在 gitlab ci 作业中使用 kubectl 创建 ImagePullSecret 时出现奇怪错误

Question

I am trying to deploy an image from a private gitlab registry to a self-hosted kubernets cluster that is connected and managed by gitlab. As far as I understood it, I need a ImagePullSecret created and referenced in my Deployment-Config for this to work. Gitlab is creating a namespace per project so I am trying to create a secret at the start of my CI-Job. Strangely I always get the error, that an argument is missing, despite all of the required arguments being present. What am I doing wrong?

Here is the CI-Job out of my gitlab-ci.yml

deploy-app:
  stage: deploy
  image:
    name: bitnami/kubectl:latest
    entrypoint: [""]
  script:
    - kubectl create secret docker-registry gitlab-registry --docker-username=$CI_DEPLOY_USER --docker-password=$CI_DEPLOY_PASSWORD --docker-server=$CI_REGISTRY --dry-run=client -o yaml | kubectl apply -f -
    - kubectl apply -f k8s/configmap.yaml
    - kubectl apply -f k8s/deployment.yaml
    - kubectl apply -f k8s/service.yaml
    - kubectl apply -f k8s/ingress.yaml
  environment:
    name: production
    url: <my-url>
  rules:
    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH

The CI-Job always runs into the following error:

error: either --from-file or the combination of --docker-username, --docker-password and --docker-server is required

I tried to run the command directly on the server without an error, so this has something to do with this specific environment. Has someone an idea for another approach? I am a bit lost right now.

Answer 1

The kubectl secret which is being created may not be in the corret namespace. Since you mentioned that there are namespaces for different project, ensure that the secret is created in the correct namespace. For the other commands also you may mention the namespace. If the namespace is not mentioned then these kubectl commands are executed in "default" namespace.

deploy-app:
  stage: deploy
  image:
    name: bitnami/kubectl:latest
    entrypoint: [""]
  script:
    - kubectl create secret --namespace $namespace docker-registry gitlab-registry --docker-username=$CI_DEPLOY_USER --docker-password=$CI_DEPLOY_PASSWORD --docker-server=$CI_REGISTRY --dry-run=client -o yaml | kubectl apply -f -
    - kubectl apply -f k8s/configmap.yaml --namespace $namespace
    - kubectl apply -f k8s/deployment.yaml --namespace $namespace
    - kubectl apply -f k8s/service.yaml --namespace $namespace
    - kubectl apply -f k8s/ingress.yaml --namespace $namespace
  environment:
    name: production
    url: <my-url>
  rules:
    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH