mirror of
https://github.com/cozystack/cozystack.git
synced 2026-11-09 14:02:56 +09:00
Aleksei Sviridkin
4593b72cd1
## Summary Implements support for private OCI registry and Git repository credentials in platform sources. Adds `--platform-source-secret` flag to the operator and corresponding Helm chart parameter. Closes #2455 ## Changes ### Operator (`cmd/cozystack-operator/main.go`) - Added `--platform-source-secret` flag for specifying Secret name - Updated `generateOCIRepository()` to set `spec.secretRef` when secret is provided - Updated `generateGitRepository()` to set `spec.secretRef` when secret is provided - Secret is expected to be in `cozy-system` namespace ### Helm Chart - **`packages/core/installer/values.yaml`**: Added `cozystackOperator.platformSourceSecret` parameter with documentation - **`packages/core/installer/templates/cozystack-operator.yaml`**: Pass `--platform-source-secret` flag to operator container ## Usage Example ### For private OCI registry (e.g., GitLab Container Registry): ```bash # Create registry credentials secret kubectl create secret docker-registry gitlab-registry-creds \ --namespace cozy-system \ --docker-server=registry.gitlab.example.com \ --docker-username=<username> \ --docker-password=<token> ``` ```yaml # Helm values cozystackOperator: platformSourceUrl: 'oci://registry.gitlab.example.com/mygroup/cozystack-packages' platformSourceRef: 'tag=v1.0.0' platformSourceSecret: 'gitlab-registry-creds' ``` ### For private Git repository: ```bash # Create Git credentials secret (SSH key or basic auth) kubectl create secret generic git-creds \ --namespace cozy-system \ --from-literal=username=<username> \ --from-literal=password=<token> ``` ```yaml # Helm values cozystackOperator: platformSourceUrl: 'https://github.com/private-org/cozystack-packages' platformSourceRef: 'branch=main' platformSourceSecret: 'git-creds' ``` ## Testing Manually verified: - OCIRepository resource is created with `spec.secretRef` when secret name is provided - GitRepository resource is created with `spec.secretRef` when secret name is provided - Resources are created without `spec.secretRef` when secret name is empty (backward compatible) - Helm chart renders correctly with and without `platformSourceSecret` parameter ## Checklist - [x] Code follows project style and conventions - [x] Operator supports both OCI and Git source types - [x] Helm chart parameter documented with comments - [x] Backward compatible (empty secret name is handled correctly) - [x] Closes referenced issue (#2455) ## Release note ```release-note feat(operator): add `--platform-source-secret` flag to authenticate the platform package source against private OCI registries (kubernetes.io/dockerconfigjson) and private Git repositories (basic-auth, bearer token, or SSH key). Empty value preserves existing public-registry behaviour. ``` <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added support for configuring a Kubernetes Secret for the platform source. * Installer settings and startup options now let you provide a secret name for Flux source credentials. * **Bug Fixes** * Generated platform source resources can now reference the provided Secret, enabling authenticated access for OCI and Git sources. * **Documentation** * Updated configuration docs to explain the new secret setting and required secret format. <!-- end of auto-generated comment: release notes by coderabbit.ai -->