Unable to pass imagePullSecrets for the mover pods

[dheerajjoshim]

Describe the bug
Mover pods fail with an ErrImagePull error when the images are present in the secure registry. VolSync controller exposes the imagePullSecrets variable in the helm chart. However the same is not used while creating the jobs during the reconciliation.

Steps to reproduce
Use secure registries to deploy the VolSync controller and mover pods

Expected behaviour
Either one of the following

• The imagePullSecrets specified during the controller deployment is reused during the mover job creation.
• The imagePullSecrets specified during the controller deployment is reused during the mover service account creation.
• A separate environment variable to pass the imagePullSecrets to the controller which can then be used while creating the jobs.

Additional context
The workaround is to add an image pull secret to the mover service accounts after the job creation. The pod will eventually be up and running.

[tesshuflower]

hi @dheerajjoshim thanks we will have to see whether we should expose this as an option on the replicationsource/dest or not. Getting the imagePullSecrets from the controller itself may not work as the secrets need to be local to the namespace the mover pod runs in.

One thing you can do right now if you don't want to modify the serviceaccount after it's created by volsync is to use your own.

Each mover spec has a moverServiceAccount field you can use if you want to use your own service account instead of VolSync creating it for you.

[dheerajjoshim]

@tesshuflower Yes. Maybe reusing the secret from the VolSync controller namespace is not possible in all cases.

That said, I wasn't aware of the moverServiceAccount configuration of the replicators. Seems like it is missing in the documentation. I can't find anything related to it in the docs

[tesshuflower]

I think it may not have been documented as it was originally added for an internal use-case. Nonetheless, you can still use it if you wish. Each spec.[movertype]. section has a moverServiceAccount field, for example here for restic:

volsync/config/crd/bases/volsync.backube_replicationsources.yaml

Line 676 in e40dad2

moverServiceAccount:

[tesshuflower]

@dheerajjoshim I've created a PR to add info about the moverServiceAccount to the documentation (#1303).

You can see the docs built in the PR here: https://volsync--1303.org.readthedocs.build/en/1303/usage/moverserviceaccount.html

Could you let me know if you have any feedback? Anything missing when it comes to your scenario?

[dheerajjoshim]

Hi @tesshuflower
The documentation changes look good.