This is an automated email from the ASF dual-hosted git repository.
villebro pushed a commit to branch main
in repository
https://gitbox.apache.org/repos/asf/superset-kubernetes-operator.git
The following commit(s) were added to refs/heads/main by this push:
new 6c24cae feat(helm): add imagePullSecrets value for operator
Deployment (#240)
6c24cae is described below
commit 6c24cae8e9271b33cd30f1aee0849ff65c5c71e5
Author: Younsung Lee <[email protected]>
AuthorDate: Tue Jul 28 14:56:30 2026 +0900
feat(helm): add imagePullSecrets value for operator Deployment (#240)
* feat(helm): add imagePullSecrets value for operator Deployment
Add an optional imagePullSecrets value to the operator Helm chart so users
can pull the manager image from a private registry. The chart already exposes
image.repository and image.tag, but there was no way to attach pull
credentials, forcing users to patch the Deployment out-of-band or attach the
Secret to the ServiceAccount manually.
The value defaults to an empty list, so the imagePullSecrets field is
omitted from the rendered Deployment unless set, preserving existing behavior.
The referenced Secrets must already exist in the release namespace; the chart
does not create them. The values.schema.json entry, helm-docs README, and the
comprehensive chart test values and snapshot are updated to match.
Signed-off-by: younsl <[email protected]>
* docs: note Helm imagePullSecrets in releases
Signed-off-by: younsl <[email protected]>
* fix(helm): require non-empty name in imagePullSecrets schema
Signed-off-by: younsl <[email protected]>
---------
Signed-off-by: younsl <[email protected]>
---
charts/superset-operator/README.md | 1 +
charts/superset-operator/templates/deployment.yaml | 4 ++++
.../tests/__snapshot__/full_options_test.yaml.snap | 2 ++
charts/superset-operator/tests/values/full-options.yaml | 3 +++
charts/superset-operator/values.schema.json | 12 ++++++++++++
charts/superset-operator/values.yaml | 3 +++
docs/reference/releases.md | 1 +
7 files changed, 26 insertions(+)
diff --git a/charts/superset-operator/README.md
b/charts/superset-operator/README.md
index b59f73f..2f1295b 100644
--- a/charts/superset-operator/README.md
+++ b/charts/superset-operator/README.md
@@ -55,6 +55,7 @@ Full documentation is available at
<https://apache.github.io/superset-kubernetes
| image.pullPolicy | string | `"IfNotPresent"` | Image pull policy. |
| image.repository | string | `"ghcr.io/apache/superset-kubernetes-operator"`
| Docker image repository for the operator manager. |
| image.tag | string | `""` | Image tag. Defaults to the chart's appVersion
when empty. |
+| imagePullSecrets | list | `[]` | Existing Secrets used to pull the operator
image from a private registry. |
| leaderElection.enabled | bool | `true` | Enable leader election so only one
replica is active at a time. |
| logLevel | string | `""` | Operator log verbosity (`--zap-log-level`). Leave
empty for the default (`info`). Set to `debug` (alias `1`) for per-reconcile
progress logs, or `2` for trace-level internals. |
| metrics.certSecretName | string | `""` | Name of a Secret containing
`tls.crt`, `tls.key`, and `ca.crt` to use for the metrics server instead of the
built-in self-signed certificate. Typically written by cert-manager. |
diff --git a/charts/superset-operator/templates/deployment.yaml
b/charts/superset-operator/templates/deployment.yaml
index 4a89760..405b565 100644
--- a/charts/superset-operator/templates/deployment.yaml
+++ b/charts/superset-operator/templates/deployment.yaml
@@ -43,6 +43,10 @@ spec:
spec:
serviceAccountName: {{ include "superset-operator.serviceAccountName" .
