Inject global OpenShift pull-secret for Konflux deployment mode

[mclasmeier]

When deploying Konflux-built images on OpenShift 4, the standard namespace-level pull secret mechanism doesn't work for CRI-O due to a known limitation. This PR works around this by injecting registry credentials for quay.io/rhacs-eng into OpenShift's global pull secret (openshift-config/pull-secret) before deployment.

For reliable patching of an externally-owned resource we use a proper Kubernetes client, allowing for precise retry-in-conflict behavior.

Detailed changes:

• Add k8s.io/client-go dependency and k8s.NewClient() helper
• Create the Kubernetes client during deployer initialization
• Implement create-or-update logic for the global pull secret with retry handling for TOCTOU races, since this not a roxie-owned resource
• Gate the injection on KonfluxImages && ClusterTypeOpenShift4 (infra clusters already have the secret)
• Unit tests for injectRegistryCredentialsIntoSecret

[porridge]

@mclasmeier you say [REVIEW RELATIVE TO https://github.com/stackrox/roxie/commit/44be07b7d65bdd98ab8299e1d19916bc1697568a] but I cannot see this commit in the list...

[mclasmeier]

@mclasmeier you say [REVIEW RELATIVE TO https://github.com/stackrox/roxie/commit/44be07b7d65bdd98ab8299e1d19916bc1697568a] but I cannot see this commit in the list...

Updated commit in description!

[porridge]

Are you aware that updating the global image pull secret requires a rolling restart of all nodes? Maybe it would be better to integrate with the image prefetcher for speed instead?

[porridge]

So are we now going to migrate uses of kubectl into direct calls to kube API server from Go?
If not, where do we draw the line?

[mclasmeier]

I think it's something to consider.
But I don't see any urgency in doing so.
For certain new use-cases, like my conflict handling in this PR, i think it makes sense to use client-go.

[porridge]

AFAICT we only need the connection in a very narrow case: downstream images on an OpenShift cluster, and only until https://redhat.atlassian.net/browse/RFE-1956 is shipped (already in dev preview in 4.21 judging by the comments there), so this comment seems like a stretch.

[mclasmeier]

Well, that is currently exactly the use-case I am trying to wrap up. 🤷

[mclasmeier]

Are you aware that updating the global image pull secret requires a rolling restart of all nodes? Maybe it would be better to integrate with the image prefetcher for speed instead?

I haven't been aware of this requirement for the nodes.

I haven't run experiments with the image prefetcher as of now.
I hope that it would really allow us to skip the pull-secret patching.

[coderabbitai]

Warning

Rate limit exceeded

@mclasmeier has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 58 minutes and 48 seconds before requesting another review.

You’ve run out of usage credits. Purchase more in the billing tab.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yml

Review profile: CHILL

Plan: Enterprise

Run ID: 3b04c50c-58df-4fc8-b48d-c7743203dbf5

📥 Commits

Reviewing files that changed from the base of the PR and between befa352 and 07e05e2.

⛔ Files ignored due to path filters (1)

• go.sum is excluded by !**/*.sum

📒 Files selected for processing (5)

• go.mod
• internal/deployer/deployer.go
• internal/deployer/openshift.go
• internal/deployer/openshift_test.go
• internal/k8s/client.go

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch mc/inject-global-pull-secret

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[mclasmeier]

rebased on current main.