaderElection
bool, leaderElectionID
exitOnError(mgr.Start(ctx), "manager exited non-zero")
}
+func checkRegistry() {
+ // The operator will eventually try to get the registry address from an
IntegrationPlatform, if provided
+ if platform.SingletonPlatform.Registry.Address == "" {
+ // TODO: fail fast exiting the program when we don't support
IntegrationPlatform.
+ log.Info("Failed to initialize singleton platform from
environment variables: missing mandatory env var REGISTRY_ADDRESS. " +
+ "Mind that this will be required when we stop
supporting IntegrationPlatform in future releases.")
+ } else {
+ // TODO: support registry in IntegrationProfile before removing
IntegrationPlatform.
+ log.Infof("Registry %s configured for this operator. "+
+ "The operator will use this one unless any other
specified in IntegrationPlatform (deprecated)",
+ platform.SingletonPlatform.Registry.Address)
+ }
+ if platform.SingletonPlatform.Registry.Insecure {
+ log.Info("The registry may be accessed insecurely via http (non
encrypted) protocol: " +
+ "make sure this is disabled in a production environment
for security reasons.")
+ }
+ if platform.SingletonPlatform.Registry.Secret == "" {
+ log.Info("The registry will access publicly (no secret
configured): " +
+ "make sure this is disabled in a production environment
for security reasons.")
+ }
+}
+
func getNamespacesSelector(operatorNamespace string, watchNamespace string)
map[string]cache.Config {
namespacesSelector := map[string]cache.Config{
// The same operator namespace is needed while the operator
stores
diff --git a/pkg/controller/build/build_pod.go
b/pkg/controller/build/build_pod.go
index e294c2502..734529ff0 100644
--- a/pkg/controller/build/build_pod.go
+++ b/pkg/controller/build/build_pod.go
@@ -32,6 +32,7 @@ import (
"github.com/apache/camel-k/v2/pkg/platform"
"github.com/apache/camel-k/v2/pkg/util/kubernetes"
"github.com/apache/camel-k/v2/pkg/util/openshift"
+ "github.com/apache/camel-k/v2/pkg/util/registry"
)
const (
@@ -84,19 +85,19 @@ func newBuildPod(ctx context.Context, client client.Client,
build *v1.Build) *co
switch {
// Builder task
case task.Builder != nil:
- addBuildTaskToPod(ctx, client, build,
task.Builder.Name, pod)
+ addBuildTaskToPod(ctx, client, build,
task.Builder.Name, "", pod)
// Custom task
case task.Custom != nil:
addCustomTaskToPod(build, task.Custom, pod)
// Package task
// It's a type of builder task, we can reuse the same type
case task.Package != nil:
- addBuildTaskToPod(ctx, client, build,
task.Package.Name, pod)
+ addBuildTaskToPod(ctx, client, build,
task.Package.Name, "", pod)
//nolint:staticcheck
case task.S2i != nil:
- addBuildTaskToPod(ctx, client, build, task.S2i.Name,
pod)
+ addBuildTaskToPod(ctx, client, build, task.S2i.Name,
"", pod)
case task.Jib != nil:
- addBuildTaskToPod(ctx, client, build, task.Jib.Name,
pod)
+ addBuildTaskToPod(ctx, client, build, task.Jib.Name,
task.Jib.Registry.Secret, pod)
}
}
@@ -181,7 +182,7 @@ func buildPodName(build *v1.Build) string {
return "camel-k-" + build.Name + "-builder"
}
-func addBuildTaskToPod(ctx context.Context, client client.Client, build
*v1.Build, taskName string, pod *corev1.Pod) {
+func addBuildTaskToPod(ctx context.Context, client client.Client, build
*v1.Build, taskName, registrySecretName string, pod *corev1.Pod) {
if !hasVolume(pod, builderVolume) {
pod.Spec.Volumes = append(pod.Spec.Volumes,
// EmptyDir volume used to share the build state across
tasks
@@ -202,6 +203,23 @@ func addBuildTaskToPod(ctx context.Context, client
client.Client, build *v1.Buil
},
)
+ // If there is a registry secret configured, we need to include the
related env var
+ if registrySecretName != "" {
+ envVars = append(envVars,
+ corev1.EnvVar{
+ Name: registry.RegistrySecretConfEnvVar,
+ ValueFrom: &corev1.EnvVarSource{
+ SecretKeyRef: &corev1.SecretKeySelector{
+ LocalObjectReference:
corev1.LocalObjectReference{
+ Name:
registrySecretName,
+ },
+ Key:
registry.RegistryDockerConfFilename,
+ },
+ },
+ },
+ )
+ }
+
container := corev1.Container{
Name: taskName,
Image: build.BuilderConfiguration().ToolImage,
diff --git a/pkg/controller/integration/build.go
b/pkg/controller/integration/build.go
index 6c57004e9..8ce975398 100644
--- a/pkg/controller/integration/build.go
+++ b/pkg/controller/integration/build.go
@@ -287,16 +287,6 @@ func (action *buildAction) createBuilderRole(ctx
context.Context, ns string) err
Resources: []string{"builds/status"},
Verbs: []string{"get", "patch", "update"},
},
- {
- APIGroups: []string{""},
- Resources: []string{"secrets"},
- Verbs: []string{"get"},
- },
- {
- APIGroups: []string{""},
- Resources: []string{"configmaps"},
- Verbs: []string{"get", "list"},
- },
},
}
action.L.Infof("Creating %s Role in namespace %s", r.Name, r.Namespace)
diff --git a/pkg/install/optional.go b/pkg/install/optional.go
index 764c5ece3..88bc991d9 100644
--- a/pkg/install/optional.go
+++ b/pkg/install/optional.go
@@ -21,9 +21,7 @@ import (
"context"
"github.com/apache/camel-k/v2/pkg/client"
- "github.com/apache/camel-k/v2/pkg/platform"
logutil "github.com/apache/camel-k/v2/pkg/util/log"
- metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
)
// OperatorStartupOptionalTools tries to install optional tools at operator
startup and warns if something goes wrong.
@@ -33,20 +31,4 @@ func OperatorStartupOptionalTools(ctx context.Context, c
client.Client, log logu
log.Info("Cannot install OpenShift CLI download link:
skipping.")
log.Debug("Error while installing OpenShift CLI download link",
"error", err)
}
- // Check the presence of a registry service configuration, and, if it
exists, calculate the address
- registryServiceName := platform.GetEnvOrDefault("REGISTRY_SVC_NAME", "")
- if registryServiceName != "" {
- registryServiceNamespace :=
platform.GetEnvOrDefault("REGISTRY_SVC_NAMESPACE", "")
- if registryServiceNamespace == "" {
- // fallback to operator namespace
- registryServiceNamespace =
platform.GetOperatorNamespace()
- }
- svc, err :=
c.CoreV1().Services(registryServiceNamespace).Get(ctx, registryServiceName,
metav1.GetOptions{})
- if err != nil {
- log.Error(err, "Could not get any container registry %s
in namespace %s. "+
- "If you're targeting Minikube, make sure to
enable the registry addon first!",
- registryServiceNamespace, registryServiceName)
- }
- platform.SingletonPlatform.Registry.Address = svc.Spec.ClusterIP
- }
}
diff --git a/pkg/platform/env_platform.go b/pkg/platform/env_platform.go
index c9ef96d94..dd5bd46b7 100644
--- a/pkg/platform/env_platform.go
+++ b/pkg/platform/env_platform.go
@@ -55,13 +55,6 @@ type Platform struct {
// getEnvPlatform is in charge to parse the environment variables of the
operator and return the Platform object.
func getEnvPlatform() Platform {
registry := registry()
- // The operator will eventually try to get the registry address from a
service, if provided
- if registry.Address == "" && GetEnvOrDefault("REGISTRY_SVC_NAME", "")
== "" {
- // TODO: fail fast exiting the program when we don't support
IntegrationPlatform.
- log.Info("failed to initialize singleton platform from
environment variables: missing mandatory env var REGISTRY_ADDRESS or " +
- "REGISTRY_SVC_NAME (and REGISTRY_SVC_NAMESPACE). " +
- "Mind that this will be required when we stop
supporting IntegrationPlatform in future releases.")
- }
return Platform{
CatalogNamespace: GetOperatorNamespace(),
@@ -264,7 +257,7 @@ func registry() v1.RegistrySpec {
insecure, err := strconv.ParseBool(GetEnvOrDefault("REGISTRY_INSECURE",
"false"))
if err != nil {
insecure = false
- log.Error(err, "could not parse REGISTRY_INSECURE environment
variable, fallback to true")
+ log.Error(err, "could not parse REGISTRY_INSECURE environment
variable, fallback to false")
}
registry := v1.RegistrySpec{
Insecure: insecure,
diff --git
a/pkg/resources/config/crd/bases/camel.apache.org_integrationplatforms.yaml
b/pkg/resources/config/crd/bases/camel.apache.org_integrationplatforms.yaml
index 791c2ec55..ca126a6d5 100644
--- a/pkg/resources/config/crd/bases/camel.apache.org_integrationplatforms.yaml
+++ b/pkg/resources/config/crd/bases/camel.apache.org_integrationplatforms.yaml
@@ -2227,9 +2227,7 @@ spec:
Deprecated: may be removed in future releases.
type: boolean
secretName:
- description: The pull secret name to set on the Pod.
