Add imagePullSecrets and extend imagePullPolicy to all chart images

helm/README.md

@@ -60,6 +60,13 @@ you `values.yaml` with your domain.
 | schemaHistory.database.auth.username       | Database username                                                                                                                                                                      | user                                       |
 | schemaHistory.database.auth.password       | Database password                                                                                                                                                                      | password                                   |                                                                                                                                                                       |                                                                                                                                                                                 |                                             |
 | env                                        | List of env variable to pass to the conductor                                                                                                                                          | []                                         |
+| imagePullSecrets                           | Global list of imagePullSecrets applied to all container images. Per-component `imagePullSecrets` override this value (not merged).                                                    | []                                         |
+| stage.imagePullSecrets                     | Overrides global `imagePullSecrets` for the stage image.                                                                                                                               | []                                         |
+| conductor.imagePullSecrets                 | Overrides global `imagePullSecrets` for the conductor image.                                                                                                                           | []                                         |
+| conductor.descriptors.official.imagePullPolicy | Image pull policy for the descriptors OCI image.                                                                                                                                   | IfNotPresent                               |
+| conductor.descriptors.official.imagePullSecrets | Overrides global `imagePullSecrets` for the descriptors image.                                                                                                                    | []                                         |
+| server.imagePullPolicy                     | Image pull policy for Debezium Server instances created by pipelines.                                                                                                                  | IfNotPresent                               |
+| server.imagePullSecrets                    | Overrides global `imagePullSecrets` for the Debezium Server image.                                                                                                                     | []                                         |
 
 ## Descriptor OCI Artifacts
 

helm/templates/conductor-deployment.yaml

@@ -22,6 +22,13 @@ spec:
         app.kubernetes.io/name: conductor
     spec:
       serviceAccountName: conductor-service-account
+{{- $conductorSecrets := .Values.conductor.imagePullSecrets | default list }}
+{{- $globalSecrets := .Values.imagePullSecrets | default list }}
+{{- $pullSecrets := ternary $conductorSecrets $globalSecrets (gt (len $conductorSecrets) 0) }}
+{{- if gt (len $pullSecrets) 0 }}
+      imagePullSecrets:
+        {{- toYaml $pullSecrets | nindent 8 }}
+{{- end }}
       containers:
         - name: conductor
           image: {{ .Values.conductor.image }}
@@ -73,4 +80,4 @@ spec:
             - name: {{ .name }}
               value: {{ .value }}
 {{- end }}
-      restartPolicy: Always
+      restartPolicy: Always

helm/templates/stage-deployment.yaml

@@ -19,6 +19,13 @@ spec:
       labels:
         app.kubernetes.io/name: stage
     spec:
+{{- $stageSecrets := .Values.stage.imagePullSecrets | default list }}
+{{- $globalSecrets := .Values.imagePullSecrets | default list }}
+{{- $pullSecrets := ternary $stageSecrets $globalSecrets (gt (len $stageSecrets) 0) }}
+{{- if gt (len $pullSecrets) 0 }}
+      imagePullSecrets:
+        {{- toYaml $pullSecrets | nindent 8 }}
+{{- end }}
       containers:
         - image: {{ .Values.stage.image }}
           imagePullPolicy: {{ .Values.stage.imagePullPolicy }}
@@ -29,4 +36,4 @@ spec:
           env:
             - name: CONDUCTOR_URL
               value: {{ required "A valid domain URL required!" (include "debezium-platform.domainUrl" .) }}
-      restartPolicy: Always
+      restartPolicy: Always

helm/values.yaml

@@ -1,12 +1,25 @@
 domain:
   url: ""
   name: ""
+
+# Global imagePullSecrets applied to all container images by default.
+# Per-component imagePullSecrets override this value (not merged).
+# Example:
+#   imagePullSecrets:
+#     - name: my-registry-secret
+imagePullSecrets: []
+
 stage:
   image: quay.io/debezium/platform-stage:nightly
   imagePullPolicy: IfNotPresent
+  # Overrides global imagePullSecrets for the stage image.
+  imagePullSecrets: []
+
 conductor:
   image: quay.io/debezium/platform-conductor:nightly
   imagePullPolicy: IfNotPresent
+  # Overrides global imagePullSecrets for the conductor image.
+  imagePullSecrets: []
   offset:
     existingConfigMap: ""
   descriptors:
@@ -16,8 +29,17 @@ conductor:
       image: debezium/debezium-descriptors
       tag: nightly
       mountPath: /opt/descriptors
+      # Image pull policy for the descriptors OCI image.
+      imagePullPolicy: IfNotPresent
+      # Overrides global imagePullSecrets for the descriptors image.
+      imagePullSecrets: []
+
 server:
   image: ""
+  # Image pull policy for Debezium Server instances.
+  imagePullPolicy: IfNotPresent
+  # Overrides global imagePullSecrets for the Debezium Server image.
+  imagePullSecrets: []
 ingress:
   enabled: true
   className: ""