From ee0808fe81e005891846d1b4279d1f5c6dbae207 Mon Sep 17 00:00:00 2001 From: Ankitsinghsisodya Date: Sun, 17 May 2026 15:33:01 +0530 Subject: [PATCH 1/2] feat: add support for CLI overrides in func deployment This commit enhances the deployment process by allowing CLI-specified overrides for image pull secrets, service accounts, and deployer types to be forwarded to the in-cluster deployment step. The changes include: - Updated `main.go` to read environment variables for `FUNC_IMAGE_PULL_SECRET`, `FUNC_SERVICE_ACCOUNT`, and `FUNC_DEPLOYER`. - Modified Tekton task templates (`task-buildpack.yaml.tmpl`, `task-s2i.yaml.tmpl`) to include new parameters for these overrides. - Adjusted template data structures in `templates_pack.go` and `templates_s2i.go` to accommodate the new parameters. These enhancements ensure that user-defined configurations are properly applied during deployment, improving flexibility and usability. --- cmd/func-util/main.go | 20 ++++++++++++++-- pkg/pipelines/tekton/task-buildpack.yaml.tmpl | 16 +++++++++++++ pkg/pipelines/tekton/task-s2i.yaml.tmpl | 16 +++++++++++++ pkg/pipelines/tekton/templates.go | 12 ++++++++++ pkg/pipelines/tekton/templates_pack.go | 24 +++++++++++++++++++ pkg/pipelines/tekton/templates_s2i.go | 24 +++++++++++++++++++ 6 files changed, 110 insertions(+), 2 deletions(-) diff --git a/cmd/func-util/main.go b/cmd/func-util/main.go index 7a9dcaf48c..0cf4fab034 100644 --- a/cmd/func-util/main.go +++ b/cmd/func-util/main.go @@ -153,9 +153,25 @@ func deploy(ctx context.Context) error { if f.Deploy.Image == "" { f.Deploy.Image = f.Image } + // For Git-based remote deploys the on-cluster func.yaml comes from the + // committed repo and never contains CLI overrides supplied by the user + // (--image-pull-secret, --service-account, --deployer). The pipeline run + // forwards those overrides as environment variables so they can be applied + // here before deploying. + if v := os.Getenv("FUNC_IMAGE_PULL_SECRET"); v != "" { + f.Deploy.ImagePullSecret = v + } + if v := os.Getenv("FUNC_SERVICE_ACCOUNT"); v != "" { + f.Deploy.ServiceAccountName = v + } + // Resolve the deployer. Mirrors config.Apply on the CLI so a remote deploy - // honors --deployer, which travels in func.yaml as intent. - deployer := f.Deployer + // honors --deployer, which travels in func.yaml as intent, or the + // FUNC_DEPLOYER override forwarded by the pipeline run. + deployer := os.Getenv("FUNC_DEPLOYER") + if deployer == "" { + deployer = f.Deployer + } if deployer == "" { deployer = f.Deploy.Deployer } diff --git a/pkg/pipelines/tekton/task-buildpack.yaml.tmpl b/pkg/pipelines/tekton/task-buildpack.yaml.tmpl index c60e2c06df..2e3cf7bb0d 100644 --- a/pkg/pipelines/tekton/task-buildpack.yaml.tmpl +++ b/pkg/pipelines/tekton/task-buildpack.yaml.tmpl @@ -67,6 +67,15 @@ spec: - name: COMMIT description: Git commit SHA of the function source default: "" + - name: IMAGE_PULL_SECRET + description: Image pull secret name forwarded from the CLI to the in-cluster deploy step + default: "" + - name: SERVICE_ACCOUNT + description: Service account name forwarded from the CLI to the in-cluster deploy step + default: "" + - name: DEPLOYER + description: Deployer type forwarded from the CLI to the in-cluster deploy step (knative, raw, keda) + default: "" stepTemplate: env: - name: CNB_PLATFORM_API @@ -300,6 +309,13 @@ spec: - name: func-deploy image: '{{.DeployerImage}}' workingDir: $(workspaces.source.path) + env: + - name: FUNC_IMAGE_PULL_SECRET + value: $(params.IMAGE_PULL_SECRET) + - name: FUNC_SERVICE_ACCOUNT + value: $(params.SERVICE_ACCOUNT) + - name: FUNC_DEPLOYER + value: $(params.DEPLOYER) command: ["deploy", $(params.SOURCE_SUBPATH), "$(params.APP_IMAGE)"] volumes: - name: empty-dir diff --git a/pkg/pipelines/tekton/task-s2i.yaml.tmpl b/pkg/pipelines/tekton/task-s2i.yaml.tmpl index c739a45a1f..25a8d8b8a3 100644 --- a/pkg/pipelines/tekton/task-s2i.yaml.tmpl +++ b/pkg/pipelines/tekton/task-s2i.yaml.tmpl @@ -45,6 +45,15 @@ spec: - name: COMMIT description: Git commit SHA of the function source default: "" + - name: IMAGE_PULL_SECRET + description: Image pull secret name forwarded from the CLI to the in-cluster deploy step + default: "" + - name: SERVICE_ACCOUNT + description: Service account name forwarded from the CLI to the in-cluster deploy step + default: "" + - name: DEPLOYER + description: Deployer type forwarded from the CLI to the in-cluster deploy step (knative, raw, keda) + default: "" workspaces: - name: source - name: cache @@ -148,6 +157,13 @@ spec: - name: func-deploy image: '{{.DeployerImage}}' workingDir: $(workspaces.source.path) + env: + - name: FUNC_IMAGE_PULL_SECRET + value: $(params.IMAGE_PULL_SECRET) + - name: FUNC_SERVICE_ACCOUNT + value: $(params.SERVICE_ACCOUNT) + - name: FUNC_DEPLOYER + value: $(params.DEPLOYER) command: ["deploy", $(params.PATH_CONTEXT), "$(params.IMAGE)"] volumes: - emptyDir: {} diff --git a/pkg/pipelines/tekton/templates.go b/pkg/pipelines/tekton/templates.go index b853194bcf..72663d63f2 100644 --- a/pkg/pipelines/tekton/templates.go +++ b/pkg/pipelines/tekton/templates.go @@ -93,6 +93,14 @@ type templateData struct { // Git commit SHA of the function source Commit string + + // CLI overrides forwarded to the in-cluster func-deploy task step. + // For Git-based remote deploys the on-cluster func.yaml comes from the + // committed repo and never contains these values; they must be threaded + // through the pipeline run as discrete params. + ImagePullSecret string + ServiceAccountName string + Deployer string } // createPipelineTemplatePAC creates a Pipeline template used for PAC on-cluster build @@ -412,6 +420,10 @@ func createAndApplyPipelineRunTemplate(f fn.Function, namespace string, labels m RepoUrl: f.Build.Git.URL, Revision: pipelinesTargetBranch, + + ImagePullSecret: f.Deploy.ImagePullSecret, + ServiceAccountName: f.Deploy.ServiceAccountName, + Deployer: f.Deploy.Deployer, } var template string diff --git a/pkg/pipelines/tekton/templates_pack.go b/pkg/pipelines/tekton/templates_pack.go index d4e73dc4b7..646d800897 100644 --- a/pkg/pipelines/tekton/templates_pack.go +++ b/pkg/pipelines/tekton/templates_pack.go @@ -44,6 +44,18 @@ spec: name: commit default: '' type: string + - description: Image pull secret name forwarded to the in-cluster deploy step + name: imagePullSecret + default: '' + type: string + - description: Service account name forwarded to the in-cluster deploy step + name: serviceAccount + default: '' + type: string + - description: Deployer type forwarded to the in-cluster deploy step (knative, raw, keda) + name: deployer + default: '' + type: string tasks: - name: build params: @@ -64,6 +76,12 @@ spec: - '$(params.buildEnvs[*])' - name: COMMIT value: $(params.commit) + - name: IMAGE_PULL_SECRET + value: $(params.imagePullSecret) + - name: SERVICE_ACCOUNT + value: $(params.serviceAccount) + - name: DEPLOYER + value: $(params.deployer) {{- if eq .TlsVerify "false"}} - name: INSECURE_REGISTRIES value: $(params.registry) @@ -123,6 +141,12 @@ spec: {{end}} - name: commit value: "{{.Commit}}" + - name: imagePullSecret + value: "{{.ImagePullSecret}}" + - name: serviceAccount + value: "{{.ServiceAccountName}}" + - name: deployer + value: "{{.Deployer}}" pipelineRef: name: {{.PipelineName}} workspaces: diff --git a/pkg/pipelines/tekton/templates_s2i.go b/pkg/pipelines/tekton/templates_s2i.go index 8eb5ccd7a0..e78c57f180 100644 --- a/pkg/pipelines/tekton/templates_s2i.go +++ b/pkg/pipelines/tekton/templates_s2i.go @@ -52,6 +52,18 @@ spec: name: commit default: '' type: string + - description: Image pull secret name forwarded to the in-cluster deploy step + name: imagePullSecret + default: '' + type: string + - description: Service account name forwarded to the in-cluster deploy step + name: serviceAccount + default: '' + type: string + - description: Deployer type forwarded to the in-cluster deploy step (knative, raw, keda) + name: deployer + default: '' + type: string tasks: - name: build params: @@ -76,6 +88,12 @@ spec: value: $(params.tlsVerify) - name: COMMIT value: $(params.commit) + - name: IMAGE_PULL_SECRET + value: $(params.imagePullSecret) + - name: SERVICE_ACCOUNT + value: $(params.serviceAccount) + - name: DEPLOYER + value: $(params.deployer) {{.FuncS2iTaskRef}} workspaces: - name: source @@ -134,6 +152,12 @@ spec: value: {{.TlsVerify}} - name: commit value: "{{.Commit}}" + - name: imagePullSecret + value: "{{.ImagePullSecret}}" + - name: serviceAccount + value: "{{.ServiceAccountName}}" + - name: deployer + value: "{{.Deployer}}" pipelineRef: name: {{.PipelineName}} workspaces: From 80913e1277a0e8192e673a78e67adf2b2712d31c Mon Sep 17 00:00:00 2001 From: Ankitsinghsisodya Date: Thu, 20 Aug 2026 12:16:22 +0530 Subject: [PATCH 2/2] chore: retrigger CI