Skip to content

feat(registry): add support for overriding image registry in Helm cha… - #4261

Open
dadez73 wants to merge 1 commit into
tektoncd:mainfrom
dadez73:feat/registry-override
Open

dadez73 wants to merge 1 commit into
tektoncd:mainfrom
dadez73:feat/registry-override

Conversation

@dadez73

@dadez73 dadez73 commented Oct 13, 2026

Copy link
Copy Markdown

Changes

Add a single registry value to the Helm chart to mirror every image to an internal registry (e.g. for air-gapped clusters), and make TEKTON_REGISTRY_OVERRIDE cover the images it previously missed.

Helm chart

  • New registry value (host[:port][/path]). It rewrites the registry of the operator's own images (operator, webhook, webhook proxy, pruner tkn) through a new tekton-operator.withRegistry helper.
  • It also sets TEKTON_REGISTRY_OVERRIDE on the operator containers, so the components the operator installs use the same mirror. A TEKTON_REGISTRY_OVERRIDE entry in operator.additionalEnvs takes precedence.

Operator

  • overrideImageRegistry now treats the first path component as a registry host only if it contains . or :, or is localhost (the Docker rule). Before this change, bitnami/postgresql lost its bitnami namespace; it now becomes <override>/bitnami/postgresql.
  • replaceContainersArgsImage only matches flags (args starting with -), skips the value after a matched flag, and ignores flags with no value. A flag's value is no longer read as a flag, and the last arg can no longer cause an out-of-range write.
  • The legacy pruner CronJob's tkn image (IMAGE_JOB_PRUNER_TKN) now goes through TEKTON_REGISTRY_OVERRIDE as well.

Docs

  • docs/AirGapImageConfiguration.md: documents the host-detection rule, the *-image* flags and pruner rewriting, and the new Helm registry value.

Tests

  • New cases in pkg/reconciler/common/transformers_test.go and the fixture testdata/test-replace-image-airgapped.yaml.

Submitter Checklist

These are the criteria that every PR should meet, please check them off as you
review them:

See the contribution guide for more details.

Release Notes

Helm chart: new `registry` value that mirrors all images (operator, webhook, proxy, pruner and the installed components through `TEKTON_REGISTRY_OVERRIDE`) to an internal registry.
`TEKTON_REGISTRY_OVERRIDE` now keeps the namespace of images that have no registry host (e.g. `bitnami/postgresql` becomes `<override>/bitnami/postgresql` instead of `<override>/postgresql`). It also applies to the legacy pruner `tkn` image.

@tekton-robot tekton-robot added the release-note Denotes a PR that will be considered when it comes time to generate release notes. label Oct 13, 2026
@tekton-robot

Copy link
Copy Markdown
Contributor

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
To complete the pull request process, please assign pratap0007 after the PR has been reviewed.
You can assign the PR to them by writing /assign @pratap0007 in a comment when ready.

The full list of commands accepted by this bot can be found here.

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@linux-foundation-easycla

linux-foundation-easycla Bot commented Oct 13, 2026 •

Copy link
Copy Markdown

CLA Signed
The committers listed above are authorized under a signed CLA.

  • ✅ login: dadez73 / name: Davide Doninelli (246366e)

@tekton-robot tekton-robot added the size/L Denotes a PR that changes 100-499 lines, ignoring generated files. label Oct 13, 2026
…rt and components

Signed-off-by: Davide Doninelli <d.doninelli@gmail.com>
@dadez73
dadez73 force-pushed the feat/registry-override branch from 2ad25ed to 246366e Compare October 13, 2026 15:24
@dadez73

dadez73 commented Oct 13, 2026

Copy link
Copy Markdown
Author

/easycla

@codecov

codecov Bot commented Oct 15, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 30.27%. Comparing base (74f0ad1) to head (246366e).
⚠️ Report is 16 commits behind head on main.

Additional details and impacted files
@@            Coverage Diff             @@
##             main    #4261      +/-   ##
==========================================
+ Coverage   30.25%   30.27%   +0.02%     
==========================================
  Files         478      478              
  Lines       23169    23176       +7     
==========================================
+ Hits         7010     7017       +7     
  Misses      16159    16159              
Flag Coverage Δ
unit-tests 30.27% <ø> (+0.02%) ⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

{{- include "tekton-operator.withRegistry" (dict "image" (printf "%s:%s" $image $tag) "registry" .Values.registry) -}}
{{- end -}}

{{- define "tekton-operator.pruner-image" -}}

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

for pruner image we shoulndt call withRegistry, otherwise there will be double override (the second is done pruner.go with TEKTON_REGISTRY_OVERRIDE

{{- end -}}
{{- end -}}
{{- printf "%s:%s" $image $tag -}}
{{- include "tekton-operator.withRegistry" (dict "image" (printf "%s:%s" $image $tag) "registry" .Values.registry) -}}

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

same here for proxy webhook, it is already handled via IMAGE_PIPELINES_PROXY and TEKTON_REGISTRY_OVERRIDE
use withRegistry only for operator image (operator base image and webhook)

@@ -211,14 +211,20 @@ func overrideImageRegistry(registry, imageName string) string {
return imageName

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

You may want to make this fonction idemptotent
if the image already starts with the override prefix, leave it alone. A second pass becomes a no-op.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

release-note Denotes a PR that will be considered when it comes time to generate release notes. size/L Denotes a PR that changes 100-499 lines, ignoring generated files.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants