Add imagePullSecrets to PodTemplate

[imjasonh]

In K8s, Pods can specify a imagePullSecrets which identifies K8s secrets that the container runtime should use to authorize container image pulls when starting a Pod (K8s docs). This potentially provides creds to the container runtime (docker, containerd, etc.) in cases when the image is not publicly available.

This isn't exposed in a TaskRun's podTemplate (PodTemplate type), to be added to the underlying Pod's configuration.

Exposing this would allow Tekton users to declare K8s secrets that should be used to pull images specified in steps.

/kind feature
/area api

[imjasonh]

On further consideration I don't think we urgently need this, since you can already add pull secrets to the SA that runs the Pod.

[kevinyu98]

we have a similar issue, want to have this feature. I have opened an issue on tekton 2339

[skaegi]

/reopen
/assign
There is the serviceAccount workaround but I think this is still reasonable to add based on how some teams would like to use Tekton. If not me I'll find someone to work on adding support.

[tekton-robot]

@skaegi: Reopened this issue.

In response to this:

/reopen
/assign
There is the serviceAccount workaround but I think this is still reasonable to add based on how some teams would like to use Tekton. If not me I'll find someone to work on adding support.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[animeshsingh]

@skaegi @afrittoli please take a look

[NikeNano]

If it is fine I will look at this and try to make a PR today for it later this evening :) Have you started on this @skaegi ?

[Tomcli]

Thanks @NikeNano for adding this feature. I think this issue can be closed.