mirror of
https://github.com/langchain-ai/langgraph.git
synced 2026-10-15 12:45:25 +02:00
gethin-langchainandGitHub
6cd26d0e21
## Summary
Deployments created with `--push-to` or `--image-uri` had no way to tell
the control plane which Kubernetes secret to use for pulling the image,
so deploying through a private registry that requires authentication
(e.g. an ECR repository gated by an imagePullSecret) wasn't possible at
all.
The control plane's `resource_spec` already supports
`image_pull_secrets` (a list of references to
`kubernetes.io/dockerconfigjson` secrets); the CLI just never exposed a
way to set it. This adds a repeatable `--image-pull-secret <name>` flag
that populates it.
```bash
langgraph deploy --push-to 123456789.dkr.ecr.us-east-1.amazonaws.com/agents/my-agent \
--image-pull-secret regcred
```
Validation follows the same pattern already used for
`--listener-id`/`--k8s-namespace`: only valid when creating a deployment
with `--push-to` or `--image-uri`, and rejected on an existing
`--deployment-id` (the secret list is fixed at creation, same as
listener placement).
## Test plan
- [x] Added unit tests for the new `_resource_spec` helper (empty list
keeps today's default, secrets become the expected `{"name": ...}` list)
- [x] Added CLI-level tests: secret(s) land in
`source_config.resource_spec.image_pull_secrets` on create (for both
`--push-to` and `--image-uri`), rejected without
`--push-to`/`--image-uri`, rejected on an existing `--deployment-id`
- [x] `make format && make lint` clean
- [x] `make test` passes, 539 passed (9 new), no regressions