Support add `username`, `password` to repo in HelmChart about clusternet

[silenceper]

/assign @silenceper

[dixudx]

apiVersion: apps.clusternet.io/v1alpha1
kind: HelmChart
metadata:
  name: example
  namespace: default
spec:
  repo: https://private-repo.com/test
  username: xxx
  password: xxx
  chart: example
  version: 0.0.1
  targetNamespace: abc

@silenceper This is not secure. The credentials here are visible to anyone with get/list roles of HelmChart.

Maybe using a secret reference is a better choice.

[silenceper]

I agree.

maybe can chagne to this:

apiVersion: apps.clusternet.io/v1alpha1
kind: HelmChart
metadata:
  name: example
  namespace: default
spec:
  repo: https://private-repo.com/test
  chartPullSecret:
    name: my-private-repo-auth
    namespace: kube-system
  chart: example
  version: 0.0.1
  targetNamespace: abc

apiVersion: v1
data:
  username: xxx
  password: xxxx
kind: Secret
metadata:
  name: my-private-repo-auth
  namespace: kube-system
type: clusternet.io/helm-chart-credentials

[dixudx]

Another thing you need to take into consideration is how to pass down those credentials when the sync mode is Pull.

[silenceper]

Another thing you need to take into consideration is how to pass down those credentials when the sync mode is Pull.

My idea is to add get secret permission for serviceAccount when CRR approve.

The namespace of this secret can be configured in the hub like --helm-repo-secret-namespace, and all secrets involving the helm chart repo are placed under this namespace.

apiVersion: apps.clusternet.io/v1alpha1
kind: HelmChart
metadata:
  name: example
  namespace: default
spec:
  repo: https://private-repo.com/test
  authSecretName: my-private-repo-auth # Under the `--helm-repo-secret-namespace` namespace
  chart: example
  version: 0.0.1
  targetNamespace: abc

[dixudx]

As discussed, we could refer ImagePullSecrets in kubelet.