pepr 0.32.3 → 0.32.4

package/dist/cli.js

@@ -475,7 +475,7 @@ function namespace(namespaceLabels) {
     };
   }
 }
-function watcher(assets, hash, buildTimestamp) {
+function watcher(assets, hash, buildTimestamp, imagePullSecret) {
   const { name: name2, image, capabilities, config } = assets;
   let hasSchedule = false;
   const app = `${name2}-watcher`;
@@ -490,7 +490,7 @@ function watcher(assets, hash, buildTimestamp) {
   if (bindings.length < 1 && !hasSchedule) {
     return null;
   }
-  return {
+  const deploy2 = {
     apiVersion: "apps/v1",
     kind: "Deployment",
     metadata: {
@@ -612,11 +612,15 @@ function watcher(assets, hash, buildTimestamp) {
       }
     }
   };
+  if (imagePullSecret) {
+    deploy2.spec.template.spec.imagePullSecrets = [{ name: imagePullSecret }];
+  }
+  return deploy2;
 }
-function deployment(assets, hash, buildTimestamp) {
+function deployment(assets, hash, buildTimestamp, imagePullSecret) {
   const { name: name2, image, config } = assets;
   const app = name2;
-  return {
+  const deploy2 = {
     apiVersion: "apps/v1",
     kind: "Deployment",
     metadata: {
@@ -747,6 +751,10 @@ function deployment(assets, hash, buildTimestamp) {
       }
     }
   };
+  if (imagePullSecret) {
+    deploy2.spec.template.spec.imagePullSecrets = [{ name: imagePullSecret }];
+  }
+  return deploy2;
 }
 function moduleSecret(name2, data, hash) {
   const compressed = (0, import_zlib.gzipSync)(data);
@@ -1026,6 +1034,32 @@ async function webhookConfig(assets, mutateOrValidate, timeoutSeconds = 10) {
 }
 
