---
id: imagepullsecrets-off
name: "Capability: no imagePullSecrets when unset (OFF)"
description: >-
  Renders the product chart with default values (no imagePullSecrets overrides) and asserts that no workload pod spec and no ServiceAccount carries an imagePullSecrets field. Since the chart has no imagePullSecrets templates, none should appear. This scenario is EXPECTED to PASS — confirming no imagePullSecrets leakage when the knob is off.
labels: {customer: enterprise, profile: compliance}
cluster:
  provider: kind
  k8s_version: v1.30.0
product:
  chart: ./chart
  release: sample
  namespace: sample
asserts:
  - type: imagepullsecrets-present
    namespace: sample
    source: rendered
    expect_present: false
    check_service_account: true
tags: [capability, compliance]
category: capability
capability: imagepullsecrets
tier: capability
mechanisms: ["capability:imagepullsecrets"]