---
id: imagepullsecrets-on
name: "Capability: imagePullSecrets propagate to every pod spec + ServiceAccount (ON)"
description: >-
  Renders the product chart with imagePullSecrets[0].name=regcred configured
  and asserts that every workload pod spec carries the imagePullSecrets
  entry and the chart ServiceAccount also carries it. The sample chart does
  NOT include an imagePullSecrets field in any template (no Deployment pod
  spec, no ServiceAccount template). Setting imagePullSecrets has no effect.
  This scenario is EXPECTED to FAIL (honest red gap) documenting that the
  chart lacks imagePullSecrets knobs on both pod specs and ServiceAccount.
labels: {customer: enterprise, profile: compliance}
cluster:
  provider: kind
  k8s_version: v1.36.1
product:
  chart: ./chart
  release: sample
  namespace: sample
  set:
    imagePullSecrets[0].name: regcred
asserts:
  - type: imagepullsecrets-present
    namespace: sample
    source: rendered
    expect_present: true
    secret_names:
      - regcred
    check_service_account: true
tags: [capability, compliance]
category: capability
capability: imagepullsecrets
tier: capability
mechanisms: ["capability:imagepullsecrets"]