fix: propagate Helm image pull secrets with native shapes

[almaslennikov]

Summary

• render Network Operator chart imagePullSecrets as a list of secret-name strings
• propagate the same secrets to enabled NFD, Maintenance Operator, and SR-IOV Operator subcharts using each subchart native value shape
• quote secret names throughout Helm values, generated policies, and the discovery DaemonSet so YAML-special valid names remain strings
• cover every deployment profile with regression tests and update the CLI, schema, docs, and skills

Root cause

The Network Operator chart wraps each root imagePullSecrets entry in a LocalObjectReference. l8k already rendered each entry as a name object, producing a nested value such as {name: {name: ngc-image-secret}}. Kubernetes then rejected the keep-ncp pre-install Job because spec.template.spec.imagePullSecrets[].name was an object instead of a string.

The subcharts do not share one schema: SR-IOV Operator expects secret-name strings, while NFD and Maintenance Operator expect LocalObjectReference objects. The generated values now preserve those chart-specific contracts.

All secret-name interpolations are quoted so valid Kubernetes names such as true, null, and 123 cannot be retyped by the YAML parser.

Testing

• go test ./... -count=1 with the documented environment-specific preset exclusions
• focused ambiguous-name coverage for Helm values, generated policies, and the discovery DaemonSet
• go vet ./...
• make build
• mkdocs build --strict --clean
• git diff --check

[greptile-apps]

Greptile Summary

The PR fixes image pull secret propagation across generated Kubernetes and Helm values.

• Quotes secret names so YAML-special values remain strings in discovery and policy manifests.
• Uses each Network Operator subchart’s native image pull secret shape.
• Adds regression coverage for every deployment profile and updates CLI documentation.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains; the previous scalar-typing issue is fixed across every image pull secret rendering path and covered by profile and discovery-daemon regression tests.

Important Files Changed

Filename	Overview
pkg/networkoperatorplugin/helm_values_render_test.go	Adds comprehensive regression coverage for root Helm values, subchart-specific value shapes, and policy rendering across all profiles.
pkg/nicconfigdaemon/assets/daemon.yaml.tmpl	Quotes interpolated secret names so discovery DaemonSet references remain YAML strings.
profiles/host-device-rdma/00-values.yaml	Propagates secrets to NFD and Maintenance Operator using LocalObjectReference objects while rendering root values as strings.
profiles/spectrum-x/00-values.yaml	Propagates correctly shaped secrets to NFD, Maintenance Operator, and SR-IOV Operator Helm values.
profiles/sriov-ethernet-rdma/00-values.yaml	Adds native image pull secret values for all enabled subcharts and corrects the root value shape.

_{Reviews (2): Last reviewed commit: "fix: quote rendered image pull secret na..." | Re-trigger Greptile}