If left
- empty this is automatically taken from the platform
registry
- configuration.
+ description: The pull secret name to set on the Pod.
type: string
type: object
quarkus:
@@ -4780,9 +4778,7 @@ spec:
Deprecated: may be removed in future releases.
type: boolean
secretName:
- description: The pull secret name to set on the Pod.
If left
- empty this is automatically taken from the platform
registry
- configuration.
+ description: The pull secret name to set on the Pod.
type: string
type: object
quarkus:
diff --git
a/pkg/resources/config/crd/bases/camel.apache.org_integrationprofiles.yaml
b/pkg/resources/config/crd/bases/camel.apache.org_integrationprofiles.yaml
index 6925e9bfa..0d816df4c 100644
--- a/pkg/resources/config/crd/bases/camel.apache.org_integrationprofiles.yaml
+++ b/pkg/resources/config/crd/bases/camel.apache.org_integrationprofiles.yaml
@@ -2085,9 +2085,7 @@ spec:
Deprecated: may be removed in future releases.
type: boolean
secretName:
- description: The pull secret name to set on the Pod.
If left
- empty this is automatically taken from the platform
registry
- configuration.
+ description: The pull secret name to set on the Pod.
type: string
type: object
quarkus:
@@ -4518,9 +4516,7 @@ spec:
Deprecated: may be removed in future releases.
type: boolean
secretName:
- description: The pull secret name to set on the Pod.
If left
- empty this is automatically taken from the platform
registry
- configuration.
+ description: The pull secret name to set on the Pod.
type: string
type: object
quarkus:
diff --git a/pkg/resources/config/crd/bases/camel.apache.org_integrations.yaml
b/pkg/resources/config/crd/bases/camel.apache.org_integrations.yaml
index 123984795..7c18bab71 100644
--- a/pkg/resources/config/crd/bases/camel.apache.org_integrations.yaml
+++ b/pkg/resources/config/crd/bases/camel.apache.org_integrations.yaml
@@ -8936,9 +8936,7 @@ spec:
Deprecated: may be removed in future releases.
type: boolean
secretName:
- description: The pull secret name to set on the Pod.
If left
- empty this is automatically taken from the platform
registry
- configuration.
+ description: The pull secret name to set on the Pod.
type: string
type: object
quarkus:
@@ -11330,9 +11328,7 @@ spec:
Deprecated: may be removed in future releases.
type: boolean
secretName:
- description: The pull secret name to set on the Pod.
If left
- empty this is automatically taken from the platform
registry
- configuration.
+ description: The pull secret name to set on the Pod.
type: string
type: object
quarkus:
diff --git a/pkg/resources/config/crd/bases/camel.apache.org_pipes.yaml
b/pkg/resources/config/crd/bases/camel.apache.org_pipes.yaml
index 4a9c4e2ed..a94040859 100644
--- a/pkg/resources/config/crd/bases/camel.apache.org_pipes.yaml
+++ b/pkg/resources/config/crd/bases/camel.apache.org_pipes.yaml
@@ -8995,9 +8995,7 @@ spec:
Deprecated: may be removed in future releases.
type: boolean
secretName:
- description: The pull secret name to set on the
Pod. If
- left empty this is automatically taken from the
platform
- registry configuration.
+ description: The pull secret name to set on the
Pod.
type: string
type: object
quarkus:
@@ -11307,9 +11305,7 @@ spec:
Deprecated: may be removed in future releases.
type: boolean
secretName:
- description: The pull secret name to set on the Pod.
If left
- empty this is automatically taken from the platform
registry
- configuration.
+ description: The pull secret name to set on the Pod.
type: string
type: object
quarkus:
diff --git a/pkg/resources/config/manager/add-registry-envvars.yaml
b/pkg/resources/config/manager/add-registry-envvars.yaml
deleted file mode 100644
index 70eb8bcb0..000000000
--- a/pkg/resources/config/manager/add-registry-envvars.yaml
+++ /dev/null
@@ -1,40 +0,0 @@
-# ---------------------------------------------------------------------------
-# Licensed to the Apache Software Foundation (ASF) under one or more
-# contributor license agreements. See the NOTICE file distributed with
-# this work for additional information regarding copyright ownership.
