You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@camel.apache.org by pc...@apache.org on 2026/05/02 08:18:19 UTC
(camel-k) branch main updated: chore(trait): deprecate image pull delegation
This is an automated email from the ASF dual-hosted git repository.
squakez pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/camel-k.git
The following commit(s) were added to refs/heads/main by this push:
new 6f8323e02 chore(trait): deprecate image pull delegation
6f8323e02 is described below
commit 6f8323e02979d1aad695cba498c863518799de54
Author: Pasquale Congiusti <pa...@gmail.com>
AuthorDate: Fri May 1 09:01:45 2026 +0200
chore(trait): deprecate image pull delegation
Closes #6576
---
docs/modules/ROOT/partials/apis/camel-k-crds.adoc | 10 +-
docs/modules/traits/pages/pull-secret.adoc | 10 +-
helm/camel-k/crds/camel-k-crds.yaml | 102 +++++++++++----------
pkg/apis/camel/v1/trait/pull_secret.go | 10 +-
.../camel.apache.org_integrationplatforms.yaml | 26 +++---
.../camel.apache.org_integrationprofiles.yaml | 26 +++---
.../crd/bases/camel.apache.org_integrations.yaml | 26 +++---
.../config/crd/bases/camel.apache.org_pipes.yaml | 24 ++---
pkg/trait/pull_secret.go | 3 +
9 files changed, 128 insertions(+), 109 deletions(-)
diff --git a/docs/modules/ROOT/partials/apis/camel-k-crds.adoc b/docs/modules/ROOT/partials/apis/camel-k-crds.adoc
index a7e5ee009..4627c4b6a 100644
--- a/docs/modules/ROOT/partials/apis/camel-k-crds.adoc
+++ b/docs/modules/ROOT/partials/apis/camel-k-crds.adoc
@@ -9132,9 +9132,6 @@ The `PodMonitor` resource labels, applicable when `pod-monitor` is `true`.
The Pull Secret trait sets a pull secret on the pod,
to allow Kubernetes to retrieve the container image from an external registry.
-The pull secret can be specified manually or, in case you've configured authentication for an external container registry
-on the `IntegrationPlatform`, the same secret is used to pull images.
-
It's enabled by default whenever you configure authentication for an external container registry,
so it assumes that external registries are private.
@@ -9158,14 +9155,17 @@ string
|
-The pull secret name to set on the Pod. If left empty this is automatically taken from the `IntegrationPlatform` registry configuration.
+The pull secret name to set on the Pod. If left empty this is automatically taken from the platform registry configuration.
|`imagePullerDelegation` +
bool
|
-When using a global operator with a shared platform, this enables delegation of the `system:image-puller` cluster role on the operator namespace to the integration service account.
+When using a global operator with a shared platform, this enables delegation of the `system:image-puller`
+cluster role on the operator namespace to the integration service account.
+
+Deprecated: may be removed in future releases.
|`auto` +
bool
diff --git a/docs/modules/traits/pages/pull-secret.adoc b/docs/modules/traits/pages/pull-secret.adoc
index 9a1b410cf..2698aac40 100755
--- a/docs/modules/traits/pages/pull-secret.adoc
+++ b/docs/modules/traits/pages/pull-secret.adoc
@@ -6,9 +6,6 @@
The Pull Secret trait sets a pull secret on the pod,
to allow Kubernetes to retrieve the container image from an external registry.
-The pull secret can be specified manually or, in case you've configured authentication for an external container registry
-on the `IntegrationPlatform`, the same secret is used to pull images.
-
It's enabled by default whenever you configure authentication for an external container registry,
so it assumes that external registries are private.
@@ -38,11 +35,14 @@ The following configuration options are available:
| pull-secret.secret-name
| string
-| The pull secret name to set on the Pod. If left empty this is automatically taken from the `IntegrationPlatform` registry configuration.
+| The pull secret name to set on the Pod. If left empty this is automatically taken from the platform registry configuration.
| pull-secret.image-puller-delegation
| bool
-| When using a global operator with a shared platform, this enables delegation of the `system:image-puller` cluster role on the operator namespace to the integration service account.
