From cd2d84fa7c7c562e4ec22d14c48ae83481662241 Mon Sep 17 00:00:00 2001 From: Ferenc Hechler Date: Tue, 25 Aug 2026 11:32:11 +0200 Subject: [PATCH 1/2] allow defining a default image pull secret --- app/imageswap/imageswap.py | 27 +++++++++++++++++++++++++++ 1 file changed, 27 insertions(+) diff --git a/app/imageswap/imageswap.py b/app/imageswap/imageswap.py index 3976cab..eba5e68 100755 --- a/app/imageswap/imageswap.py +++ b/app/imageswap/imageswap.py @@ -37,6 +37,7 @@ imageswap_disable_label = os.getenv("IMAGESWAP_DISABLE_LABEL", "k8s.twr.io/imageswap") imageswap_mode = os.getenv("IMAGESWAP_MODE", "MAPS") imageswap_maps_file = os.getenv("IMAGESWAP_MAPS_FILE", "/app/maps/imageswap-maps.conf") +imageswap_default_image_pull_secret = os.getenv("IMAGESWAP_DEFAULT_IMAGE_PULL_SECRET", None) imageswap_maps_default_key = "default" imageswap_maps_wildcard_key = "noswap_wildcards" imageswap_exact_keyword = "[EXACT]" @@ -59,6 +60,22 @@ ################################################################################ +def addImagePullSecrets(imagePullSecrets, default_image_pull_secret): + """ + check imagePullSecrets in format + + [ {"name": "secret1"}, {"name", "secret2"} ] + + whether there is an entry with name == default_image_pull_secret, if not add it to the list + """ + for secret in imagePullSecrets: + if secret.get("name") == default_image_pull_secret: + return False + app.logger.info(f'adding default image pull secret "{default_image_pull_secret}" to imagePullSecrets') + imagePullSecrets.append({"name": default_image_pull_secret}) + return True + + @app.route("/", methods=["POST"]) def mutate(): @@ -119,6 +136,11 @@ def mutate(): app.logger.info(f"Processing init-container: {namespace}/{workload}") needs_patch = swap_image(init_container_spec) or needs_patch + + if imageswap_default_image_pull_secret: + if "imagePullSecrets" in modified_spec["request"]["object"]["spec"]: + imagePullSecrets = modified_spec["request"]["object"]["spec"]["imagePullSecrets"] + needs_patch = addImagePullSecrets(imagePullSecrets, imageswap_default_image_pull_secret) or needs_patch else: @@ -134,6 +156,11 @@ def mutate(): app.logger.info(f"Processing init-container: {namespace}/{workload}") needs_patch = swap_image(init_container_spec) or needs_patch + if imageswap_default_image_pull_secret: + if "imagePullSecrets" in modified_spec["request"]["object"]["spec"]["template"]["spec"]: + imagePullSecrets = modified_spec["request"]["object"]["spec"]["template"]["spec"]["imagePullSecrets"] + needs_patch = addImagePullSecrets(imagePullSecrets, imageswap_default_image_pull_secret) or needs_patch + if needs_patch: app.logger.debug("Needs patch") From 030e0b4611c6625005dc65317a471874092871dd Mon Sep 17 00:00:00 2001 From: Ferenc Hechler Date: Tue, 25 Aug 2026 14:22:38 +0200 Subject: [PATCH 2/2] add option to suppress adding the default image-pull-secret for PODs, which do not define own imagePullSecrets --- app/imageswap/imageswap.py | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/app/imageswap/imageswap.py b/app/imageswap/imageswap.py index eba5e68..f330c14 100755 --- a/app/imageswap/imageswap.py +++ b/app/imageswap/imageswap.py @@ -38,6 +38,7 @@ imageswap_mode = os.getenv("IMAGESWAP_MODE", "MAPS") imageswap_maps_file = os.getenv("IMAGESWAP_MAPS_FILE", "/app/maps/imageswap-maps.conf") imageswap_default_image_pull_secret = os.getenv("IMAGESWAP_DEFAULT_IMAGE_PULL_SECRET", None) +imageswap_always_add_default_ips = os.getenv("IMAGESWAP_ALWAYS_ADD_DEFAULT_IPS", "true").lower() == "true" imageswap_maps_default_key = "default" imageswap_maps_wildcard_key = "noswap_wildcards" imageswap_exact_keyword = "[EXACT]" @@ -141,6 +142,10 @@ def mutate(): if "imagePullSecrets" in modified_spec["request"]["object"]["spec"]: imagePullSecrets = modified_spec["request"]["object"]["spec"]["imagePullSecrets"] needs_patch = addImagePullSecrets(imagePullSecrets, imageswap_default_image_pull_secret) or needs_patch + elif imageswap_always_add_default_ips: + app.logger.info(f'"imagePullSecrets" not present, force-adding default image pull secret "{imageswap_default_image_pull_secret}"') + modified_spec["request"]["object"]["spec"]["imagePullSecrets"] = [{"name": imageswap_default_image_pull_secret}] + needs_patch = True else: @@ -160,6 +165,10 @@ def mutate(): if "imagePullSecrets" in modified_spec["request"]["object"]["spec"]["template"]["spec"]: imagePullSecrets = modified_spec["request"]["object"]["spec"]["template"]["spec"]["imagePullSecrets"] needs_patch = addImagePullSecrets(imagePullSecrets, imageswap_default_image_pull_secret) or needs_patch + elif imageswap_always_add_default_ips: + app.logger.info(f'"imagePullSecrets" not present, force-adding default image pull secret "{imageswap_default_image_pull_secret}"') + modified_spec["request"]["object"]["spec"]["template"]["spec"]["imagePullSecrets"] = [{"name": imageswap_default_image_pull_secret}] + needs_patch = True if needs_patch: