opendefensecloud / solution-arsenal / 31585127502

80%

Build Type

push

github

Committed by web-flow

Commit Message

feat: pull secrets provision added for deployments to solar via ocm-kit (#739)

## What
Moves helm values-template rendering out of discovery and into
`solar-renderer`, so
the rendered values are computed per-Target and can carry that target's
registry pull
secrets. Charts can now emit `imagePullSecrets` on the workloads they
create, without
the user setting any `Release.spec.values`.
Closes #560 

## Why
FluxCD resources have their pull secrets
(`OCIRepository.spec.secretRef`), but the workloads
the chart itself creates came out with no `imagePullSecrets` if not
explicitly suplpied by
the user. Those Deployments failed to pull from private registries.

## Testing
- **Unit:** `pkg/renderer/values_template_test.go` (template rendering,
pull-secret
merging, credential/consumer-identity setup),
`pkg/ociregistry/host_test.go`,
`api/solar/v1alpha1/component_types_test.go` (`OCMRef` incl. empty-name
degradation).
- **envtest:** `pkg/controller/rendertask_sourcecreds_test.go` covers
both source-secret
shapes landing correctly on the render Job; `target_controller_test.go`
extended for
`ref`/`pullSecrets`/`sourceSecretRef` propagation and tag-drift on
binding changes.
- **e2e:** new `test/e2e` contexts "helm values templating" and "pull
secrets for chart
workloads" — the latter builds a CTF from
`test/fixtures/pullsecret-demo`, transfers it
into the in-cluster registry, creates a Release with **no** values, and
asserts the
pull secret appears both in the rendered ConfigMap and on the resulting
Deployment.
Last full green run was against the pre-`third_party`-removal tree;
worth one more
  `make test-e2e` before merge.

## Notes for reviewers

- `HelmResourceMetadata.valuesTemplate` is gone from `ComponentVersion`.

 - `ComponentSpec.name` is new and only written by discovery. Components
discovered before this change have an empty `name`, so `OCMRef` returns
`""` and the
renderer silently skips values-template rendering. A re-scan repopulates
the field.


## C... (continued)

Coverage Stats

207 of 275 new or added lines in 10 files covered. (75.27%)

6 existing lines in 3 files now uncovered.

5466 of 6807 relevant lines covered (80.3%)

32.69 hits per line