Kubernetes executor: add imagePullSecrets support for pause pods

Ashmit Sharmarequested to merge
4shm1td06/gitlab-runner:fix/issue-39395-pause-pod-image-pull-secrets into main

Summary

Add support for configuring imagePullSecrets for pause pods in the Kubernetes executor autoscaler.

Currently, pause pod pre-warming does not support pulling images from private registries because imagePullSecrets cannot be specified. This prevents usage in air-gapped and on-premise environments.

This change enables users to configure image pull secrets for pause pods.

Problem

Pause pods fail to pull images from private registries because:

  • PausePodManagerConfig did not expose ImagePullSecrets
  • buildDeployment() did not set PodSpec.ImagePullSecrets
  • No config option existed to pass secrets

Solution

Added support for:

  • Configuring image pull secrets via runner config
  • Passing secrets through autoscaler → manager → pod spec

Changes

  • Added PausePodImagePullSecrets to KubernetesAutoscalerConfig
  • Wired config through provider.go into PausePodManagerConfig
  • Added ImagePullSecrets to PausePodManagerConfig
  • Updated buildDeployment() to set PodSpec.ImagePullSecrets
  • Added helper to convert []string → []LocalObjectReference
  • Added unit test coverage for ImagePullSecrets

Example configuration

[runners.kubernetes.autoscaler]
  pause_pod_image = "internal-registry.example.com/pause:latest"
  pause_pod_image_pull_secrets = ["internal-registry-secret"]

Closes: #39395

Merge request reports