Init-container for installing pip requirements

charts/operators-installer/Chart.yaml

@@ -16,7 +16,7 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 3.3.0
+version: 3.3.1
 
 home: https://github.com/redhat-cop/helm-charts
 

charts/operators-installer/_scripts/pip-requirements.sh

@@ -0,0 +1,46 @@
+#!/usr/bin/env bash
+set -e
+
+# Use environment variables
+PYTHON_INDEX_URL=${PYTHON_INDEX_URL:-https://pypi.org/simple/}
+PYTHON_EXTRA_INDEX_URL=${PYTHON_EXTRA_INDEX_URL:-https://pypi.org/simple/}
+IGNORE_SSL_ERRORS=${IGNORE_SSL_ERRORS:-false}
+
+# Extract hostnames
+INDEX_HOST=$(echo $PYTHON_INDEX_URL | sed 's|https\?://||' | cut -d'/' -f1)
+EXTRA_INDEX_HOST=$(echo $PYTHON_EXTRA_INDEX_URL | sed 's|https\?://||' | cut -d'/' -f1)
+
+echo "PYTHON_INDEX_URL: $PYTHON_INDEX_URL"
+echo "PYTHON_EXTRA_INDEX_URL: $PYTHON_EXTRA_INDEX_URL"
+echo "TRUST_HOSTS: $TRUST_HOSTS"
+
+# Build trusted-host arguments conditionally
+if [ "$TRUST_HOSTS" = "true" ]; then
+    TRUSTED_HOST_ARGS="--trusted-host pypi.org \
+    --trusted-host pypi.python.org \
+    --trusted-host files.pythonhosted.org \
+    --trusted-host $INDEX_HOST \
+    --trusted-host $EXTRA_INDEX_HOST"
+    echo "SSL verification disabled for pip"
+else
+    TRUSTED_HOST_ARGS=""
+    echo "SSL verification enabled for pip"
+fi
+
+# Using a virtual environment to share pip packages with the main container.
+echo "Creating virtual environment..."
+python3 -m venv /tmp/venv
+
+echo "Activating virtual environment and installing packages..."
+source /tmp/venv/bin/activate
+
+echo "Upgrading pip..."
+python3 -m pip install --upgrade pip $TRUSTED_HOST_ARGS
+
+echo "Installing packages..."
+python3 -m pip install openshift-client semver==2.13.0 \
+    $TRUSTED_HOST_ARGS \
+    --index-url $PYTHON_INDEX_URL \
+    --extra-index-url $PYTHON_EXTRA_INDEX_URL
+
+echo "Installation completed successfully!"

charts/operators-installer/templates/ConfigMap_operators-installer-approver-scripts.yaml

@@ -24,5 +24,7 @@ data:
 {{ tpl ( $.Files.Get "_scripts/installplan-incremental-approver.py" ) $ | indent 4 }}
   installplan-verifier.py: |-
 {{ tpl ( $.Files.Get "_scripts/installplan-verifier.py" ) $ | indent 4 }}
+  pip-requirements.sh: |-
+{{ tpl ( $.Files.Get "_scripts/pip-requirements.sh" ) $ | indent 4 }}
 {{- end }}
 {{- end }}

charts/operators-installer/templates/Job_installplan-approver.yaml

@@ -29,16 +29,32 @@ spec:
       imagePullSecrets:
         - name: {{ $.Values.installPlanApproverAndVerifyJobsImagePullSecret }}
       {{- end }}
+      {{- if $.Values.installRequiredPythonLibraries }}
+      initContainers:
+      - name: setup-pip-requirements
+        image: {{ $.Values.installPlanApproverAndVerifyJobsImage }}
+        command: ["/bin/sh", "/scripts/pip-requirements.sh"]
+        env:
+        - name: PYTHON_INDEX_URL
+          value: "{{ $.Values.pythonIndexURL }}"
+        - name: PYTHON_EXTRA_INDEX_URL
+          value: "{{ $.Values.pythonExtraIndexURL }}"
+        - name: TRUST_HOSTS
+          value: "{{ $.Values.pipTrustHosts }}"
+        volumeMounts:
+        - name: shared-venv
+          mountPath: /tmp
+        - name: operators-installer-approver-scripts
+          mountPath: /scripts
+      {{- end }}
       containers:
       - name: installplan-approver
         image: {{ $.Values.installPlanApproverAndVerifyJobsImage }}
         command: ["/bin/sh","-c"]
         args:
           - >-
               {{- if $.Values.installRequiredPythonLibraries }}
-              python3 -m venv /tmp/venv &&
               source /tmp/venv/bin/activate &&
-              python3 -m pip install openshift-client semver==2.13.0 --index-url {{ $.Values.pythonIndexURL }} --extra-index-url {{ $.Values.pythonExtraIndexURL }} &&
               {{- end }}
               {{- if .automaticIntermediateManualUpgrades }}
               python3 /scripts/installplan-incremental-approver.py
@@ -64,11 +80,15 @@ spec:
         volumeMounts:
         - name: operators-installer-approver-scripts
           mountPath: /scripts
+        - name: shared-venv
+          mountPath: /tmp
       volumes:
       - name: operators-installer-approver-scripts
         configMap:
           name: {{ include "operators-installer.scriptsName" . }}
           defaultMode: 0777
+      - name: shared-venv
+        emptyDir: {}
       dnsPolicy: ClusterFirst
       restartPolicy: Never
       serviceAccount: {{ include "operators-installer.approverName" . }}

charts/operators-installer/values.yaml

@@ -37,6 +37,9 @@ pythonIndexURL: https://pypi.org/simple/
 # If `installRequiredPythonLibraries` is `true` then use this python extra index to pull required library dependencies
 pythonExtraIndexURL: https://pypi.org/simple/
 
+# In some disconnected environments, you may need to set this to true because the `pip` command will not trust the default pypi.org index.
+pipTrustHosts: false
+
 # EXAMPLE: declaratively controlled operator version
 operators:
 # - channel: stable