refactor(chart): split image repository and tag in values.yaml again

This makes it possible to fall back to the chart's appVersion attribute
for the operator controller image tag.

Also: allow overriding the image pull policy for the init container
image.

Makefile

@@ -50,8 +50,11 @@ endif
 # This is useful for CI or a project to utilize a specific version of the operator-sdk toolkit.
 OPERATOR_SDK_VERSION ?= v1.34.1
 
-# Image URL to use all building/pushing image targets
-IMG ?= dash0-operator-controller:latest
+# image repository and tag to use for building/pushing the operator image
+IMG_REPOSITORY ?= dash0-operator-controller
+IMG_TAG ?= latest
+IMG ?= $(IMG_REPOSITORY):$(IMG_TAG)
+
 # ENVTEST_K8S_VERSION refers to the version of kubebuilder assets to be downloaded by envtest binary.
 ENVTEST_K8S_VERSION = 1.28.3
 

cmd/main.go

@@ -13,6 +13,7 @@ import (
 	// to ensure that exec-entrypoint and run can make use of them.
 	_ "k8s.io/client-go/plugin/pkg/client/auth"
 
+	corev1 "k8s.io/api/core/v1"
 	"k8s.io/apimachinery/pkg/runtime"
 	utilruntime "k8s.io/apimachinery/pkg/util/runtime"
 	"k8s.io/client-go/kubernetes"
@@ -143,22 +144,40 @@ func startOperatorManager(
 		return fmt.Errorf("cannot start Dash0 operator, the mandatory environment variable " +
 			"\"DASH0_OPERATOR_IMAGE\" is missing")
 	}
+
 	initContainerImage, isSet := os.LookupEnv("DASH0_INIT_CONTAINER_IMAGE")
 	if !isSet {
 		return fmt.Errorf("cannot start Dash0 operator, the mandatory environment variable " +
 			"\"DASH0_INIT_CONTAINER_IMAGE\" is missing")
 	}
+
+	initContainerImagePullPolicyRaw := os.Getenv("DASH0_INIT_CONTAINER_IMAGE_PULL_POLICY")
+	var initContainerImagePullPolicy corev1.PullPolicy
+	if initContainerImagePullPolicyRaw == "" {
+		if initContainerImagePullPolicyRaw == string(corev1.PullAlways) ||
+			initContainerImagePullPolicyRaw == string(corev1.PullIfNotPresent) ||
+			initContainerImagePullPolicyRaw == string(corev1.PullNever) {
+			initContainerImagePullPolicy = corev1.PullPolicy(initContainerImagePullPolicyRaw)
+		} else {
+			setupLog.Info(
+				fmt.Sprintf(
+					"Ignoring unknown pull policy for init container image: %s.", initContainerImagePullPolicyRaw))
+		}
+	}
 	setupLog.Info(
 		"version information",
 		"operator image and version",
 		operatorImage,
 		"init container image and version",
 		initContainerImage,
+		"init container image pull policy override",
+		initContainerImagePullPolicy,
 	)
 
 	images := util.Images{
-		OperatorImage:      operatorImage,
-		InitContainerImage: initContainerImage,
+		OperatorImage:                operatorImage,
+		InitContainerImage:           initContainerImage,
+		InitContainerImagePullPolicy: initContainerImagePullPolicy,
 	}
 
 	if err = (&controller.Dash0Reconciler{

helm-chart/dash0-operator/templates/_helpers.tpl

@@ -40,4 +40,18 @@ helm.sh/chart: {{ include "dash0-operator.chartNameWithVersion" . }}
 {{/* service account name */}}
 {{- define "dash0-operator.serviceAccountName" -}}
 {{- default (printf "%s-controller-manager" (include "dash0-operator.chartName" .)) .Values.operator.serviceAccount.name }}
+{{- end }}
+
+{{/* the controller manager container image */}}
+{{- define "dash0-operator.image" -}}
+{{- printf "%s:%s" .Values.operator.image.repository (include "dash0-operator.imageTag" .) }}
+{{- end }}
+
+{{- define "dash0-operator.imageTag" -}}
+{{- default .Chart.AppVersion .Values.operator.image.tag }}
+{{- end }}
+
+{{/* the init container image */}}
+{{- define "dash0-operator.initContainerImage" -}}
+{{- printf "%s:%s" .Values.operator.initContainerImage.repository .Values.operator.initContainerImage.tag }}
 {{- end }}

helm-chart/dash0-operator/templates/operator/deployment.yaml

@@ -33,8 +33,8 @@ spec:
     spec:
       containers:
       - name: manager
-        image: {{ .Values.operator.image | quote }}
-        {{- if .Values.operator.imagePullPolicy }}
+        image: {{ include "dash0-operator.image" . | quote }}
+        {{- if .Values.operator.image.pullPolicy }}
         imagePullPolicy: {{ .Values.operator.image.pullPolicy }}
         {{- end }}
         command:
@@ -45,9 +45,13 @@ spec:
         - --leader-elect
         env:
         - name: DASH0_OPERATOR_IMAGE
-          value: {{ .Values.operator.image | quote }}
+          value: {{ include "dash0-operator.image" . | quote }}
         - name: DASH0_INIT_CONTAINER_IMAGE
-          value: {{ .Values.operator.initContainerImage | quote }}
+          value: {{ include "dash0-operator.initContainerImage" . | quote }}
+        {{- if .Values.operator.initContainerImage.pullPolicy }}
+        - name: DASH0_INIT_CONTAINER_IMAGE_PULL_POLICY
+          value: {{ .Values.operator.initContainerImage.pullPolicy }}
+        {{- end }}
         ports:
         - containerPort: 9443
           name: webhook-server
@@ -93,6 +97,10 @@ spec:
           capabilities:
             drop:
             - ALL
+      {{- with .Values.operator.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
       securityContext:
         runAsNonRoot: true
         seccompProfile:

helm-chart/dash0-operator/tests/operator/deployment_test.yaml

@@ -22,9 +22,17 @@ tests:
         podLabels:
           label1: "value 1"
           label2: "value 2"
-        image: custom-operator-image:1.2.3
-        imagePullPolicy: Never
-        initContainerImage: custom-init-container-image:4.5.6
+        image:
+          repository: custom-operator-image
+          tag: "1.2.3"
+          pullPolicy: Never
+        initContainerImage:
+          repository: custom-init-container-image
+          tag: "4.5.6"
+          pullPolicy: Always
+        imagePullSecrets:
+          - name: regcred
+          - name: anotherSecret
         managerPodResources:
           limits:
             cpu: 123m
@@ -60,18 +68,36 @@ tests:
       - equal:
           path: spec.template.metadata.labels['label2']
           value: "value 2"
+      - equal:
+          path: spec.template.spec.imagePullSecrets[0].name
+          value: regcred
+      - equal:
+          path: spec.template.spec.imagePullSecrets[1].name
+          value: anotherSecret
       - equal:
           path: spec.template.spec.containers[0].image
           value: custom-operator-image:1.2.3
       - equal:
           path: spec.template.spec.containers[0].imagePullPolicy
           value: Never
+      - equal:
+          path: spec.template.spec.containers[0].env[0].name
+          value: DASH0_OPERATOR_IMAGE
       - equal:
           path: spec.template.spec.containers[0].env[0].value
           value: custom-operator-image:1.2.3
+      - equal:
+         path: spec.template.spec.containers[0].env[1].name
+         value: DASH0_INIT_CONTAINER_IMAGE
       - equal:
           path: spec.template.spec.containers[0].env[1].value
           value: custom-init-container-image:4.5.6
+      - equal:
+          path: spec.template.spec.containers[0].env[2].name
+          value: DASH0_INIT_CONTAINER_IMAGE_PULL_POLICY
+      - equal:
+          path: spec.template.spec.containers[0].env[2].value
+          value: Always
       - equal:
           path: spec.template.spec.containers[0].resources.limits.cpu
           value: 123m

helm-chart/dash0-operator/values.yaml

@@ -71,14 +71,28 @@ operator:
   webhookPort: 443
 
   # the container image to use for the controller manager component (there should usually be no reason to override this)
-  image: "dash0-operator-controller:1.0.0"
-
-  # override the default image pull policy
-  imagePullPolicy:
+  image:
+    # Use a different image entirely. Note that Dash0 does not offer support for Dash0 operator setups that do not use
+    # Dash0's official image.
+    repository: "dash0-operator-controller"
+    # overrides the image tag, which defaults to the chart appVersion.
+    tag:
+    # override the default image pull policy
+    pullPolicy:
 