-# The ASF licenses this file to You under the Apache License, Version 2.0
-# (the "License"); you may not use this file except in compliance with
-# the License. You may obtain a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-# ---------------------------------------------------------------------------
-
-# Adding the default registry as expected for Minikube registry addon
-# IMPORTANT: don't use this in a production environment and change the values
to a production grade registry instead
-- op: add
- path: /spec/template/spec/containers/0/env/-
- value:
- name: REGISTRY_SVC_NAMESPACE
- value: "kube-system"
-- op: add
- path: /spec/template/spec/containers/0/env/-
- value:
- name: REGISTRY_SVC_NAME
- value: "registry"
-- op: add
- path: /spec/template/spec/containers/0/env/-
- value:
- name: REGISTRY_INSECURE
- value: "true"
-# You can also set directly the registry address
-# - op: add
-# path: /spec/template/spec/containers/0/env/-
-# value:
-# name: REGISTRY_ADDRESS
-# value: "my-registry.io"
\ No newline at end of file
diff --git a/pkg/resources/config/manager/kustomization.yaml
b/pkg/resources/config/manager/kustomization.yaml
index a4543333a..c14f19583 100644
--- a/pkg/resources/config/manager/kustomization.yaml
+++ b/pkg/resources/config/manager/kustomization.yaml
@@ -22,9 +22,3 @@ resources:
- operator-deployment.yaml
- operator-service-account.yaml
- builder-service-account.yaml
-
-patches:
- - path: add-registry-envvars.yaml
- target:
- kind: Deployment
- name: camel-k-operator
diff --git a/pkg/resources/config/rbac/kustomization.yaml
b/pkg/resources/config/rbac/kustomization.yaml
index 798548189..d6a983f2c 100644
--- a/pkg/resources/config/rbac/kustomization.yaml
+++ b/pkg/resources/config/rbac/kustomization.yaml
@@ -25,8 +25,6 @@ resources:
- builder-role.yaml
- builder-role-openshift.yaml
- kamelets-viewer-role.yaml
-- registry-clusterrole.yaml
- builder-role-binding.yaml
- builder-role-binding-openshift.yaml
- kamelets-viewer-role-binding.yaml
-- registry-clusterrole-binding.yaml
diff --git a/pkg/resources/config/rbac/registry-clusterrole-binding.yaml
b/pkg/resources/config/rbac/registry-clusterrole-binding.yaml
deleted file mode 100644
index f44ecc8be..000000000
--- a/pkg/resources/config/rbac/registry-clusterrole-binding.yaml
+++ /dev/null
@@ -1,30 +0,0 @@
-# ---------------------------------------------------------------------------
-# Licensed to the Apache Software Foundation (ASF) under one or more
-# contributor license agreements. See the NOTICE file distributed with
-# this work for additional information regarding copyright ownership.
-# The ASF licenses this file to You under the Apache License, Version 2.0
-# (the "License"); you may not use this file except in compliance with
-# the License. You may obtain a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-# ---------------------------------------------------------------------------
-
-kind: ClusterRoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
-metadata:
- name: registry-reader-binding
- labels:
- app: "camel-k"
-subjects:
-- kind: ServiceAccount
- name: camel-k-operator
-roleRef:
- kind: ClusterRole
- name: registry-reader
- apiGroup: rbac.authorization.k8s.io
diff --git a/pkg/resources/config/rbac/registry-clusterrole.yaml
b/pkg/resources/config/rbac/registry-clusterrole.yaml
deleted file mode 100644
index 8d8dcc331..000000000
--- a/pkg/resources/config/rbac/registry-clusterrole.yaml
+++ /dev/null
@@ -1,28 +0,0 @@
-# ---------------------------------------------------------------------------
-# Licensed to the Apache Software Foundation (ASF) under one or more
-# contributor license agreements. See the NOTICE file distributed with
-# this work for additional information regarding copyright ownership.
