feat(k8s): imagePullSecrets support + populate ProvisionResult endpoints

- Config.ImagePullSecrets []string (CP_K8S_IMAGE_PULL_SECRETS env)
- WithImagePullSecrets(...string) option; WithConfig copies non-empty slice
- buildPodSpec/buildDeployment/buildStatefulSet forward pull secrets to
  pod template imagePullSecrets
- buildEndpoints helper derives in-cluster DNS URLs
  (http://<svc>.<ns>.svc.cluster.local:<port>) and populates
  ProvisionResult.Endpoints so twinos firstEndpoint/injectUpstreamEnv
  get a usable upstream base URL
- 3 new unit tests: imagePullSecrets propagation + endpoint URL shape

Author: juicycleff

provider/kubernetes/config.go

@@ -36,4 +36,10 @@ type Config struct {
 
 	// Labels are additional labels applied to all managed resources.
 	Labels map[string]string `json:"labels,omitempty"`
+
+	// ImagePullSecrets is the list of Secret names in the same namespace
+	// that contain credentials to pull private container images.
+	// Corresponds to the Kubernetes podSpec.imagePullSecrets field.
+	// Use CP_K8S_IMAGE_PULL_SECRETS (comma-separated) to configure via env.
+	ImagePullSecrets []string `env:"CP_K8S_IMAGE_PULL_SECRETS" json:"image_pull_secrets,omitempty"`
 }

provider/kubernetes/multi_service_test.go

@@ -52,7 +52,7 @@ func TestBuildPodSpec_MultiService(t *testing.T) {
 		},
 	}
 
-	spec := buildPodSpec(req)
+	spec := buildPodSpec(req, nil)
 
 	// Init goes to initContainers[]; Main + Sidecar to containers[].
 	if len(spec.InitContainers) != 1 {
@@ -98,7 +98,7 @@ func TestBuildDeployment_ReplicasFromMain(t *testing.T) {
 		},
 	}
 
-	dep := buildDeployment(req, "default", map[string]string{})
+	dep := buildDeployment(req, "default", map[string]string{}, nil)
 
 	if dep.Spec.Replicas == nil {
 		t.Fatalf("expected replicas pointer, got nil")
@@ -131,7 +131,7 @@ func TestBuildStatefulSet_PVCTemplates(t *testing.T) {
 		},
 	}
 
-	ss := buildStatefulSet(req, "default", map[string]string{})
+	ss := buildStatefulSet(req, "default", map[string]string{}, nil)
 
 	if len(ss.Spec.VolumeClaimTemplates) != 1 {
 		t.Fatalf("volume claim templates: want 1, got %d", len(ss.Spec.VolumeClaimTemplates))
@@ -171,7 +171,7 @@ func TestBuildService_HeadlessForStatefulSet(t *testing.T) {
 		},
 	}
 
