diff --git a/.exp/design-workflow-3-helm-chart-deployment.md b/.exp/design-workflow-3-helm-chart-deployment.md index 2ba4e5325e6..7bee6ebf17e 100644 --- a/.exp/design-workflow-3-helm-chart-deployment.md +++ b/.exp/design-workflow-3-helm-chart-deployment.md @@ -18,7 +18,8 @@ The chart is marked as experimental in the README, encouraging feedback via GitH ### Helm Chart Structure - **Chart.yaml**: Defines the chart's metadata, including name (`onlineboutique`), version (`0.10.4`), and type (`application`). No external dependencies. - **values.yaml**: Comprehensive configuration file with defaults for: - - Global settings: `images.repository`, service accounts creation/annotation, feature flags (e.g., `networkPolicies.create: false`, `opentelemetryCollector.create: false`). + - Global settings: `images.repository`, feature flags (e.g., `networkPolicies.create: false`, `opentelemetryCollector.create: false`). + - Service Accounts: `create: true` to enable ServiceAccount creation, `annotations: {}` for adding labels/annotations (e.g., Workload Identity), `imagePullSecrets: []` (override) for specifying secrets to pull images from private registries. - Per-service configs: Resource requests/limits for each microservice (e.g., `adService.resources.requests.cpu: 200m`), enable/disable flags (`create: true`). - Database: `cartDatabase.type: redis` (default in-cluster Redis) or `spanner` with connection string and IAM annotations. - Frontend-specific: `externalService: true` for LoadBalancer exposure, `virtualService.create: false` for Istio, branding/platform options. @@ -38,7 +39,7 @@ The chart is marked as experimental in the README, encouraging feedback via GitH - NetworkPolicies per service if enabled. - Istio AuthorizationPolicies. - Sidecars (e.g., for TLS origination to external Redis). - - ServiceAccounts with annotations (e.g., for GCP Workload Identity). + - ServiceAccounts with annotations (e.g., for GCP Workload Identity) and optional `imagePullSecrets` for pulling images from private registries. - **Integration Points**: Supports external databases, custom images (e.g., from Artifact Registry), and Istio gateways. ## Sequence Diagrams @@ -55,26 +56,26 @@ sequenceDiagram U->>H: helm upgrade --install [options] [values overrides] H->>H: Load chart from OCI registry or local path H->>H: Merge default values.yaml with user overrides - H->>H: Render templates (e.g., service Deployments, conditional policies) + H->>H: Render templates (e.g., service Deployments, ServiceAccounts with optional imagePullSecrets, conditional policies) H->>S: Apply rendered YAMLs (e.g., Deployments, Services, Redis if enabled) S->>R: Create/Update Kubernetes objects S->>R: Schedule Pods, pull images, run init containers if needed - Note over R: Microservices start; gRPC health checks; inter-service communication begins - R->>S: Pods become ready; Services get endpoints + Note over R: Microservices start, gRPC health checks, inter-service communication begins + R->>S: Pods become ready, Services get endpoints S->>H: Confirmation of resource creation - H->>U: Helm release status (success/failure); NOTES for frontend access + H->>U: Helm release status (success/failure), NOTES for frontend access ``` ### Component Creation Flowchart -This flowchart shows decision points based on values.yaml flags during template rendering and deployment. +This flowchart shows decision points based on values.yaml flags during template rendering and deployment, including `serviceAccounts.imagePullSecrets` for enabling private image registry access. ```mermaid flowchart TD Start[User runs helm install/upgrade with values] --> Load[Load Chart.yaml, values.yaml, templates/] - Load --> CheckFlags[Evaluate feature flags e.g. networkPolicies.create, cartDatabase.type] + Load --> CheckFlags[Evaluate feature flags e.g. networkPolicies.create, cartDatabase.type, serviceAccounts.imagePullSecrets] CheckFlags -->|redis| CreateRedis[Create in-cluster Redis StatefulSet/Service] CheckFlags -->|spanner| ConfigSpanner[Set env vars & annotations for Spanner connection] - CheckFlags --> RenderServices[Render per-service templates:
Deployments, Services, Probes, Resources] + CheckFlags --> RenderServices[Render per-service templates:
Deployments, Services, Probes, Resources,
ServiceAccounts with optional imagePullSecrets] RenderServices -->|flags enabled| AddPolicies[Add NetworkPolicies, AuthPolicies, Sidecars] RenderServices --> AddOTEL[Add OTEL Collector if create: true] AddPolicies --> Apply[Apply all rendered resources to K8s API] @@ -96,6 +97,7 @@ flowchart TD - **Service Mesh Integration**: Enable `authorizationPolicies.create=true`, `frontend.virtualService.create=true` with Istio gateway details. - **Observability**: Set `opentelemetryCollector.create=true`, `googleCloudOperations.tracing=true` for metrics/traces export to Cloud Operations. - **Security**: Enable `networkPolicies.create=true` for fine-grained traffic control; `seccompProfile.enable=true` for pod security. +- **Private Registry Support**: Create a `kubernetes.io/dockerconfigjson` secret with registry credentials in the target namespace, then set `serviceAccounts.imagePullSecrets: - name: ` in custom values.yaml or via `--set` to include it in all service accounts, allowing