-# The ASF licenses this file to You under the Apache License, Version 2.0
-# (the "License"); you may not use this file except in compliance with
-# the License. You may obtain a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-# ---------------------------------------------------------------------------
-
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
- name: registry-reader
- labels:
- app: "camel-k"
-rules:
- - apiGroups: [""]
- resources: ["services"]
- resourceNames: ["registry"]
- verbs: ["get"]
diff --git a/pkg/trait/pull_secret.go b/pkg/trait/pull_secret.go
index f65151ee4..d6ca457e0 100644
--- a/pkg/trait/pull_secret.go
+++ b/pkg/trait/pull_secret.go
@@ -28,6 +28,7 @@ import (
traitv1 "github.com/apache/camel-k/v2/pkg/apis/camel/v1/trait"
"github.com/apache/camel-k/v2/pkg/platform"
"github.com/apache/camel-k/v2/pkg/util/kubernetes"
+ "github.com/apache/camel-k/v2/pkg/util/log"
"github.com/apache/camel-k/v2/pkg/util/openshift"
)
@@ -68,7 +69,10 @@ func (t *pullSecretTrait) Configure(e *Environment) (bool,
*TraitCondition, erro
}
}
- t.secretName = t.SecretName
+ if t.SecretName != "" {
+ t.secretName = t.SecretName
+ }
+
//nolint:staticcheck
t.deprecatedImagePullerDelegation = t.ImagePullerDelegation
@@ -90,14 +94,21 @@ func (t *pullSecretTrait) autoConfigure(e *Environment)
error {
t.deprecatedImagePullerDelegation = &needsDelegation
}
+ if t.SecretName == "" && e.Platform.Registry.Secret != "" {
+ // This is deprecated and will be removed in future versions
+ log.Info("Setting the configured operator pull secret. This
feature is deprecated and will be removed in the future. " +
+ "Use pull-secret trait explicitly instead.")
+ t.secretName = e.Platform.Registry.Secret
+ }
+
return nil
}
func (t *pullSecretTrait) Apply(e *Environment) error {
- if t.SecretName != "" {
+ if t.secretName != "" {
e.Resources.VisitPodSpec(func(p *corev1.PodSpec) {
p.ImagePullSecrets = append(p.ImagePullSecrets,
corev1.LocalObjectReference{
- Name: t.SecretName,
+ Name: t.secretName,
})
})
}
diff --git a/pkg/util/jib/configuration.go b/pkg/util/jib/configuration.go
index 9c18a1cbf..0158d46a0 100644
--- a/pkg/util/jib/configuration.go
+++ b/pkg/util/jib/configuration.go
@@ -30,6 +30,10 @@ const JibMavenContainerUser = "-Djib.container.user="
const JibMavenFromPlatforms = "-Djib.from.platforms="
const JibMavenBaseImageCache = "-Djib.baseImageCache="
const JibMavenInsecureRegistries = "-Djib.allowInsecureRegistries="
+
+// JibMavenSendCredentialsOverHTTP
+// #nosec G101 -- This is a Jib configuration property, not a credential.
+const JibMavenSendCredentialsOverHTTP = "-DsendCredentialsOverHttp="
const JibDigestFile = "target/jib-image.digest"
const JibMavenPluginVersionDefault = "3.4.1"
const JibLayerFilterExtensionMavenVersionDefault = "0.3.0"
diff --git a/pkg/util/log/log.go b/pkg/util/log/log.go
index 7b99c74c3..974b3649d 100644
--- a/pkg/util/log/log.go
+++ b/pkg/util/log/log.go
@@ -27,12 +27,8 @@ import (
)
// Log --.
-var Log Logger
-
-func init() {
- Log = Logger{
- delegate: logf.Log.WithName("camel-k"),
- }
+var Log = Logger{
+ delegate: logf.Log.WithName("camel-k"),
}
// InitForCmd is required to avoid nil pointer exceptions from command line.
diff --git a/pkg/util/registry/registry.go b/pkg/util/registry/registry.go
index bab8906a2..088dd7186 100644
--- a/pkg/util/registry/registry.go
+++ b/pkg/util/registry/registry.go
@@ -29,13 +29,24 @@ import (
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
)
+const RegistrySecretConfEnvVar = "REGISTRY_SECRET_CONF"
+const RegistryDockerConfFilename = ".dockerconfigjson"
+const jibConfigExtension = "config.json"
+
// MountSecretRegistryConfig write a file containing the secret registry
config in a temporary folder.
