fix: authenticate Helm downloads with image pull secrets

[almaslennikov]

Summary

• Read configured networkOperator.imagePullSecrets from the Network Operator namespace when Phase 0 actually needs to install or upgrade the chart.
• Reuse compatible Docker credentials for both the Helm repository index and chart archive requests. Exact host matches are supported, plus the documented NGC nvcr.io to helm.ngc.nvidia.com credential mapping.
• Try multiple configured credentials in order, support both kubernetes.io/dockerconfigjson and legacy kubernetes.io/dockercfg, and preserve anonymous downloads when no compatible credentials are configured.
• Keep credentials in memory only, never log them, and refuse to forward repository credentials when an index points its chart archive at a different host.
• Document that the Secret must already exist in networkOperator.namespace and the kubeconfig must be able to read it.

Why

PR #148 propagates image pull secret names into the generated Network Operator Helm values. Phase 0 still fetched the chart anonymously, so private and staging NGC repositories could fail before Helm ever used those values. This change explicitly bridges the already-configured Kubernetes Docker Secret into the in-process Helm downloader.

Validation

• go test ./... -count=1 -skip 'TestGetPresetsDir_(NotFound|SkipsFiles)'
• go test -race ./pkg/networkoperatorplugin -run 'Test(CredentialsFromImagePullSecrets|PullChart)' -count=1
• go vet ./...
• make build
• mkdocs build --strict --clean
• git diff --check

[greptile-apps]

Greptile Summary

This PR adds authenticated Helm chart downloads using compatible Kubernetes image pull Secrets.

• Reads Docker credentials from the configured Network Operator namespace only when a chart installation or upgrade requires loading the chart.
• Supports Docker config JSON and legacy dockercfg Secrets, ordered credential retries, exact-host matching, and the documented NGC host mapping.
• Prevents repository credentials from being forwarded to cross-host chart archive URLs.
• Updates tests, CLI descriptions, documentation, configuration guidance, and deployment skills.

Confidence Score: 5/5

The PR appears safe to merge, with no concrete blocking or independently actionable non-blocking defects identified.

The changed flow limits Secret reads to chart-loading paths, preserves anonymous access when no compatible credential exists, retries usable credentials in order, and prevents credentials from crossing repository-host boundaries.

Important Files Changed

Filename	Overview
pkg/networkoperatorplugin/helm_credentials.go	Adds scoped Kubernetes Secret loading, Docker credential parsing, host normalization, NGC mapping, and ordered compatible-credential selection without exposing credential values.
pkg/networkoperatorplugin/helm.go	Integrates credential loading into chart installation and upgrade paths, retries chart pulls with configured credentials, and blocks cross-host credential forwarding.
pkg/networkoperatorplugin/helm_test.go	Adds coverage for supported Secret formats, missing and unrelated Secrets, credential retries, authenticated index/archive requests, and cross-host archive protection.
docs/reference/configuration.md	Documents Secret location and RBAC prerequisites, supported formats, credential handling, host restrictions, and the explicit NGC mapping.

Sequence Diagram

sequenceDiagram
    participant Deploy as Phase 0 Deploy
    participant K8s as Kubernetes API
    participant Repo as Helm Repository
    participant Archive as Chart Archive Host
    Deploy->>K8s: Read configured image pull Secrets
    K8s-->>Deploy: Docker credentials
    loop Compatible credentials in configured order
        Deploy->>Repo: Fetch index.yaml with Basic Auth
        Repo-->>Deploy: Chart archive URL
        alt Archive host matches repository host
            Deploy->>Archive: Download chart with Basic Auth
        else Archive host differs
            Deploy->>Archive: Download chart anonymously
        end
    end

Loading

_{Reviews (1): Last reviewed commit: "fix: authenticate Helm downloads with pu..." | Re-trigger Greptile}