-	svc := buildService(req, "default", map[string]string{}, true)
+	svc := buildService(req, "default", map[string]string{}, true /*headless*/)
 	if svc == nil {
 		t.Fatalf("expected Service, got nil")
 	}
@@ -217,3 +217,114 @@ func TestBuildConfigMaps_PerService(t *testing.T) {
 		t.Fatalf("config maps: want 2 (main + logger), got %d", len(cms))
 	}
 }
+
+// TestBuildPodSpec_ImagePullSecrets verifies that imagePullSecrets are
+// forwarded to the PodSpec so private registry images can be pulled.
+func TestBuildPodSpec_ImagePullSecrets(t *testing.T) {
+	t.Parallel()
+
+	req := provider.ProvisionRequest{
+		InstanceID: id.New(id.PrefixInstance),
+		TenantID:   "ten_test",
+		Services: []provider.ServiceSpec{
+			{
+				Name:  "main",
+				Image: "ghcr.io/private/app:1.0",
+				Role:  provider.RoleMain,
+			},
+		},
+	}
+
+	spec := buildPodSpec(req, []string{"ghcr-pull"})
+
+	if len(spec.ImagePullSecrets) != 1 {
+		t.Fatalf("imagePullSecrets: want 1, got %d", len(spec.ImagePullSecrets))
+	}
+
+	if spec.ImagePullSecrets[0].Name != "ghcr-pull" {
+		t.Fatalf("imagePullSecrets[0].Name: want ghcr-pull, got %q", spec.ImagePullSecrets[0].Name)
+	}
+}
+
+// TestBuildDeployment_ImagePullSecrets verifies that imagePullSecrets
+// propagate through buildDeployment into the pod template spec.
+func TestBuildDeployment_ImagePullSecrets(t *testing.T) {
+	t.Parallel()
+
+	req := provider.ProvisionRequest{
+		InstanceID: id.New(id.PrefixInstance),
+		TenantID:   "ten_test",
+		Kind:       provider.KindDeployment,
+		Services: []provider.ServiceSpec{
+			{
+				Name:  "main",
+				Image: "ghcr.io/private/app:1.0",
+				Role:  provider.RoleMain,
+				Ports: []provider.PortSpec{
+					{Container: 7903, Protocol: "TCP"},
+				},
+			},
+		},
+	}
+
+	dep := buildDeployment(req, "default", map[string]string{}, []string{"ghcr-pull"})
+
+	got := dep.Spec.Template.Spec.ImagePullSecrets
+	if len(got) != 1 {
+		t.Fatalf("deployment imagePullSecrets: want 1, got %d", len(got))
+	}
+
+	if got[0].Name != "ghcr-pull" {
+		t.Fatalf("deployment imagePullSecrets[0].Name: want ghcr-pull, got %q", got[0].Name)
+	}
+}
+
+// TestBuildEndpoints verifies that buildEndpoints produces the correct
+// in-cluster DNS URL for each service with ports.
+func TestBuildEndpoints(t *testing.T) {
+	t.Parallel()
+
+	req := provider.ProvisionRequest{
+		InstanceID: id.New(id.PrefixInstance),
+		TenantID:   "ten_test",
+		Services: []provider.ServiceSpec{
+			{
+				Name:  "main",
+				Image: "app:1",
+				Role:  provider.RoleMain,
+				Ports: []provider.PortSpec{
+					{Container: 7903, Protocol: "TCP"},
+				},
+			},
+			{
+				// No ports — should not produce an endpoint.
+				Name:  "init-db",
+				Image: "alpine:3",
+				Role:  provider.RoleInit,
+			},
+		},
+	}
+
+	endpoints := buildEndpoints(req, "staging")
+
+	if len(endpoints) != 1 {
+		t.Fatalf("endpoints: want 1 (main only), got %d", len(endpoints))
+	}
+
+	ep := endpoints[0]
+
+	if ep.ServiceName != "main" {
+		t.Fatalf("endpoint ServiceName: want main, got %q", ep.ServiceName)
+	}
+
+	if ep.Port != 7903 {
+		t.Fatalf("endpoint Port: want 7903, got %d", ep.Port)
+	}
+
+	svcName := serviceName(req.InstanceID)
+	wantURL := "http://" + svcName + ".staging.svc.cluster.local:7903"
+
+	if ep.URL != wantURL {
+		t.Fatalf("endpoint URL:\n  want %q\n   got %q", wantURL, ep.URL)
+	}
+}

provider/kubernetes/options.go

@@ -89,6 +89,17 @@ func WithInCluster() Option {
 	}
 }
 
+// WithImagePullSecrets sets the list of Kubernetes Secret names that
+// contain credentials for pulling private container images. Each name
+// is added to the pod spec's imagePullSecrets field verbatim.
+func WithImagePullSecrets(secrets ...string) Option {
+	return func(p *Provider) error {
+		p.cfg.ImagePullSecrets = secrets
+
+		return nil
+	}
+}
+
 // WithConfig applies all non-zero fields from a Config struct.
 // This is useful when loading configuration from files or environment variables.
 func WithConfig(cfg Config) Option {
@@ -125,6 +136,10 @@ func WithConfig(cfg Config) Option {
 			p.cfg.Labels = cfg.Labels
 		}
 
+		if len(cfg.ImagePullSecrets) > 0 {
+			p.cfg.ImagePullSecrets = cfg.ImagePullSecrets
+		}
+
 		return nil
 	}
 }

provider/kubernetes/provider.go

@@ -117,9 +117,11 @@ func (p *Provider) Provision(ctx context.Context, req provider.ProvisionRequest)
 		}
 	}
 
+	pullSecrets := p.cfg.ImagePullSecrets
+
 	switch req.Kind {
 	case provider.KindStatefulSet:
-		ss := buildStatefulSet(req, ns, labels)
+		ss := buildStatefulSet(req, ns, labels, pullSecrets)
 		if _, err := p.client.AppsV1().StatefulSets(ns).Create(ctx, ss, metav1.CreateOptions{}); err != nil {
 			return nil, fmt.Errorf("kubernetes: create statefulset: %w", err)
 		}
@@ -131,7 +133,7 @@ func (p *Provider) Provision(ctx context.Context, req provider.ProvisionRequest)
 			}
 		}
 	default: // KindDeployment (also covers empty-string for legacy paths)
-		dep := buildDeployment(req, ns, labels)
+		dep := buildDeployment(req, ns, labels, pullSecrets)
 		if _, err := p.client.AppsV1().Deployments(ns).Create(ctx, dep, metav1.CreateOptions{}); err != nil {
 			return nil, fmt.Errorf("kubernetes: create deployment: %w", err)
 		}
@@ -155,9 +157,16 @@ func (p *Provider) Provision(ctx context.Context, req provider.ProvisionRequest)
 		serviceRefs[req.Services[i].Name] = pref + "/" + req.Services[i].Name
 	}
 