+// The procedure tries to read the secret from "REGISTRY_SECRET_CONF"
environment variable, as, such a value
+// could have been provided by operator in "Pod" build strategy.
func MountSecretRegistryConfig(ctx context.Context, c client.Client,
namespace, prefix, name string) (string, error) {
dir, err := os.MkdirTemp("", prefix)
if err != nil {
return "", err
}
+ if os.Getenv(RegistrySecretConfEnvVar) != "" {
+ return mountSecretRegistryConfigFromEnvVar(dir)
+ }
+
+ // TODO: this part is likely to be removed when dropping the support of
"routine" build strategy.
secret, err := c.CoreV1().Secrets(namespace).Get(ctx, name,
metav1.GetOptions{})
if err != nil {
if removeErr := os.RemoveAll(dir); removeErr != nil {
@@ -58,9 +69,24 @@ func MountSecretRegistryConfig(ctx context.Context, c
client.Client, namespace,
return dir, nil
}
+// Use any secret mounted as an env var.
+func mountSecretRegistryConfigFromEnvVar(dir string) (string, error) {
+ registrySecretValue := os.Getenv(RegistrySecretConfEnvVar)
+ // #nosec G703 -- jibConfigExtension is a fixed filename; dir is a
trusted directory.
+ if err := os.WriteFile(filepath.Join(dir, jibConfigExtension),
[]byte(registrySecretValue), io.FilePerm600); err != nil {
+ if removeErr := os.RemoveAll(dir); removeErr != nil {
+ err = multierr.Append(err, removeErr)
+ }
+
+ return "", err
+ }
+
+ return dir, nil
+}
+
func remap(name string) string {
- if name == ".dockerconfigjson" {
- return "config.json"
+ if name == RegistryDockerConfFilename {
+ return jibConfigExtension
}
return name
diff --git a/pkg/util/registry/registry_test.go
b/pkg/util/registry/registry_test.go
new file mode 100644
index 000000000..c76488837
--- /dev/null
+++ b/pkg/util/registry/registry_test.go
@@ -0,0 +1,38 @@
+/*
+Licensed to the Apache Software Foundation (ASF) under one or more
+contributor license agreements. See the NOTICE file distributed with
+this work for additional information regarding copyright ownership.
+The ASF licenses this file to You under the Apache License, Version 2.0
+(the "License"); you may not use this file except in compliance with
+the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package registry
+
+import (
+ "os"
+ "path/filepath"
+ "testing"
+
+ "github.com/stretchr/testify/assert"
+ "github.com/stretchr/testify/require"
+)
+
+func TestReadSecretConfFromEnvVar(t *testing.T) {
+ t.Setenv(RegistrySecretConfEnvVar, "some s3cr3t")
+ dir, err := MountSecretRegistryConfig(t.Context(), nil, "ns", "test",
"secret")
+ require.NoError(t, err)
+ assert.NotEmpty(t, dir)
+
+ data, err := os.ReadFile(filepath.Join(dir, jibConfigExtension))
+ require.NoError(t, err)
+ assert.Equal(t, []byte("some s3cr3t"), data)
+}
diff --git a/script/Makefile b/script/Makefile
index fe0fcbb6c..f216a1809 100644
--- a/script/Makefile
+++ b/script/Makefile
@@ -807,22 +807,6 @@ install-k8s-ns: DEFAULT_NS="default"
install-k8s-ns: KUSTOMIZE_DIR="install/overlays/own-namespace"
install-k8s-ns: clone-kustomize-dir set-operator-id set-operator-env
install-operator
-install-registry: NAMESPACE="camel-k"
-install-registry: clone-kustomize-dir
- @echo "####### Installing container registry..."
-ifdef REGISTRY
- @echo "INFO: Setting IntegrationPlatform container registry to
$(REGISTRY)"
- @sed -i 's/address: .*/address: $(REGISTRY)/'
$(KUST_TMP)/install/overlays/platform/integration-platform.yaml
- kubectl apply -k $(KUST_TMP)/install/overlays/platform --server-side -n
$(NAMESPACE) --force-conflicts
-else
- $(eval MINIKUBE_REGISTRY=$(shell kubectl -n kube-system get service
registry -o jsonpath='{.spec.clusterIP}' 2> /dev/null))
-ifneq ($(MINIKUBE_REGISTRY),"")
- @echo "INFO: Looks like you're on Minikube. Setting IntegrationPlatform
container registry to $(MINIKUBE_REGISTRY)"
- @sed -i 's/address: .*/address: $(MINIKUBE_REGISTRY)/'
$(KUST_TMP)/install/overlays/platform/integration-platform.yaml
- kubectl apply -k $(KUST_TMP)/install/overlays/platform --server-side -n
$(NAMESPACE) --force-conflicts
-endif
-endif
-
uninstall:
ifdef NAMESPACE
kubectl delete deploy -l app=camel-k -n $(NAMESPACE)
