Problem
Two enhancement requests for the WSO2 APIM Helm charts (4.7.0-1) to improve Kubernetes integration flexibility.
Feature 1: Externalization of image secrets: The ability to reference an imagePullSecret that is already deployed in the namespace.
The imagePullSecretsconfiguration in values.yaml only supports providing username and password, which causes the chart to always create a new Kubernetes Secret (<release>-<fullname>-docker-registry-auth). There is no option to reference a pre-existing secret already deployed in the namespace.
Feature 2: Configuration of execution privileges: Exposing the runAsGroup field (similar to runAsUser) in the pod templates to comply with my cluster's security restrictions.
The all-in-one chart exposes runAsGroup under kubernetes.securityContext (values.yaml#L305), but the distributed deployment charts (traffic-manager, gateway) only render runAsUser — runAsGroup is missing from both values.yaml and the deployment templates.
Proposed Solution
Feature 1:
Add an optional imagePullSecrets.name field. When set, the chart should skip creating a new Secret and instead reference the named secret directly in the pod spec. When left empty, the existing credential-based behavior should remain unchanged.
Feature 2:
Expose runAsGroup in the distributed charts (traffic-manager, gateway, control-plane) consistent with the all-in-one chart, so users can comply with cluster security policies that require setting the group ID.
Alternatives
No response
Version
No response
Problem
Two enhancement requests for the WSO2 APIM Helm charts (4.7.0-1) to improve Kubernetes integration flexibility.
Feature 1: Externalization of image secrets: The ability to reference an imagePullSecret that is already deployed in the namespace.
The
imagePullSecretsconfiguration invalues.yamlonly supports providingusernameandpassword, which causes the chart to always create a new Kubernetes Secret (<release>-<fullname>-docker-registry-auth). There is no option to reference a pre-existing secret already deployed in the namespace.Feature 2: Configuration of execution privileges: Exposing the runAsGroup field (similar to runAsUser) in the pod templates to comply with my cluster's security restrictions.
The
all-in-onechart exposesrunAsGroupunderkubernetes.securityContext(values.yaml#L305), but the distributed deployment charts (traffic-manager, gateway) only renderrunAsUser—runAsGroupis missing from bothvalues.yamland the deployment templates.Proposed Solution
Feature 1:
Add an optional
imagePullSecrets.namefield. When set, the chart should skip creating a new Secret and instead reference the named secret directly in the pod spec. When left empty, the existing credential-based behavior should remain unchanged.Feature 2:
Expose
runAsGroupin the distributed charts (traffic-manager, gateway, control-plane) consistent with the all-in-one chart, so users can comply with cluster security policies that require setting the group ID.Alternatives
No response
Version
No response