+| When using a global operator with a shared platform, this enables delegation of the `system:image-puller`
+cluster role on the operator namespace to the integration service account.
+
+Deprecated: may be removed in future releases.
| pull-secret.auto
| bool
diff --git a/helm/camel-k/crds/camel-k-crds.yaml b/helm/camel-k/crds/camel-k-crds.yaml
index a1651e9a7..7f9f03ff9 100644
--- a/helm/camel-k/crds/camel-k-crds.yaml
+++ b/helm/camel-k/crds/camel-k-crds.yaml
@@ -5477,15 +5477,16 @@ spec:
traits share this common property.
type: boolean
imagePullerDelegation:
- description: When using a global operator with a shared platform,
- this enables delegation of the `system:image-puller` cluster
- role on the operator namespace to the integration service
- account.
+ description: |-
+ When using a global operator with a shared platform, this enables delegation of the `system:image-puller`
+ cluster role on the operator namespace to the integration service account.
+
+ Deprecated: may be removed in future releases.
type: boolean
secretName:
description: The pull secret name to set on the Pod. If left
- empty this is automatically taken from the `IntegrationPlatform`
- registry configuration.
+ empty this is automatically taken from the platform registry
+ configuration.
type: string
type: object
quarkus:
@@ -8000,15 +8001,16 @@ spec:
traits share this common property.
type: boolean
imagePullerDelegation:
- description: When using a global operator with a shared platform,
- this enables delegation of the `system:image-puller` cluster
- role on the operator namespace to the integration service
- account.
+ description: |-
+ When using a global operator with a shared platform, this enables delegation of the `system:image-puller`
+ cluster role on the operator namespace to the integration service account.
+
+ Deprecated: may be removed in future releases.
type: boolean
secretName:
description: The pull secret name to set on the Pod. If left
- empty this is automatically taken from the `IntegrationPlatform`
- registry configuration.
+ empty this is automatically taken from the platform registry
+ configuration.
type: string
type: object
quarkus:
@@ -10421,15 +10423,16 @@ spec:
traits share this common property.
type: boolean
imagePullerDelegation:
- description: When using a global operator with a shared platform,
- this enables delegation of the `system:image-puller` cluster
- role on the operator namespace to the integration service
- account.
+ description: |-
+ When using a global operator with a shared platform, this enables delegation of the `system:image-puller`
+ cluster role on the operator namespace to the integration service account.
+
+ Deprecated: may be removed in future releases.
type: boolean
secretName:
description: The pull secret name to set on the Pod. If left
- empty this is automatically taken from the `IntegrationPlatform`
- registry configuration.
+ empty this is automatically taken from the platform registry
+ configuration.
type: string
type: object
quarkus:
@@ -12828,15 +12831,16 @@ spec:
traits share this common property.
type: boolean
imagePullerDelegation:
- description: When using a global operator with a shared platform,
- this enables delegation of the `system:image-puller` cluster
- role on the operator namespace to the integration service
- account.
+ description: |-
+ When using a global operator with a shared platform, this enables delegation of the `system:image-puller`
+ cluster role on the operator namespace to the integration service account.
+
+ Deprecated: may be removed in future releases.
type: boolean
secretName:
description: The pull secret name to set on the Pod. If left
- empty this is automatically taken from the `IntegrationPlatform`
- registry configuration.
+ empty this is automatically taken from the platform registry
+ configuration.
type: string
type: object
quarkus:
@@ -22092,15 +22096,16 @@ spec:
traits share this common property.
type: boolean
imagePullerDelegation:
- description: When using a global operator with a shared platform,
- this enables delegation of the `system:image-puller` cluster
- role on the operator namespace to the integration service
- account.
+ description: |-
+ When using a global operator with a shared platform, this enables delegation of the `system:image-puller`
+ cluster role on the operator namespace to the integration service account.
+
+ Deprecated: may be removed in future releases.
type: boolean
secretName:
description: The pull secret name to set on the Pod. If left
- empty this is automatically taken from the `IntegrationPlatform`
- registry configuration.
