Support private OCI registry credentials for platform source #2455

Feature Request

Currently, the cozystack-operator creates the OCIRepository Flux resource via --platform-source-url but has no way to attach registry credentials. This makes it impossible to use a private OCI registry (e.g. GitLab Container Registry) as the platform source.

The OCIRepository CRD supports spec.secretRef pointing to a kubernetes.io/dockerconfigjson secret, but the operator's generateOCIRepository() function does not populate this field, and there is no corresponding flag to configure it.

Additionally, because the operator does a full Update() of the OCIRepository spec on every restart, any manually applied patch with secretRef gets overwritten.

Proposed Solution

Add a --platform-source-secret flag to the operator that accepts the name of a Secret in the cozy-system namespace containing the registry credentials. This secret name would then be set as spec.secretRef in the generated OCIRepository (and GitRepository for private Git sources).

The installer Helm chart (packages/core/installer) would expose a corresponding cozystackOperator.platformSourceSecret value.

Usage would look like:

# Create the registry credentials secret
kubectl create secret docker-registry gitlab-registry-credentials \
  --namespace cozy-system \
  --docker-server=registry.gitlab.example.com \
  --docker-username=<username> \
  --docker-password=<token>

# values.yaml
cozystackOperator:
  platformSourceUrl: 'oci://registry.gitlab.example.com/mygroup/cozystack-packages'
  platformSourceSecret: 'gitlab-registry-credentials'

Affected Files

• cmd/cozystack-operator/main.go — add --platform-source-secret flag, pass to generateOCIRepository() / generateGitRepository()
• packages/core/installer/templates/cozystack-operator.yaml — add --platform-source-secret arg
• packages/core/installer/values.yaml — add platformSourceSecret value