Postgres-operator: How to get secret for custom Spilo image?

[okolesnykovvs]

Right now it's possible to specify docker_image to use custom Spilo image, like documentation says:

docker_image Spilo docker image for postgres instances. For production, don't rely on the default image, as it might be not the most up-to-date one. Instead, build your own Spilo image from the github repository.

But we can't specify secret for the custom image. So when I configure like:
docker_image: private_registry/company/spilo-cdp-10:1.5-p35
it fails to fetch image from the private registry.

Looking into source code - https://github.com/zalando/postgres-operator/blob/master/pkg/util/config/config.go#L78
There is no option to specify secret too.

[alexeyklyukin]

Hm... can't you set imagePullSecrets for your service account instead?

[okolesnykovvs]

@alexeyklyukin , tried to set it, but does not help. Anyway such option will not cover case if we use few registries.

[alexeyklyukin]

@okolesnykovvs did you also specify the service account you've attached your secrets to in the pod_service_account_name option of the operator configuration?

You can deal with multiple registries as well by creating multiple service accounts. It's also questionable whether one really need a single operator managing Postgres pods that run images from multiple private registries

[knan-nrk]

We would also like to set imagePullSecrets for use of a custom spilo. It's more convenient if postgres-operator can set it on the serviceaccount when it is deploying the serviceaccount and cluster, instead of the cluster creation stalling until we edit the service account in the target namespace.
Precreating the serviceaccount with the right addon in all namespaces is of course an option but not very agile. ;)

[knan-nrk]

All right. I've been testing a bit, and for us using a custom pod_service_account_definition with the imagePullSecret set works and is good enough. Like @alexeyklyukin suggested. It's then added to the serviceaccount on creation.

In the configmap:
pod_service_account_definition: '{ "apiVersion": "v1", "kind": "ServiceAccount", "metadata": { "name": "zalando-postgres-operator" }, "imagePullSecrets": [ { "name": "my-fine-secret" } ] }'

[FxKu]

Thanks @knan-nrk for the tests. This answers the question. I'll have a look where to add this explanation to the docs.

[jiandanshifu]

@alexeyklyukin
How to set parameters of "imagePullSecrets"？

[deepd]

The following worked for me:

apiVersion: "acid.zalan.do/v1"
kind: OperatorConfiguration
metadata:
  name: postgresql-operator-config
  namespace: myNamespace
configuration:
  kubernetes:
    pod_service_account_name: postgres-pod
    pod_service_account_definition: '
      {
        "apiVersion": "v1",
        "kind": "ServiceAccount",
        "metadata": {
          "name": "postgres-pod"
        },
        "imagePullSecrets": [
          {
            "name": "SECRET_NAME"
          }
        ]
      }'