[Feature]: Add imagePullSecrets to the tau-core-controller and gpu-monitoring charts

Open Beginner friendly
  • Is something wrong?
#484 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
78/100
Issue type
Feature
Clarity
Clearly specified
Activity status
Active
Tech stack
helm, kubernetes, yaml
Domain
infrastructure

Research direction

Read charts/tau-core-controller/templates/deployment.yaml and charts/gpu-monitoring/templates/daemonset.yaml, then compare their values and templates with charts/taugrid-core/templates/portal.yaml. Add the chart values and render them in the pod specs; update charts/tau-core-controller/tests/deployment_test.yaml and charts/gpu-monitoring/tests/daemonset_test.yaml. Done means defaults omit the key and configured secrets appear on the controller and every enabled GPU SKU DaemonSet.

Written by the indexing model from the issue text.

Description

enhancement
User problem

Operators who mirror TauGrid images into an authenticated private registry (Harbor, Zot, Artifactory, or a private ACR/ECR that is not wired to node credentials) can override every image repository, but in two charts they can't attach pull credentials:

  • charts/tau-core-controller: templates/deployment.yaml has no imagePullSecrets, and values.yaml has no key for it.
  • charts/gpu-monitoring: templates/daemonset.yaml (one DaemonSet per GPU SKU profile) has no imagePullSecrets, and values.yaml has no key for it.

Every other workload the taugrid umbrella installs already supports pull secrets:

  • taugrid-core: portal, portal.entraAuth, stellar, prewarm and lifecycleRecorder each have imagePullSecrets.
  • kueue: controllerManager.imagePullSecrets.
  • kuberay-operator: imagePullSecrets.

So a mirrored install comes up with the controller and the GPU monitoring DaemonSets stuck in ImagePullBackOff, while everything else pulls fine.

Today's workarounds sit outside the chart: node-level registry credentials (kubelet credential provider, containerd/k3s registries.yaml), or patching the chart-managed tau-core-controller / gpu-monitoring ServiceAccounts by hand, which GitOps tools report as drift.

Desired outcome
tau-core-controller:
  imagePullSecrets:
    - name: registry-creds
gpu-monitoring:
  imagePullSecrets:
    - name: registry-creds

With these values, the controller Deployment and every gpu-monitoring DaemonSet render spec.template.spec.imagePullSecrets, as the taugrid-core components already do.

Proposed approach

Additive, and the default renders exactly as today:

  1. Add imagePullSecrets: [] to both charts' values.yaml.
  2. Render it in the pod spec with the same {{- with ... }} imagePullSecrets: {{ toYaml . | nindent 8 }} block taugrid-core uses (e.g. templates/portal.yaml).
  3. helm-unittest cases in charts/tau-core-controller/tests/deployment_test.yaml and charts/gpu-monitoring/tests/daemonset_test.yaml:
    • The default renders no imagePullSecrets key.
    • When set, the value renders on the controller and on every enabled SKU DaemonSet.

I'd leave charts/tau-core-controller/kustomize/deployment.yaml alone, since a kustomize overlay can add pull secrets with a patch. Tell me if you'd rather keep it in sync.

Alternatives considered
  • A global imagePullSecrets in the umbrella, passed down to every subchart. That would be nicer for mirrored installs, but it touches all subcharts, and kueue and kuberay are vendored. Per-chart keys come first, and a global key can be built on top of them later.
  • Node-level credentials only. These work, but they require node or containerd access that the team installing TauGrid often doesn't have.
Additional context

I found this while mapping what a mirrored or air-gapped install needs. Per-image repository overrides already exist everywhere, so pull secrets are the remaining gap in these two charts. I'm happy to send the PR.

Confirmation
  • I searched existing issues and roadmap items for this request.
  • This request does not include confidential or security-sensitive information.
Dominant language
Go
Stars
59
Forks
8
Avg merge
1d 15h
Merged PRs (30d)
84

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from Azure/taugrid

All issues in Azure/taugrid

Similar issues

More Go issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.