feat: add imagePullSecrets for private deployment (#330)

Co-authored-by: PNarode <pratik.narode@renaissance.com> Co-authored-by: venky-wandb <92930965+venky-wandb@users.noreply.github.com>
wandb · Feb 12, 2025 · 8c5dc23 · 8c5dc23
1 parent a57e957
commit 8c5dc23
Show file tree

Hide file tree

Showing 22 changed files with 53 additions and 15 deletions.
diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
@@ -1,3 +1,4 @@
 * @jsbroks @vanpelt
 /charts/launch-agent/ @bcsherma @KyleGoyette @TimH98
 /charts/**/service.yaml @dacbd @zacharyblasczyk
+
diff --git a/charts/operator-wandb/Chart.yaml b/charts/operator-wandb/Chart.yaml
@@ -2,7 +2,7 @@ apiVersion: v2
 name: operator-wandb
 description: A Helm chart for deploying W&B to Kubernetes
 type: application
-version: 0.25.5
+version: 0.26.0
 appVersion: 1.0.0
 icon: https://wandb.ai/logo.svg
 

diff --git a/charts/operator-wandb/charts/app/templates/deployment.yaml b/charts/operator-wandb/charts/app/templates/deployment.yaml
@@ -46,6 +46,8 @@ spec:
       # Extend the pods shutdown grace period from the default of 30s to 60s.
       # This goes in the pod template spec.
       terminationGracePeriodSeconds: 60
+      imagePullSecrets:
+      {{- include "wandb.imagePullSecrets" . }}
       initContainers:
         - name: init-db
           image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"

diff --git a/charts/operator-wandb/charts/bufstream/templates/deployment.yaml b/charts/operator-wandb/charts/bufstream/templates/deployment.yaml
@@ -36,10 +36,8 @@ spec:
           {{- toYaml . | nindent 8 }}
         {{- end }}
     spec:
-      {{- with .Values.imagePullSecrets }}
       imagePullSecrets:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
+      {{- include "wandb.imagePullSecrets" . }}
       {{ if .Values.bufstream.deployment.shareProcessNamespace }}
       shareProcessNamespace: true
       {{- end }}

diff --git a/charts/operator-wandb/charts/console/templates/deployment.yaml b/charts/operator-wandb/charts/console/templates/deployment.yaml
@@ -45,6 +45,8 @@ spec:
       # Extend the pods shutdown grace period from the default of 30s to 60s.
       # This goes in the pod template spec.
       terminationGracePeriodSeconds: 60
+      imagePullSecrets:
+      {{- include "wandb.imagePullSecrets" . }}
       containers:
         - name: {{ .Chart.Name }}
           image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"

diff --git a/charts/operator-wandb/charts/executor/templates/deployment.yaml b/charts/operator-wandb/charts/executor/templates/deployment.yaml
@@ -37,16 +37,14 @@ spec:
         {{- include "executor.commonLabels" . | nindent 8 }}
         {{- include "executor.podLabels" . | nindent 8 }}
     spec:
-      {{- with .Values.imagePullSecrets }}
-      imagePullSecrets:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
       serviceAccountName: {{ include "executor.serviceAccountName" . }}
       {{- include "wandb.nodeSelector" . | nindent 6 }}
       {{- include "wandb.priorityClassName" . | nindent 6 }}
       {{- include "wandb.podSecurityContext" .Values.pod.securityContext | nindent 6 }}
       # needed to ensure ensure Kafka consumers handle pod termination gracefully and avoid data loss
       terminationGracePeriodSeconds: 60
+      imagePullSecrets:
+      {{- include "wandb.imagePullSecrets" . }}
       containers:
         - name: {{ .Chart.Name }}
           {{- include "wandb.containerSecurityContext" .Values.container.securityContext | nindent 10 }}

diff --git a/charts/operator-wandb/charts/filestream/templates/deployment.yaml b/charts/operator-wandb/charts/filestream/templates/deployment.yaml
@@ -37,10 +37,8 @@ spec:
         {{- include "filestream.commonLabels" . | nindent 8 }}
         {{- include "filestream.podLabels" . | nindent 8 }}
     spec:
-      {{- with .Values.imagePullSecrets }}
       imagePullSecrets:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
+      {{- include "wandb.imagePullSecrets" . }}
       serviceAccountName: {{ include "filestream.serviceAccountName" . }}
       {{- include "wandb.nodeSelector" . | nindent 6 }}
       {{- include "wandb.priorityClassName" . | nindent 6 }}

