---
id: imagepullsecrets-on
name: "Capability: imagePullSecrets propagate to every pod spec + ServiceAccount (ON)"
description: >-
  Renders the product chart with imagePullSecrets[0].name=regcred configured and asserts that every workload pod spec carries the imagePullSecrets entry and the chart ServiceAccount also carries it. The sample chart does NOT include an imagePullSecrets field in any template (no Deployment pod spec, no ServiceAccount template). Setting imagePullSecrets has no effect. This scenario is EXPECTED to FAIL (honest red gap) documenting that the chart lacks imagePullSecrets knobs on both pod specs and ServiceAccount.
labels: {customer: enterprise, profile: compliance}
cluster:
  provider: kind
  k8s_version: v1.30.0
product:
  chart: ./chart
  release: sample
  namespace: sample
  set:
    imagePullSecrets[0].name: regcred
asserts:
  - type: imagepullsecrets-present
    namespace: sample
    source: rendered
    expect_present: true
    secret_names:
      - regcred
    check_service_account: true
tags: [capability, compliance]
category: capability
capability: imagepullsecrets
tier: capability
mechanisms: ["capability:imagepullsecrets"]