}}
terminationGracePeriodSeconds: 10
+ {{- with .Values.imagePullSecrets }}
+ imagePullSecrets:
+ {{- toYaml . | nindent 8 }}
+ {{- end }}
{{- with .Values.podSecurityContext }}
securityContext:
{{- toYaml . | nindent 8 }}
diff --git
a/charts/superset-operator/tests/__snapshot__/full_options_test.yaml.snap
b/charts/superset-operator/tests/__snapshot__/full_options_test.yaml.snap
index 77bf103..dbccd88 100644
--- a/charts/superset-operator/tests/__snapshot__/full_options_test.yaml.snap
+++ b/charts/superset-operator/tests/__snapshot__/full_options_test.yaml.snap
@@ -91,6 +91,8 @@ renders the full install manifests:
- mountPath: /tmp/k8s-metrics-server/metrics-certs
name: metrics-certs
readOnly: true
+ imagePullSecrets:
+ - name: superset-operator-registry
nodeSelector:
kubernetes.io/os: linux
securityContext:
diff --git a/charts/superset-operator/tests/values/full-options.yaml
b/charts/superset-operator/tests/values/full-options.yaml
index 60d6d4c..a9e7334 100644
--- a/charts/superset-operator/tests/values/full-options.yaml
+++ b/charts/superset-operator/tests/values/full-options.yaml
@@ -24,6 +24,9 @@ image:
tag: v9.9.9-test
pullPolicy: Always
+imagePullSecrets:
+ - name: superset-operator-registry
+
replicas: 2
revisionHistoryLimit: 5
diff --git a/charts/superset-operator/values.schema.json
b/charts/superset-operator/values.schema.json
index 6ccfc2f..b1a779a 100644
--- a/charts/superset-operator/values.schema.json
+++ b/charts/superset-operator/values.schema.json
@@ -22,6 +22,18 @@
}
}
},
+ "imagePullSecrets": {
+ "description": "References to Secrets in the release namespace used to
pull the operator image from a private registry. See
https://pkg.go.dev/k8s.io/api/core/v1#LocalObjectReference";,
+ "type": "array",
+ "items": {
+ "type": "object",
+ "additionalProperties": false,
+ "properties": {
+ "name": { "type": "string", "minLength": 1 }
+ },
+ "required": ["name"]
+ }
+ },
"replicas": { "type": "integer", "minimum": 0 },
"revisionHistoryLimit": { "type": ["integer", "null"], "minimum": 0 },
"resources": {
diff --git a/charts/superset-operator/values.yaml
b/charts/superset-operator/values.yaml
index e47099e..233ca2b 100644
--- a/charts/superset-operator/values.yaml
+++ b/charts/superset-operator/values.yaml
@@ -6,6 +6,9 @@ image:
# -- Image pull policy.
pullPolicy: IfNotPresent
+# -- Existing Secrets used to pull the operator image from a private registry.
+imagePullSecrets: []
+
# -- Number of operator manager replicas.
replicas: 1
diff --git a/docs/reference/releases.md b/docs/reference/releases.md
index 3c6a1a4..5d94cff 100644
--- a/docs/reference/releases.md
+++ b/docs/reference/releases.md
@@ -26,6 +26,7 @@ This page tracks notable changes in Apache Superset
Kubernetes Operator releases
### Added
- **Seconds and year precision in `cronSchedule`.** Lifecycle task
`cronSchedule` fields now accept 6- and 7-field cron expressions in addition to
the classic 5-field form — an optional leading seconds field and/or trailing
year field (e.g. `*/30 * * * * *` every 30 seconds, `0 0 2 * * * 2027`).
Existing 5-field schedules are unaffected
([#238](https://github.com/apache/superset-kubernetes-operator/pull/238),
[@villebro](https://github.com/villebro)).
+- **Helm `imagePullSecrets`.** The Helm chart now exposes an
`imagePullSecrets` value that sets `spec.template.spec.imagePullSecrets` on the
operator Deployment, letting operators pull the manager image from a private
registry. The referenced Secrets must already exist in the release namespace —
the chart does not create them
([#240](https://github.com/apache/superset-kubernetes-operator/pull/240),
[@younsl](https://github.com/younsl)).
- **Helm `topologySpreadConstraints`.** The Helm chart now exposes a
`topologySpreadConstraints` value that sets
`spec.template.spec.topologySpreadConstraints` on the operator Deployment,
letting operators distribute manager pods across failure domains such as nodes
and zones
([#213](https://github.com/apache/superset-kubernetes-operator/pull/213),
[@younsl](https://github.com/younsl)).
- **Helm `revisionHistoryLimit`.** The Helm chart now exposes a
`revisionHistoryLimit` value that allows setting `spec.revisionHistoryLimit` on
the operator Deployment, capping the number of old ReplicaSets retained for
rollback ([@younsl](https://github.com/younsl)).
- **Helm extra manifests.** The Helm chart now supports `extraManifests` for
rendering trusted, release-scoped Kubernetes manifests with Helm `tpl`. Use it
for companion resources owned by the operator release, not shared cluster
infrastructure such as Gateway API controllers, CRDs, or shared Gateways
([#196](https://github.com/apache/superset-kubernetes-operator/pull/196),
[@younsl](https://github.com/younsl)).