+ empty this is automatically taken from the platform registry
+ configuration.
type: string
type: object
quarkus:
@@ -24455,15 +24460,16 @@ spec:
traits share this common property.
type: boolean
imagePullerDelegation:
- description: When using a global operator with a shared platform,
- this enables delegation of the `system:image-puller` cluster
- role on the operator namespace to the integration service
- account.
+ description: |-
+ When using a global operator with a shared platform, this enables delegation of the `system:image-puller`
+ cluster role on the operator namespace to the integration service account.
+
+ Deprecated: may be removed in future releases.
type: boolean
secretName:
description: The pull secret name to set on the Pod. If left
- empty this is automatically taken from the `IntegrationPlatform`
- registry configuration.
+ empty this is automatically taken from the platform registry
+ configuration.
type: string
type: object
quarkus:
@@ -35086,14 +35092,15 @@ spec:
All traits share this common property.
type: boolean
imagePullerDelegation:
- description: When using a global operator with a shared
- platform, this enables delegation of the `system:image-puller`
- cluster role on the operator namespace to the integration
- service account.
+ description: |-
+ When using a global operator with a shared platform, this enables delegation of the `system:image-puller`
+ cluster role on the operator namespace to the integration service account.
+
+ Deprecated: may be removed in future releases.
type: boolean
secretName:
description: The pull secret name to set on the Pod. If
- left empty this is automatically taken from the `IntegrationPlatform`
+ left empty this is automatically taken from the platform
registry configuration.
type: string
type: object
@@ -37372,15 +37379,16 @@ spec:
traits share this common property.
type: boolean
imagePullerDelegation:
- description: When using a global operator with a shared platform,
- this enables delegation of the `system:image-puller` cluster
- role on the operator namespace to the integration service
- account.
+ description: |-
+ When using a global operator with a shared platform, this enables delegation of the `system:image-puller`
+ cluster role on the operator namespace to the integration service account.
+
+ Deprecated: may be removed in future releases.
type: boolean
secretName:
description: The pull secret name to set on the Pod. If left
- empty this is automatically taken from the `IntegrationPlatform`
- registry configuration.
+ empty this is automatically taken from the platform registry
+ configuration.
type: string
type: object
quarkus:
diff --git a/pkg/apis/camel/v1/trait/pull_secret.go b/pkg/apis/camel/v1/trait/pull_secret.go
index 53249ee83..c55c9f43a 100644
--- a/pkg/apis/camel/v1/trait/pull_secret.go
+++ b/pkg/apis/camel/v1/trait/pull_secret.go
@@ -20,9 +20,6 @@ package trait
// The Pull Secret trait sets a pull secret on the pod,
// to allow Kubernetes to retrieve the container image from an external registry.
//
-// The pull secret can be specified manually or, in case you've configured authentication for an external container registry
-// on the `IntegrationPlatform`, the same secret is used to pull images.
-//
// It's enabled by default whenever you configure authentication for an external container registry,
// so it assumes that external registries are private.
//
@@ -34,9 +31,12 @@ package trait
type PullSecretTrait struct {
Trait `json:",inline" property:",squash"`
- // The pull secret name to set on the Pod. If left empty this is automatically taken from the `IntegrationPlatform` registry configuration.
+ // The pull secret name to set on the Pod. If left empty this is automatically taken from the platform registry configuration.
SecretName string `json:"secretName,omitempty" property:"secret-name"`
- // When using a global operator with a shared platform, this enables delegation of the `system:image-puller` cluster role on the operator namespace to the integration service account.
+ // When using a global operator with a shared platform, this enables delegation of the `system:image-puller`
+ // cluster role on the operator namespace to the integration service account.
+ //
+ // Deprecated: may be removed in future releases.
ImagePullerDelegation *bool `json:"imagePullerDelegation,omitempty" property:"image-puller-delegation"`
// Automatically configures the platform registry secret on the pod if it is of type `kubernetes.io/dockerconfigjson`.
