Add imagePullSecrets to post-upgrade job (#9264) (#9273)

Signed-off-by: Frank Wittig <frank@e5k.de>
Signed-off-by: Trey Dockendorf <tdockendorf@osc.edu>
Co-authored-by: Frank Wittig <frank@e5k.de>
Co-authored-by: Vishal Choudhary <vishal.choudhary@nirmata.com>

charts/kyverno/Chart.yaml

@@ -79,6 +79,8 @@ annotations:
       description: Fix Helm chart to not error when replicas defined
     - kind: added
       description: allow tolerations and affinity settings for reportsCleanup
+    - kind: added
+      description: Add imagePullSecrets to post-upgrade job
 dependencies:
   - name: grafana
     version: "0.0.0"

charts/kyverno/README.md

@@ -720,6 +720,7 @@ The chart values are organised per component.
 | policyReportsCleanup.image.repository | string | `"bitnami/kubectl"` | Image repository |
 | policyReportsCleanup.image.tag | string | `"1.28.4"` | Image tag Defaults to `latest` if omitted |
 | policyReportsCleanup.image.pullPolicy | string | `nil` | Image pull policy Defaults to image.pullPolicy if omitted |
+| policyReportsCleanup.imagePullSecrets | list | `[]` | Image pull secrets |
 | policyReportsCleanup.podSecurityContext | object | `{}` | Security context for the pod |
 | policyReportsCleanup.nodeSelector | object | `{}` | Node labels for pod assignment |
 | policyReportsCleanup.tolerations | list | `[]` | List of node taints to tolerate |

charts/kyverno/templates/hooks/post-upgrade.yaml

@@ -54,6 +54,10 @@ spec:
           securityContext:
             {{- toYaml . | nindent 12 }}
           {{- end }}
+      {{- with .Values.policyReportsCleanup.imagePullSecrets }}
+      imagePullSecrets:
+        {{- tpl (toYaml .) $ | nindent 8 }}
+      {{- end }}
       {{- with .Values.policyReportsCleanup.tolerations }}
       tolerations:
         {{- tpl (toYaml .) $ | nindent 8 }}

charts/kyverno/values.yaml

@@ -391,6 +391,10 @@ policyReportsCleanup:
     # Defaults to image.pullPolicy if omitted
     pullPolicy: ~
 
+  # -- Image pull secrets
+  imagePullSecrets: []
+  # - name: secretName
+
   # -- Security context for the pod
   podSecurityContext: {}