Skip to content

Add default ImagePullSecret if not present #125

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
ferenc-hechler wants to merge 2 commits into
base: master
Choose a base branch
from
Open

Add default ImagePullSecret if not present #125

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
cd2d84f
allow defining a default image pull secret
Aug 25, 2026
030e0b4
add option to suppress adding the default image-pull-secret for PODs,
Aug 25, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
36 changes: 36 additions & 0 deletions app/imageswap/imageswap.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,6 +37,8 @@
imageswap_disable_label = os.getenv("IMAGESWAP_DISABLE_LABEL", "k8s.twr.io/imageswap")
imageswap_mode = os.getenv("IMAGESWAP_MODE", "MAPS")
imageswap_maps_file = os.getenv("IMAGESWAP_MAPS_FILE", "/app/maps/imageswap-maps.conf")
imageswap_default_image_pull_secret = os.getenv("IMAGESWAP_DEFAULT_IMAGE_PULL_SECRET", None)
imageswap_always_add_default_ips = os.getenv("IMAGESWAP_ALWAYS_ADD_DEFAULT_IPS", "true").lower() == "true"
imageswap_maps_default_key = "default"
imageswap_maps_wildcard_key = "noswap_wildcards"
imageswap_exact_keyword = "[EXACT]"
Expand All @@ -59,6 +61,22 @@
################################################################################


def addImagePullSecrets(imagePullSecrets, default_image_pull_secret):
"""
check imagePullSecrets in format

[ {"name": "secret1"}, {"name", "secret2"} ]

whether there is an entry with name == default_image_pull_secret, if not add it to the list
"""
for secret in imagePullSecrets:
if secret.get("name") == default_image_pull_secret:
return False
app.logger.info(f'adding default image pull secret "{default_image_pull_secret}" to imagePullSecrets')
imagePullSecrets.append({"name": default_image_pull_secret})
return True


@app.route("/", methods=["POST"])
def mutate():

Expand Down Expand Up @@ -119,6 +137,15 @@ def mutate():

app.logger.info(f"Processing init-container: {namespace}/{workload}")
needs_patch = swap_image(init_container_spec) or needs_patch

if imageswap_default_image_pull_secret:
if "imagePullSecrets" in modified_spec["request"]["object"]["spec"]:
imagePullSecrets = modified_spec["request"]["object"]["spec"]["imagePullSecrets"]
needs_patch = addImagePullSecrets(imagePullSecrets, imageswap_default_image_pull_secret) or needs_patch
elif imageswap_always_add_default_ips:
app.logger.info(f'"imagePullSecrets" not present, force-adding default image pull secret "{imageswap_default_image_pull_secret}"')
modified_spec["request"]["object"]["spec"]["imagePullSecrets"] = [{"name": imageswap_default_image_pull_secret}]
needs_patch = True

else:

Expand All @@ -134,6 +161,15 @@ def mutate():
app.logger.info(f"Processing init-container: {namespace}/{workload}")
needs_patch = swap_image(init_container_spec) or needs_patch

if imageswap_default_image_pull_secret:
if "imagePullSecrets" in modified_spec["request"]["object"]["spec"]["template"]["spec"]:
imagePullSecrets = modified_spec["request"]["object"]["spec"]["template"]["spec"]["imagePullSecrets"]
needs_patch = addImagePullSecrets(imagePullSecrets, imageswap_default_image_pull_secret) or needs_patch
elif imageswap_always_add_default_ips:
app.logger.info(f'"imagePullSecrets" not present, force-adding default image pull secret "{imageswap_default_image_pull_secret}"')
modified_spec["request"]["object"]["spec"]["template"]["spec"]["imagePullSecrets"] = [{"name": imageswap_default_image_pull_secret}]
needs_patch = True

if needs_patch:

app.logger.debug("Needs patch")
Expand Down
Loading