Auto *bool `json:"auto,omitempty" property:"auto"`
diff --git a/pkg/resources/config/crd/bases/camel.apache.org_integrationplatforms.yaml b/pkg/resources/config/crd/bases/camel.apache.org_integrationplatforms.yaml
index 1320ba8c8..e1eeb897b 100644
--- a/pkg/resources/config/crd/bases/camel.apache.org_integrationplatforms.yaml
+++ b/pkg/resources/config/crd/bases/camel.apache.org_integrationplatforms.yaml
@@ -2191,15 +2191,16 @@ spec:
traits share this common property.
type: boolean
imagePullerDelegation:
- description: When using a global operator with a shared platform,
- this enables delegation of the `system:image-puller` cluster
- role on the operator namespace to the integration service
- account.
+ description: |-
+ When using a global operator with a shared platform, this enables delegation of the `system:image-puller`
+ cluster role on the operator namespace to the integration service account.
+
+ Deprecated: may be removed in future releases.
type: boolean
secretName:
description: The pull secret name to set on the Pod. If left
- empty this is automatically taken from the `IntegrationPlatform`
- registry configuration.
+ empty this is automatically taken from the platform registry
+ configuration.
type: string
type: object
quarkus:
@@ -4714,15 +4715,16 @@ spec:
traits share this common property.
type: boolean
imagePullerDelegation:
- description: When using a global operator with a shared platform,
- this enables delegation of the `system:image-puller` cluster
- role on the operator namespace to the integration service
- account.
+ description: |-
+ When using a global operator with a shared platform, this enables delegation of the `system:image-puller`
+ cluster role on the operator namespace to the integration service account.
+
+ Deprecated: may be removed in future releases.
type: boolean
secretName:
description: The pull secret name to set on the Pod. If left
- empty this is automatically taken from the `IntegrationPlatform`
- registry configuration.
+ empty this is automatically taken from the platform registry
+ configuration.
type: string
type: object
quarkus:
diff --git a/pkg/resources/config/crd/bases/camel.apache.org_integrationprofiles.yaml b/pkg/resources/config/crd/bases/camel.apache.org_integrationprofiles.yaml
index 1bcb94da8..9d90c840a 100644
--- a/pkg/resources/config/crd/bases/camel.apache.org_integrationprofiles.yaml
+++ b/pkg/resources/config/crd/bases/camel.apache.org_integrationprofiles.yaml
@@ -2053,15 +2053,16 @@ spec:
traits share this common property.
type: boolean
imagePullerDelegation:
- description: When using a global operator with a shared platform,
- this enables delegation of the `system:image-puller` cluster
- role on the operator namespace to the integration service
- account.
+ description: |-
+ When using a global operator with a shared platform, this enables delegation of the `system:image-puller`
+ cluster role on the operator namespace to the integration service account.
+
+ Deprecated: may be removed in future releases.
type: boolean
secretName:
description: The pull secret name to set on the Pod. If left
- empty this is automatically taken from the `IntegrationPlatform`
- registry configuration.
+ empty this is automatically taken from the platform registry
+ configuration.
type: string
type: object
quarkus:
@@ -4460,15 +4461,16 @@ spec:
traits share this common property.
type: boolean
imagePullerDelegation:
- description: When using a global operator with a shared platform,
- this enables delegation of the `system:image-puller` cluster
- role on the operator namespace to the integration service
- account.
+ description: |-
+ When using a global operator with a shared platform, this enables delegation of the `system:image-puller`
+ cluster role on the operator namespace to the integration service account.
+
+ Deprecated: may be removed in future releases.
type: boolean
secretName:
description: The pull secret name to set on the Pod. If left
- empty this is automatically taken from the `IntegrationPlatform`
- registry configuration.
+ empty this is automatically taken from the platform registry
+ configuration.
type: string
type: object
quarkus:
diff --git a/pkg/resources/config/crd/bases/camel.apache.org_integrations.yaml b/pkg/resources/config/crd/bases/camel.apache.org_integrations.yaml
index 62508f0e9..b88540cad 100644
--- a/pkg/resources/config/crd/bases/camel.apache.org_integrations.yaml
+++ b/pkg/resources/config/crd/bases/camel.apache.org_integrations.yaml
@@ -8899,15 +8899,16 @@ spec:
traits share this common property.
type: boolean
imagePullerDelegation:
- description: When using a global operator with a shared platform,
- this enables delegation of the `system:image-puller` cluster
- role on the operator namespace to the integration service
- account.