   # the container image to use for the instrumentation init container
   # (there should usually be no reason to override this)
-  initContainerImage: "dash0-instrumentation:1.0.0"
+  initContainerImage:
+    # Use a different image for the init container entirely. Note that Dash0 does not offer support for Dash0 operator
+    # setups that do not use Dash0's official init container image.
+    repository: "dash0-instrumentation"
+    # overrides the image tag for the init container image
+    tag: "1.0.0"
+    # override the default image pull policy
+    pullPolicy:
+
+  # the image pull secrets to pull the container images
+  imagePullSecrets: []
 
 # settings for the OpenTelemetry collector instance
 collector:

internal/controller/dash0_controller_test.go

@@ -11,6 +11,7 @@ import (
 	. "github.com/onsi/ginkgo/v2"
 	. "github.com/onsi/gomega"
 
+	corev1 "k8s.io/api/core/v1"
 	apierrors "k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/api/meta"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
@@ -40,8 +41,9 @@ var (
 	pollingInterval = 50 * time.Millisecond
 
 	images = util.Images{
-		OperatorImage:      "some-registry.com:1234/dash0-operator-controller:1.2.3",
-		InitContainerImage: "some-registry.com:1234/dash0-instrumentation:4.5.6",
+		OperatorImage:                "some-registry.com:1234/dash0-operator-controller:1.2.3",
+		InitContainerImage:           "some-registry.com:1234/dash0-instrumentation:4.5.6",
+		InitContainerImagePullPolicy: corev1.PullAlways,
 	}
 )
 

internal/util/types.go

@@ -3,6 +3,8 @@
 
 package util
 
+import corev1 "k8s.io/api/core/v1"
+
 type ConditionType string
 type Reason string
 
@@ -19,8 +21,9 @@ const (
 )
 
 type Images struct {
-	OperatorImage      string
-	InitContainerImage string
+	OperatorImage                string
+	InitContainerImage           string
+	InitContainerImagePullPolicy corev1.PullPolicy
 }
 
 type InstrumentationMetadata struct {

internal/webhook/webhook_suite_test.go

@@ -18,6 +18,7 @@ import (
 	. "github.com/onsi/gomega"
 
 	admissionv1 "k8s.io/api/admission/v1"
+	corev1 "k8s.io/api/core/v1"
 	apimachineryruntime "k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/client-go/kubernetes"
 	clientgoscheme "k8s.io/client-go/kubernetes/scheme"
@@ -45,8 +46,9 @@ var (
 	cancel    context.CancelFunc
 
 	images = util.Images{
-		OperatorImage:      "some-registry.com:1234/dash0-operator-controller:1.2.3",
-		InitContainerImage: "some-registry.com:1234/dash0-instrumentation:4.5.6",
+		OperatorImage:                "some-registry.com:1234/dash0-operator-controller:1.2.3",
+		InitContainerImage:           "some-registry.com:1234/dash0-instrumentation:4.5.6",
+		InitContainerImagePullPolicy: corev1.PullAlways,
 	}
 )
 

internal/workloads/workload_modifier.go

@@ -170,7 +170,7 @@ func (m *ResourceModifier) createInitContainer(podSpec *corev1.PodSpec) *corev1.
 		initContainerGroup = securityContext.FSGroup
 	}
 
-	return &corev1.Container{
+	initContainer := &corev1.Container{
 		Name:  initContainerName,
 		Image: m.instrumentationMetadata.InitContainerImage,
 		Env: []corev1.EnvVar{
@@ -195,6 +195,11 @@ func (m *ResourceModifier) createInitContainer(podSpec *corev1.PodSpec) *corev1.
 			},
 		},
 	}
+
+	if m.instrumentationMetadata.InitContainerImagePullPolicy != "" {
+		initContainer.ImagePullPolicy = m.instrumentationMetadata.InitContainerImagePullPolicy
+	}
+	return initContainer
 }
 
 func (m *ResourceModifier) instrumentContainer(container *corev1.Container, dash0CollectorBaseUrl string) {

internal/workloads/workload_modifier_test.go

@@ -9,6 +9,7 @@ import (
 	. "github.com/onsi/ginkgo/v2"
 	. "github.com/onsi/gomega"
 
+	corev1 "k8s.io/api/core/v1"
 	"sigs.k8s.io/controller-runtime/pkg/log"
 
 	"github.com/dash0hq/dash0-operator/internal/util"
@@ -22,8 +23,10 @@ import (
 
 var (
 	instrumentationMetadata = util.InstrumentationMetadata{
-		Images: util.Images{OperatorImage: "some-registry.com:1234/dash0-operator-controller:1.2.3",
-			InitContainerImage: "some-registry.com:1234/dash0-instrumentation:4.5.6",
+		Images: util.Images{
+			OperatorImage:                "some-registry.com:1234/dash0-operator-controller:1.2.3",
+			InitContainerImage:           "some-registry.com:1234/dash0-instrumentation:4.5.6",
+			InitContainerImagePullPolicy: corev1.PullAlways,
 		},
 		InstrumentedBy: "modify_test",
 	}

test/e2e/e2e_helpers.go

@@ -304,7 +304,7 @@ func UninstallCollector(namespace string) error {
 		))
 }
 
-func DeployOperator(operatorNamespace string, image string) {
+func DeployOperator(operatorNamespace string, imageRepository string, imageTag string) {
 	By("deploying the controller-manager")
 	output, err := Run(
 		exec.Command(
@@ -313,10 +313,9 @@ func DeployOperator(operatorNamespace string, image string) {
 			"--namespace",
 			operatorNamespace,
 			"--create-namespace",
-			"--set",
-			fmt.Sprintf("operator.image=%s", image),
-			"--set",
-			"operator.imagePullPolicy=Never",
+			"--set", fmt.Sprintf("operator.image.repository=%s", imageRepository),
+			"--set", fmt.Sprintf("operator.image.tag=%s", imageTag),
+			"--set", "operator.image.pullPolicy=Never",
 			"e2e-tests-operator-helm-release",
 			"helm-chart/dash0-operator",
 		))

test/e2e/e2e_test.go

@@ -15,8 +15,9 @@ import (
 )
 
 const (
-	operatorNamespace = "dash0-operator-system"
-	operatorImage     = "dash0-operator-controller:latest"
+	operatorNamespace       = "dash0-operator-system"
+	operatorImageRepository = "dash0-operator-controller"
+	operatorImageTag        = "latest"
 
 	kubeContextForTest            = "docker-desktop"
 	applicationUnderTestNamespace = "e2e-application-under-test-namespace"
@@ -91,7 +92,13 @@ var _ = Describe("Dash0 Kubernetes Operator", Ordered, func() {
 
 		By("building the manager(Operator) image")
 		ExpectWithOffset(1,
-			RunAndIgnoreOutput(exec.Command("make", "docker-build", fmt.Sprintf("IMG=%s", operatorImage)))).To(Succeed())
+			RunAndIgnoreOutput(
+				exec.Command(
+					"make",
+					"docker-build",
+					fmt.Sprintf("IMG_REPOSITORY=%s", operatorImageRepository),
+					fmt.Sprintf("IMG_TAG=%s", operatorImageTag),
+				))).To(Succeed())
 
 		setupFinishedSuccessfully = true
 	})
@@ -163,7 +170,7 @@ var _ = Describe("Dash0 Kubernetes Operator", Ordered, func() {
 				Expect(config.installWorkload(applicationUnderTestNamespace)).To(Succeed())
 				By("deploy the operator and the Dash0 custom resource")
 
-				DeployOperator(operatorNamespace, operatorImage)
+				DeployOperator(operatorNamespace, operatorImageRepository, operatorImageTag)
 				DeployDash0Resource(applicationUnderTestNamespace)
 				By(fmt.Sprintf("verifying that the Node.js %s has been instrumented by the controller", config.workloadType))
 				testId := VerifyThatWorkloadHasBeenInstrumented(
@@ -213,7 +220,7 @@ var _ = Describe("Dash0 Kubernetes Operator", Ordered, func() {
 				By("installing the Node.js job")
 				Expect(InstallNodeJsJob(applicationUnderTestNamespace)).To(Succeed())
 				By("deploy the operator and the Dash0 custom resource")
-				DeployOperator(operatorNamespace, operatorImage)
+				DeployOperator(operatorNamespace, operatorImageRepository, operatorImageTag)
 				DeployDash0Resource(applicationUnderTestNamespace)
 				By("verifying that the Node.js job has been labelled by the controller")
 				Eventually(func(g Gomega) {
@@ -230,7 +237,7 @@ var _ = Describe("Dash0 Kubernetes Operator", Ordered, func() {
 	Describe("webhook", func() {
 
 		BeforeAll(func() {
-			DeployOperator(operatorNamespace, operatorImage)
+			DeployOperator(operatorNamespace, operatorImageRepository, operatorImageTag)
 
 			// Deliberately not deploying the Dash0 custom resource here: as of now, the webhook does not rely on the
 			// presence of the Dash0 resource. This is subject to change though. (If changed, it also needs to be