Kubernetes Executor: Add imagePullSecrets support for pause pods

Description

The Kubernetes executor's pause pod pre-warming feature currently does not support configuring imagePullSecrets for pause pod image pulls. This prevents air-gapped and on-premise deployments from using private container registries for pause pod images.

Problem

When using the pause pod pre-warming feature with a custom pause pod image from a private registry, the Kubernetes executor cannot authenticate to pull the image. The PausePodManagerConfig struct and the buildDeployment() function do not expose imagePullSecrets as a configurable parameter, even though the underlying Kubernetes PodSpec API fully supports this field.

Impact:

  • Air-gapped deployments cannot use pause pods with images from internal registries
  • Users must either:
    • Disable pre-warming (performance impact)
    • Use public mirror images (security/compliance concern)
    • Configure cluster-wide image pull secrets (limited scope)

Proposal

Add imagePullSecrets configuration support to the pause pod manager:

  1. Add field to PausePodManagerConfig:

    ImagePullSecrets []api.LocalObjectReference

  2. Set it in buildDeployment():

    Spec: api.PodSpec{
    // ... existing fields ...
    ImagePullSecrets: m.config.ImagePullSecrets,
}

  3. Wire through Kubernetes executor configuration so users can specify it in config.toml or Helm values:

    [[runners]]
  [runners.kubernetes]
    [runners.kubernetes.autoscaler]
      [runners.kubernetes.autoscaler.pause_pod]
        image = "internal-registry.example.com/pause:latest"
        image_pull_secrets = ["internal-registry-secret"]

This follows the existing pattern used for NodeSelector, Tolerations, and ServiceAccountName in the same file.

Links to related issues and merge requests / references