+ description: |-
+ When using a global operator with a shared platform, this enables delegation of the `system:image-puller`
+ cluster role on the operator namespace to the integration service account.
+
+ Deprecated: may be removed in future releases.
type: boolean
secretName:
description: The pull secret name to set on the Pod. If left
- empty this is automatically taken from the `IntegrationPlatform`
- registry configuration.
+ empty this is automatically taken from the platform registry
+ configuration.
type: string
type: object
quarkus:
@@ -11262,15 +11263,16 @@ spec:
traits share this common property.
type: boolean
imagePullerDelegation:
- description: When using a global operator with a shared platform,
- this enables delegation of the `system:image-puller` cluster
- role on the operator namespace to the integration service
- account.
+ description: |-
+ When using a global operator with a shared platform, this enables delegation of the `system:image-puller`
+ cluster role on the operator namespace to the integration service account.
+
+ Deprecated: may be removed in future releases.
type: boolean
secretName:
description: The pull secret name to set on the Pod. If left
- empty this is automatically taken from the `IntegrationPlatform`
- registry configuration.
+ empty this is automatically taken from the platform registry
+ configuration.
type: string
type: object
quarkus:
diff --git a/pkg/resources/config/crd/bases/camel.apache.org_pipes.yaml b/pkg/resources/config/crd/bases/camel.apache.org_pipes.yaml
index 506d1378a..a0b66bb5f 100644
--- a/pkg/resources/config/crd/bases/camel.apache.org_pipes.yaml
+++ b/pkg/resources/config/crd/bases/camel.apache.org_pipes.yaml
@@ -8958,14 +8958,15 @@ spec:
All traits share this common property.
type: boolean
imagePullerDelegation:
- description: When using a global operator with a shared
- platform, this enables delegation of the `system:image-puller`
- cluster role on the operator namespace to the integration
- service account.
+ description: |-
+ When using a global operator with a shared platform, this enables delegation of the `system:image-puller`
+ cluster role on the operator namespace to the integration service account.
+
+ Deprecated: may be removed in future releases.
type: boolean
secretName:
description: The pull secret name to set on the Pod. If
- left empty this is automatically taken from the `IntegrationPlatform`
+ left empty this is automatically taken from the platform
registry configuration.
type: string
type: object
@@ -11244,15 +11245,16 @@ spec:
traits share this common property.
type: boolean
imagePullerDelegation:
- description: When using a global operator with a shared platform,
- this enables delegation of the `system:image-puller` cluster
- role on the operator namespace to the integration service
- account.
+ description: |-
+ When using a global operator with a shared platform, this enables delegation of the `system:image-puller`
+ cluster role on the operator namespace to the integration service account.
+
+ Deprecated: may be removed in future releases.
type: boolean
secretName:
description: The pull secret name to set on the Pod. If left
- empty this is automatically taken from the `IntegrationPlatform`
- registry configuration.
+ empty this is automatically taken from the platform registry
+ configuration.
type: string
type: object
quarkus:
diff --git a/pkg/trait/pull_secret.go b/pkg/trait/pull_secret.go
index bd44d565b..be1cdf7c7 100644
--- a/pkg/trait/pull_secret.go
+++ b/pkg/trait/pull_secret.go
@@ -67,6 +67,7 @@ func (t *pullSecretTrait) Configure(e *Environment) (bool, *TraitCondition, erro
}
}
+ //nolint:staticcheck
return t.SecretName != "" || ptr.Deref(t.ImagePullerDelegation, false), nil, nil
}
func (t *pullSecretTrait) autoConfigure(e *Environment) error {
@@ -79,6 +80,7 @@ func (t *pullSecretTrait) autoConfigure(e *Environment) error {
t.SecretName = s
}
+ //nolint:staticcheck
if t.ImagePullerDelegation == nil {
var isOpenShift bool
if t.Client != nil {
@@ -105,6 +107,7 @@ func (t *pullSecretTrait) Apply(e *Environment) error {
})
})
}
+ //nolint:staticcheck
if ptr.Deref(t.ImagePullerDelegation, false) {
if err := t.delegateImagePuller(e); err != nil {
return err