[znerol2]

Summary

The chart defaulted imagePullSecrets to registry-creds, a secret that no role, script or playbook creates. Every console pod logged FailedToRetrieveImagePullSecret. Pulls worked only because the platform registry serves anonymous reads (ADR-0033), so the warning was noise. If reads ever needed a login, that noise would also hide the real failure.

The default is now imagePullSecrets: [], with a comment saying to set it only when the registry needs credentials for reads.

Verification

• CI-style helm template:
  • With CI's --set values, there is no imagePullSecrets by default.
  • --set imagePullSecrets[0].name=x renders the override.
  • main renders registry-creds.
• helm lint and the version sync check pass.
• Nothing depends on the old default. There are no references in this repo, in dmf-infra or in dmf-env. The cms role's values template never sets the field.
• Live on a sandbox: playbook 650 with this chart rolled the console. The new pod has no imagePullSecrets, is ready, and pulled from the platform registry, with no FailedToRetrieveImagePullSecret event.

Review

One round of adversarial review. It passed.

Closes dmfdeploy/dmfdeploy#852

[lkirc]

Static review of 0760ef3: no blocking findings.

The empty-list default cleanly omits imagePullSecrets while preserving the documented opt-in override. Required checks and approval gates pass.