+	// Populate Endpoints from the in-cluster Service DNS address for
+	// each service that declares ports. Consumers (e.g. twinos
+	// firstEndpoint / injectUpstreamEnv) read Endpoints[0].URL as the
+	// upstream base URL.
+	endpoints := buildEndpoints(req, ns)
+
 	return &provider.ProvisionResult{
 		ProviderRef: pref,
 		ServiceRefs: serviceRefs,
+		Endpoints:   endpoints,
 	}, nil
 }
 

provider/kubernetes/resources.go

@@ -97,7 +97,10 @@ func replicaCountFor(req provider.ProvisionRequest) int32 {
 // Init services land in InitContainers (run-once before main start);
 // Main and Sidecar services land in Containers and run for the pod's
 // lifetime.
-func buildPodSpec(req provider.ProvisionRequest) corev1.PodSpec {
+//
+// imagePullSecrets is the list of Secret names in the same namespace
+// that hold registry credentials. Pass nil/empty for public images.
+func buildPodSpec(req provider.ProvisionRequest, imagePullSecrets []string) corev1.PodSpec {
 	var (
 		containers     []corev1.Container
 		initContainers []corev1.Container
@@ -137,10 +140,16 @@ func buildPodSpec(req provider.ProvisionRequest) corev1.PodSpec {
 		}
 	}
 
+	var pullSecretRefs []corev1.LocalObjectReference
+	for _, s := range imagePullSecrets {
+		pullSecretRefs = append(pullSecretRefs, corev1.LocalObjectReference{Name: s})
+	}
+
 	return corev1.PodSpec{
-		Containers:     containers,
-		InitContainers: initContainers,
-		Volumes:        podVolumes,
+		Containers:       containers,
+		InitContainers:   initContainers,
+		Volumes:          podVolumes,
+		ImagePullSecrets: pullSecretRefs,
 	}
 }
 
@@ -176,7 +185,7 @@ func buildContainer(instanceID id.ID, svc provider.ServiceSpec) corev1.Container
 
 // buildDeployment creates a Kubernetes Deployment for a stateless
 // workload (req.Kind == KindDeployment, the default).
-func buildDeployment(req provider.ProvisionRequest, namespace string, labels map[string]string) *appsv1.Deployment {
+func buildDeployment(req provider.ProvisionRequest, namespace string, labels map[string]string, imagePullSecrets []string) *appsv1.Deployment {
 	replicas := replicaCountFor(req)
 
 	return &appsv1.Deployment{
@@ -196,7 +205,7 @@ func buildDeployment(req provider.ProvisionRequest, namespace string, labels map
 				ObjectMeta: metav1.ObjectMeta{
 					Labels: labels,
 				},
-				Spec: buildPodSpec(req),
+				Spec: buildPodSpec(req, imagePullSecrets),
 			},
 		},
 	}
@@ -206,9 +215,9 @@ func buildDeployment(req provider.ProvisionRequest, namespace string, labels map
 // stateful workload (req.Kind == KindStatefulSet). Persistent volumes
 // declared on services become volumeClaimTemplates so each replica
 // gets its own PVC.
-func buildStatefulSet(req provider.ProvisionRequest, namespace string, labels map[string]string) *appsv1.StatefulSet {
+func buildStatefulSet(req provider.ProvisionRequest, namespace string, labels map[string]string, imagePullSecrets []string) *appsv1.StatefulSet {
 	replicas := replicaCountFor(req)
-	podSpec := buildPodSpec(req)
+	podSpec := buildPodSpec(req, imagePullSecrets)
 
 	// Volume claims: take every unique named volume across services
 	// and emit a volumeClaimTemplate for it. The PodSpec volumes that
@@ -408,6 +417,41 @@ func buildVolumeMounts(volumes []provider.VolumeSpec) []corev1.VolumeMount {
 	return result
 }
 
+// buildEndpoints derives the in-cluster DNS endpoints for a provisioned
+// instance. One Endpoint is emitted per service that declares at least
+// one port. The URL has the form:
+//
+//	http://<serviceName>.<namespace>.svc.cluster.local:<firstPort>
+//
+// This is the stable address consumers (e.g. twinos injectUpstreamEnv)
+// should use to reach the workload from within the cluster. Non-HTTP
+// protocols are not distinguished here — callers that need TLS or gRPC
+// URLs should wrap the value themselves.
+func buildEndpoints(req provider.ProvisionRequest, namespace string) []provider.Endpoint {
+	svcName := serviceName(req.InstanceID)
+
+	var endpoints []provider.Endpoint
+
+	for i := range req.Services {
+		svc := req.Services[i]
+		if len(svc.Ports) == 0 {
+			continue
+		}
+
+		firstPort := svc.Ports[0].Container
+		url := fmt.Sprintf("http://%s.%s.svc.cluster.local:%d", svcName, namespace, firstPort)
+
+		endpoints = append(endpoints, provider.Endpoint{
+			ServiceName: svc.Name,
+			URL:         url,
+			Port:        firstPort,
+			Protocol:    "TCP",
+		})
+	}
+
+	return endpoints
+}
+
 // toK8sProtocol maps a protocol string to a Kubernetes Protocol constant.
 func toK8sProtocol(protocol string) corev1.Protocol {
 	switch strings.ToUpper(protocol) {