pods to authenticate and pull images from private registries. ### Flow of Information in Application Once deployed, information flows as per the system architecture (see project-overview.md): diff --git a/pr-analysis-3059.md b/pr-analysis-3059.md new file mode 100644 index 00000000000..f7b76829ea7 --- /dev/null +++ b/pr-analysis-3059.md @@ -0,0 +1,78 @@ +# PR #3059: Workflow Design Impact Analysis + +## Affected Workflows +- **Helm Chart Deployment (Workflow 3)**: This workflow is directly impacted as the PR changes multiple template files in `helm-chart/templates/` to include optional `imagePullSecrets` in ServiceAccount resources. This enhances the configurability of deployments for private image registries. Justification: All changed files are Helm templates used in this workflow's rendering process during `helm install/upgrade`. + +No other workflows are affected, as they rely on Kubernetes manifests or other tools without these Helm-specific changes. Workflows like Release Process (7) will indirectly include this in future chart publications, but no design changes to their flows. + +## Workflow 3 Analysis + +### Summary of design changes +The PR adds a new configuration capability to the Helm chart by templating `imagePullSecrets` into ServiceAccounts for each microservice and the OpenTelemetry collector. This is achieved through conditional Go templating in each service template file, referencing a new values path `serviceAccounts.imagePullSecrets`. + +- **Affected aspects**: Template rendering step now supports additional ServiceAccount metadata; deployed resources include pull secrets if configured; customization examples now cover private registry setups. +- **Implementation**: Added 4 lines of Helm templating in 12 files, allowing list override in values for all service accounts uniformly. +- **Benefits**: Enables secure image pulls from private repositories (e.g., via dockerconfigjson secrets), useful for restricted environments; no impact on public image deployments. +- **Implications**: Users must manage secrets separately; enhances flexibility but adds a dependency on secret existence for private images. + +The design documentation has been updated to reflect these changes, including descriptions, examples, and diagram annotations. + +### Diff: Deployment Flow Sequence Diagram +This updated sequence diagram highlights the addition in green (rendering of ServiceAccounts with imagePullSecrets). + +```mermaid +sequenceDiagram + participant U as User/CLI + participant H as Helm Client + participant S as Kubernetes Server (API) + participant R as Resources (Pods, Services, etc.) + U->>H: helm upgrade --install [options] [values overrides] + H->>H: Load chart from OCI registry or local path + H->>H: Merge default values.yaml with user overrides + H->>H: Render templates (e.g., service Deployments, conditional policies) + Note right of H: Addition (in green): Include imagePullSecrets in ServiceAccounts if values.serviceAccounts.imagePullSecrets set + H->>S: Apply rendered YAMLs (e.g., Deployments, Services, Redis if enabled) + S->>R: Create/Update Kubernetes objects + S->>R: Schedule Pods, pull images using ServiceAccount secrets if configured + Note over R: Microservices start, gRPC health checks, inter-service communication begins + R->>S: Pods become ready, Services get endpoints + S->>H: Confirmation of resource creation + H->>U: Helm release status (success/failure), NOTES for frontend access + +``` + +(Note: The green highlighting via note and style on H for render phase.) + +### Diff: Component Creation Flowchart +Updated flowchart with green for added/changed elements related to imagePullSecrets. + +```mermaid +flowchart TD + Start[User runs helm install/upgrade with values] --> Load[Load Chart.yaml, values.yaml, templates/] + Load --> CheckFlags[Evaluate feature flags e.g. networkPolicies.create, cartDatabase.type] + CheckFlags -->|imagePullSecrets set| ConfigIPS[Configure imagePullSecrets for ServiceAccounts] + ConfigIPS --> RenderServices + CheckFlags -->|redis| CreateRedis[Create in-cluster Redis StatefulSet/Service] + CheckFlags -->|spanner| ConfigSpanner[Set env vars & annotations for Spanner connection] + CheckFlags --> RenderServices[Render per-service templates:
Deployments, Services, Probes, Resources] + RenderServices -->|flags enabled| AddPolicies[Add NetworkPolicies, AuthPolicies, Sidecars] + RenderServices --> AddOTEL[Add OTEL Collector if create: true] + AddPolicies --> Apply[Apply all rendered resources to K8s API] + AddOTEL --> Apply + CreateRedis --> Apply + ConfigSpanner --> Apply + Apply --> Deploy[Deploy Pods; Image pulls from repository/tag
using imagePullSecrets if present] + Deploy --> Expose[Expose frontend via LoadBalancer or VirtualService] + Expose --> Ready[Application ready: Access via external IP] + style ConfigIPS fill:#90EE90 + style RenderServices fill:#FFFF00 + style Deploy fill:#90EE90 + style Start fill:#e1f5fe + style Ready fill:#e8f5e8 +``` + +- **Green rectangles**: New additions like ConfigIPS node and enhanced Deploy step for image pulls. +- **Yellow rectangle**: Changed RenderServices to note the inclusion. +- No red (removals). + +These diagrams illustrate the integration of the new feature into the existing design.