diff --git a/charts/operator-wandb/charts/flat-run-fields-updater/templates/deployment.yaml b/charts/operator-wandb/charts/flat-run-fields-updater/templates/deployment.yaml
@@ -39,8 +39,7 @@ spec:
     spec:
       {{- with .Values.imagePullSecrets }}
       imagePullSecrets:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
+      {{- include "wandb.imagePullSecrets" . }}
       serviceAccountName: {{ include "flat-run-fields-updater.serviceAccountName" . }}
       {{- include "wandb.nodeSelector" . | nindent 6 }}
       {{- include "wandb.priorityClassName" . | nindent 6 }}

diff --git a/charts/operator-wandb/charts/mysql/templates/statefulset.yaml b/charts/operator-wandb/charts/mysql/templates/statefulset.yaml
@@ -29,6 +29,8 @@ spec:
       {{- include "wandb.nodeSelector" . | nindent 6 }}
       {{- include "wandb.priorityClassName" . | nindent 6 }}
       {{- include "wandb.podSecurityContext" .Values.pod.securityContext | nindent 6 }}
+      imagePullSecrets:
+      {{- include "wandb.imagePullSecrets" . }}
       containers:
         - name: mysql
           image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
@@ -89,4 +91,4 @@ spec:
         - name: data
           persistentVolumeClaim:
             claimName: {{ include "mysql.fullname" . }}-data
-{{- end }}
+{{- end }}
diff --git a/charts/operator-wandb/charts/nginx/templates/deployment.yaml b/charts/operator-wandb/charts/nginx/templates/deployment.yaml
@@ -36,6 +36,8 @@ spec:
         {{- toYaml .tolerations | nindent 8 }}
       {{- end }}
       {{- include "nginx.podSecurityContext" .Values.pod.securityContext | nindent 6 }}
+      imagePullSecrets:
+      {{- include "wandb.imagePullSecrets" . }}
       containers:
       - image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
         name: {{ .Chart.Name }}

diff --git a/charts/operator-wandb/charts/otel/charts/agent/templates/deployment.yaml b/charts/operator-wandb/charts/otel/charts/agent/templates/deployment.yaml
@@ -43,6 +43,8 @@ spec:
       {{- include "wandb.nodeSelector" . | nindent 6 }}
       {{- include "wandb.priorityClassName" . | nindent 6 }}
       {{- include "wandb.podSecurityContext" .Values.pod.securityContext | nindent 6 }}
+      imagePullSecrets:
+      {{- include "wandb.imagePullSecrets" . }}
       containers:
         - name: {{ .Chart.Name }}
           image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"

diff --git a/charts/operator-wandb/charts/parquet/templates/deployment.yaml b/charts/operator-wandb/charts/parquet/templates/deployment.yaml
@@ -54,6 +54,8 @@ spec:
       {{- include "wandb.nodeSelector" . | nindent 6 }}
       {{- include "wandb.priorityClassName" . | nindent 6 }}
       {{- include "wandb.podSecurityContext" .Values.pod.securityContext | nindent 6 }}
+      imagePullSecrets:
+      {{- include "wandb.imagePullSecrets" . }}
       containers:
         - name: {{ .Chart.Name }}
           image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"

diff --git a/charts/operator-wandb/charts/prometheus/charts/mysql-exporter/templates/deployment.yaml b/charts/operator-wandb/charts/prometheus/charts/mysql-exporter/templates/deployment.yaml
@@ -41,6 +41,8 @@ spec:
       {{- include "wandb.nodeSelector" . | nindent 6 }}
       {{- include "wandb.priorityClassName" . | nindent 6 }}
       {{- include "wandb.podSecurityContext" .Values.pod.securityContext | nindent 6 }}
+      imagePullSecrets:
+      {{- include "wandb.imagePullSecrets" . }}
       containers:
         - name: {{ .Chart.Name }}
           image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"

diff --git a/charts/operator-wandb/charts/prometheus/charts/redis-exporter/templates/deployment.yaml b/charts/operator-wandb/charts/prometheus/charts/redis-exporter/templates/deployment.yaml
@@ -41,6 +41,8 @@ spec:
       {{- include "wandb.nodeSelector" . | nindent 6 }}
       {{- include "wandb.priorityClassName" . | nindent 6 }}
       {{- include "wandb.podSecurityContext" .Values.pod.securityContext | nindent 6 }}
+      imagePullSecrets:
+      {{- include "wandb.imagePullSecrets" . }}
       containers:
         - name: {{ .Chart.Name }}
           image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"

diff --git a/charts/operator-wandb/charts/stackdriver/templates/deployment.yaml b/charts/operator-wandb/charts/stackdriver/templates/deployment.yaml
@@ -36,6 +36,8 @@ spec:
       {{- include "wandb.priorityClassName" . | nindent 6 }}
       {{- include "wandb.podSecurityContext" .Values.pod.securityContext | nindent 6 }}
     spec:
+      imagePullSecrets:
+      {{- include "wandb.imagePullSecrets" . }}
       containers:
         - name: {{ .Chart.Name }}
           image:  "{{ .Values.image.repository }}:{{ .Values.image.tag }}"

diff --git a/charts/operator-wandb/charts/weave-trace/templates/deployment.yaml b/charts/operator-wandb/charts/weave-trace/templates/deployment.yaml
@@ -41,6 +41,8 @@ spec:
       {{- include "wandb.priorityClassName" . | nindent 6 }}
       {{- include "wandb.podSecurityContext" .Values.pod.securityContext | nindent 6 }}
       {{- if not .Values.migration.useHook }}
+      imagePullSecrets:
+      {{- include "wandb.imagePullSecrets" . }}
       initContainers:
         - name: {{ include "weaveTraceMigrate.fullname" . }}
           image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"

diff --git a/charts/operator-wandb/charts/weave/templates/deployment.yaml b/charts/operator-wandb/charts/weave/templates/deployment.yaml
@@ -43,6 +43,8 @@ spec:
       {{- include "wandb.nodeSelector" . | nindent 6 }}
       {{- include "wandb.priorityClassName" . | nindent 6 }}
       {{- include "wandb.podSecurityContext" .Values.pod.securityContext | nindent 6 }}
+      imagePullSecrets:
+      {{- include "wandb.imagePullSecrets" . }}
       containers:
         - name: {{ include "weave.fullname" .  }}
           image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"

diff --git a/charts/operator-wandb/charts/yace/templates/deployment.yaml b/charts/operator-wandb/charts/yace/templates/deployment.yaml
@@ -42,6 +42,8 @@ spec:
       {{- include "wandb.nodeSelector" . | nindent 6 }}
       {{- include "wandb.priorityClassName" . | nindent 6 }}
       {{- include "wandb.podSecurityContext" .Values.pod.securityContext | nindent 6 }}
+      imagePullSecrets:
+      {{- include "wandb.imagePullSecrets" . }}
       containers:
         - name: {{ .Chart.Name }}
           image: "{{ .Values.image.registry }}/{{ .Values.image.repository }}:{{ .Values.image.tag }}"

diff --git a/charts/operator-wandb/templates/_helpers.tpl b/charts/operator-wandb/templates/_helpers.tpl
@@ -71,3 +71,14 @@ otlp+{{ .Values.global.otel.traces.proto }}://{{ .Values.global.otel.traces.host
 otlp+{{ .Values.global.otel.traces.proto }}://{{ .Release.Name }}-otel-daemonset:{{ .Values.global.otel.traces.port }}?trace_ratio={{ default 0.0 .Values.traceRatio }}
 {{- end -}}
 {{- end -}}
+
+{{/*
+Create the name of the imagePullSecret to use
+*/}}
+{{- define "wandb.imagePullSecrets" -}}
+{{- if .Values.global.imagePullSecrets }}
+{{- range .Values.global.imagePullSecrets }}
+- name: {{ . }}
+{{- end }}
+{{- end }}
+{{- end }}
diff --git a/charts/operator-wandb/values.yaml b/charts/operator-wandb/values.yaml
@@ -17,6 +17,11 @@ global:
   licenseSecret:
     name: ""
     key: ""
+  # List of image pull secrets for accessing private container registries.
+  # Example:
+  # imagePullSecrets:
+  #   - name: my-registry-secret
+  imagePullSecrets: []
 
   cloudProvider: ""
 

diff --git a/charts/operator/Chart.yaml b/charts/operator/Chart.yaml
@@ -2,7 +2,7 @@ apiVersion: v2
 name: operator
 description: A Helm chart for Weights & Biases operator
 type: application
-version: 1.3.12
+version: 1.4.0
 appVersion: "1.0.0"
 maintainers:
   - name: wandb

diff --git a/charts/operator/templates/deployment.yaml b/charts/operator/templates/deployment.yaml
@@ -19,6 +19,10 @@ spec:
       securityContext:
         seccompProfile:
           type: RuntimeDefault
+      imagePullSecrets:
+        {{- range .Values.image.pullSecrets }}
+      - name: {{ . }}
+        {{- end }}
       containers:
       - name: manager
         command: