Implementation

config/manager/env-images.yaml

@@ -13,8 +13,8 @@ spec:
         - name: manager
           env:
             - name: install-cni
-              value: reg.ps-test.goats.shoot.live.k8s-hana.ondemand.com/istio/install-cni:1.27.1-distroless
+              value: europe-docker.pkg.dev/kyma-project/prod/external/istio/install-cni:1.27.1-distroless
             - name: proxyv2
-              value: reg.ps-test.goats.shoot.live.k8s-hana.ondemand.com/istio/proxyv2:1.27.1-distroless
+              value: europe-docker.pkg.dev/kyma-project/prod/external/istio/proxyv2:1.27.1-distroless
             - name: pilot
-              value: reg.ps-test.goats.shoot.live.k8s-hana.ondemand.com/istio/pilot:1.27.1-distroless
+              value: europe-docker.pkg.dev/kyma-project/prod/external/istio/pilot:1.27.1-distroless

internal/images/merge.go

@@ -1,10 +1,14 @@
 package images
 
 import (
+	"os"
+
 	"github.com/imdario/mergo"
 	"sigs.k8s.io/yaml"
 )
 
+const pullSecretEnvVar = "SKR_IMG_PULL_SECRET"
+
 // MergeHubConfiguration merges the Istio hub configuration to the provided manifest.
 func MergeHubConfiguration(manifest []byte, istioImagesHub string) ([]byte, error) {
 	var templateMap map[string]interface{}
@@ -24,3 +28,58 @@ func MergeHubConfiguration(manifest []byte, istioImagesHub string) ([]byte, erro
 
 	return yaml.Marshal(templateMap)
 }
+
+func MergePullSecretEnv(manifest []byte) ([]byte, error) {
+	secret, pullSecretEnvExists := os.LookupEnv(pullSecretEnvVar)
+	if !pullSecretEnvExists {
+		return manifest, nil
+	}
+
+	var templateMap map[string]interface{}
+	_ = yaml.Unmarshal(manifest, &templateMap)
+
+	spec := ensureMap(templateMap, "spec")
+	values := ensureMap(spec, "values")
+	global := ensureMap(values, "global")
+
+	ips, ok := global["imagePullSecrets"].([]interface{})
+	if !ok {
+		ips = []interface{}{}
+	}
+
+	secretName := secret
+	already := false
+	for _, v := range ips {
+		if v == secretName {
+			already = true
+			break
+		}
+	}
+	if !already {
+		ips = append(ips, secretName)
+	}
+
+	global["imagePullSecrets"] = ips
+
+	out, err := yaml.Marshal(templateMap)
+	if err != nil {
+		return nil, err
+	}
+
+	return out, nil
+}
+
+func ensureMap(m map[string]interface{}, key string) map[string]interface{} {
+	v, ok := m[key]
+	if !ok {
+		nm := map[string]interface{}{}
+		m[key] = nm
+		return nm
+	}
+	nm, ok := v.(map[string]interface{})
+	if !ok {
+		nm = map[string]interface{}{}
+		m[key] = nm
+	}
+	return nm
+}

internal/istiooperator/istio-operator-light.yaml

@@ -6,7 +6,7 @@ metadata:
   labels:
     kyma-project.io/module: istio
 spec:
-  hub: reg.ps-test.goats.shoot.live.k8s-hana.ondemand.com
+  hub: europe-docker.pkg.dev/kyma-project/prod/external/istio
   tag: "1.27.1-distroless"
   components:
     base:
@@ -309,7 +309,7 @@ spec:
         requests:
           cpu: 10m
       imagePullPolicy: IfNotPresent
-      imagePullSecrets: [regcred]
+      imagePullSecrets: []
       istioNamespace: istio-system
       istiod:
         enableAnalysis: false

internal/istiooperator/istio-operator.yaml

@@ -6,7 +6,7 @@ metadata:
   labels:
     kyma-project.io/module: istio
 spec:
-  hub: reg.ps-test.goats.shoot.live.k8s-hana.ondemand.com
+  hub: europe-docker.pkg.dev/kyma-project/prod/external/istio
   tag: "1.27.1-distroless"
   components:
     base:
@@ -362,7 +362,7 @@ spec:
         requests:
           cpu: 10m
       imagePullPolicy: IfNotPresent
-      imagePullSecrets: [regcred]
+      imagePullSecrets: []
       istioNamespace: istio-system
       istiod:
         enableAnalysis: false

internal/istiooperator/merge.go

@@ -24,7 +24,11 @@ func (m *IstioMerger) Merge(clusterSize clusterconfig.ClusterSize, istioCR *oper
 	if err != nil {
 		return "", err
 	}
-	iopWithOverrides, err := clusterconfig.MergeOverrides(manifestWithOverrideImagesHub, overrides)
+	manifestWithOverridePullSecret, err := images.MergePullSecretEnv(manifestWithOverrideImagesHub)
+	if err != nil {
+		return "", err
+	}
+	iopWithOverrides, err := clusterconfig.MergeOverrides(manifestWithOverridePullSecret, overrides)
 	if err != nil {
 		return "", err
 	}

internal/istiooperator/merge_experimental.go

@@ -34,7 +34,11 @@ func (m *IstioMerger) Merge(clusterSize clusterconfig.ClusterSize, istioCR *oper
 	if err != nil {
 		return "", err
 	}
-	iopWithOverrides, err := clusterconfig.MergeOverrides(manifestWithOverrideImagesHub, overrides)
+	manifestWithOverridePullSecret, err := images.MergePullSecretEnv(manifestWithOverrideImagesHub)
+	if err != nil {
+		return "", err
+	}
+	iopWithOverrides, err := clusterconfig.MergeOverrides(manifestWithOverridePullSecret, overrides)
 	if err != nil {
 		return "", err
 	}