Missing ImagePullSecret in VolSync Jobs Causes imagePullBackOff Error

[Sanjeeth8733]

Description:

The VolSync controller pod in the common namespace spawns jobs across both primary and secondary sites for replication. However, these spawned jobs lack an imagePullSecret, which leads to imagePullBackOff errors for the replicator pods as they fail to pull the required images.

Issue Details:

There is currently no Helm chart parameter that can be configured to inject imagePullSecret into the job specs spawned by the VolSync controller. This lack of customization prevents the job from accessing private images when required.

The existing workaround involves patching the service accounts utilized by these jobs to add the necessary imagePullSecret. While effective temporarily, this approach introduces manual intervention needs, especially during switchover events where the secondary site becomes the new primary, and source service accounts are recreated without the secret.

Suggested Solution:

We request a feature in the VolSync Helm chart to support injecting imagePullSecrets directly into the job specifications. This would eliminate the need for manual patches on service accounts.

Additional Information:

Documentation updates have been made to outline this workaround, but we are awaiting an official fix from the VolSync team to streamline the process.

[tesshuflower]

I think part of the issue with setting something in the helm charts is that VolSync is a cluster scoped operator and so setting some parameter such as a secret name may not apply to all namespaces.

If we want to set an image pull secret on any mover pod, that secret needs to exist in the namespace the replicationsource or replicationdestination CR is in.

Is there an issue with using your own service account? I think this is the best way to use your own imagepullsecret. It sounds like perhaps the issue is around trying to wait for volsync to create a service account and then patching it? You can actually create your own service account and then use this rather than having volsync create one. See info in the docs here: https://volsync.readthedocs.io/en/stable/usage/moverserviceaccount.html