 // src/lib/assets/deploy.ts
+async function deployImagePullSecret(imagePullSecret, name2) {
+  try {
+    await (0, import_kubernetes_fluent_client4.K8s)(import_kubernetes_fluent_client4.kind.Namespace).Get("pepr-system");
+  } catch {
+    await (0, import_kubernetes_fluent_client4.K8s)(import_kubernetes_fluent_client4.kind.Namespace).Apply(namespace());
+  }
+  try {
+    await (0, import_kubernetes_fluent_client4.K8s)(import_kubernetes_fluent_client4.kind.Secret).Apply(
+      {
+        apiVersion: "v1",
+        kind: "Secret",
+        metadata: {
+          name: name2,
+          namespace: "pepr-system"
+        },
+        type: "kubernetes.io/dockerconfigjson",
+        data: {
+          ".dockerconfigjson": Buffer.from(JSON.stringify(imagePullSecret)).toString("base64")
+        }
+      },
+      { force: true }
+    );
+  } catch (e) {
+    logger_default.error(e);
+  }
+}
 async function deploy(assets, force, webhookTimeout) {
   logger_default.info("Establishing connection to Kubernetes");
   const { name: name2, host, path } = assets;
@@ -1308,13 +1342,13 @@ function zarfYamlChart({ name: name2, image, config }, path) {
   };
   return (0, import_client_node.dumpYaml)(zarfCfg, { noRefs: true });
 }
-async function allYaml(assets, rbacMode) {
+async function allYaml(assets, rbacMode, imagePullSecret) {
   const { name: name2, tls, apiToken, path } = assets;
   const code = await import_fs4.promises.readFile(path);
   assets.hash = import_crypto2.default.createHash("sha256").update(code).digest("hex");
   const mutateWebhook = await webhookConfig(assets, "mutate", assets.config.webhookTimeout);
   const validateWebhook = await webhookConfig(assets, "validate", assets.config.webhookTimeout);
-  const watchDeployment = watcher(assets, assets.hash, assets.buildTimestamp);
+  const watchDeployment = watcher(assets, assets.hash, assets.buildTimestamp, imagePullSecret);
   const resources = [
     namespace(assets.config.customLabels?.namespace),
     clusterRole(name2, assets.capabilities, rbacMode),
@@ -1322,7 +1356,7 @@ async function allYaml(assets, rbacMode) {
     serviceAccount(name2),
     apiTokenSecret(name2, apiToken),
     tlsSecret(name2, tls),
-    deployment(assets, assets.hash, assets.buildTimestamp),
+    deployment(assets, assets.hash, assets.buildTimestamp, imagePullSecret),
     service(name2),
     watcherService(name2),
     moduleSecret(name2, code, assets.hash),
@@ -1591,12 +1625,12 @@ var Assets = class {
   };
   zarfYaml = (path) => zarfYaml(this, path);
   zarfYamlChart = (path) => zarfYamlChart(this, path);
-  allYaml = async (rbacMode) => {
+  allYaml = async (rbacMode, imagePullSecret) => {
     this.capabilities = await loadCapabilities(this.path);
     for (const capability of this.capabilities) {
       namespaceComplianceValidator(capability, this.alwaysIgnore.namespaces);
     }
-    return allYaml(this, rbacMode);
+    return allYaml(this, rbacMode, imagePullSecret);
   };
   generateHelmChart = async (basePath) => {
     const CHART_DIR = `${basePath}/${this.config.uuid}-chart`;
@@ -1888,7 +1922,7 @@ var gitIgnore = "# Ignore node_modules and Pepr build artifacts\nnode_modules\nd
 var readmeMd = '# Pepr Module\n\nThis is a Pepr Module. [Pepr](https://github.com/defenseunicorns/pepr) is a type-safe Kubernetes middleware system.\n\nThe `capabilities` directory contains all the capabilities for this module. By default,\na capability is a single typescript file in the format of `capability-name.ts` that is\nimported in the root `pepr.ts` file as `import { HelloPepr } from "./capabilities/hello-pepr";`.\nBecause this is typescript, you can organize this however you choose, e.g. creating a sub-folder\nper-capability or common logic in shared files or folders.\n\nExample Structure:\n\n```\nModule Root\n\u251C\u2500\u2500 package.json\n\u251C\u2500\u2500 pepr.ts\n\u2514\u2500\u2500 capabilities\n    \u251C\u2500\u2500 example-one.ts\n    \u251C\u2500\u2500 example-three.ts\n    \u2514\u2500\u2500 example-two.ts\n```\n';
 var peprTS = 'import { PeprModule } from "pepr";\n// cfg loads your pepr configuration from package.json\nimport cfg from "./package.json";\n\n// HelloPepr is a demo capability that is included with Pepr. Comment or delete the line below to remove it.\nimport { HelloPepr } from "./capabilities/hello-pepr";\n\n/**\n * This is the main entrypoint for this Pepr module. It is run when the module is started.\n * This is where you register your Pepr configurations and capabilities.\n */\nnew PeprModule(cfg, [\n  // "HelloPepr" is a demo capability that is included with Pepr. Comment or delete the line below to remove it.\n  HelloPepr,\n\n  // Your additional capabilities go here\n]);\n';
 var helloPeprTS = 'import {\n  Capability,\n  K8s,\n  Log,\n  PeprMutateRequest,\n  RegisterKind,\n  a,\n  fetch,\n  fetchStatus,\n  kind,\n} from "pepr";\n\n/**\n *  The HelloPepr Capability is an example capability to demonstrate some general concepts of Pepr.\n *  To test this capability you run `pepr dev`and then run the following command:\n *  `kubectl apply -f capabilities/hello-pepr.samples.yaml`\n */\nexport const HelloPepr = new Capability({\n  name: "hello-pepr",\n  description: "A simple example capability to show how things work.",\n  namespaces: ["pepr-demo", "pepr-demo-2"],\n});\n\n// Use the \'When\' function to create a new action, use \'Store\' to persist data\nconst { When, Store } = HelloPepr;\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (Namespace)                                   *\n * ---------------------------------------------------------------------------------------------------\n *\n * This action removes the label `remove-me` when a Namespace is created.\n * Note we don\'t need to specify the namespace here, because we\'ve already specified\n * it in the Capability definition above.\n */\nWhen(a.Namespace)\n  .IsCreated()\n  .Mutate(ns => ns.RemoveLabel("remove-me"));\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Watch Action with K8s SSA (Namespace)                           *\n * ---------------------------------------------------------------------------------------------------\n *\n * This action watches for the `pepr-demo-2` namespace to be created, then creates a ConfigMap with\n * the name `pepr-ssa-demo` and adds the namespace UID to the ConfigMap data. Because Pepr uses\n * server-side apply for this operation, the ConfigMap will be created or updated if it already exists.\n */\nWhen(a.Namespace)\n  .IsCreated()\n  .WithName("pepr-demo-2")\n  .Watch(async ns => {\n    Log.info("Namespace pepr-demo-2 was created.");\n\n    try {\n      // Apply the ConfigMap using K8s server-side apply\n      await K8s(kind.ConfigMap).Apply({\n        metadata: {\n          name: "pepr-ssa-demo",\n          namespace: "pepr-demo-2",\n        },\n        data: {\n          "ns-uid": ns.metadata.uid,\n        },\n      });\n    } catch (error) {\n      // You can use the Log object to log messages to the Pepr controller pod\n      Log.error(error, "Failed to apply ConfigMap using server-side apply.");\n    }\n\n    // You can share data between actions using the Store, including between different types of actions\n    Store.setItem("watch-data", "This data was stored by a Watch Action.");\n  });\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (CM Example 1)                                *\n * ---------------------------------------------------------------------------------------------------\n *\n * This is a single action. They can be in the same file or put imported from other files.\n * In this example, when a ConfigMap is created with the name `example-1`, then add a label and annotation.\n *\n * Equivalent to manually running:\n * `kubectl label configmap example-1 pepr=was-here`\n * `kubectl annotate configmap example-1 pepr.dev=annotations-work-too`\n */\nWhen(a.ConfigMap)\n  .IsCreated()\n  .WithName("example-1")\n  .Mutate(request => {\n    request\n      .SetLabel("pepr", "was-here")\n      .SetAnnotation("pepr.dev", "annotations-work-too");\n\n    // Use the Store to persist data between requests and Pepr controller pods\n    Store.setItem("example-1", "was-here");\n\n    // This data is written asynchronously and can be read back via `Store.getItem()` or `Store.subscribe()`\n    Store.setItem("example-1-data", JSON.stringify(request.Raw.data));\n  });\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate & Validate Actions (CM Example 2)                                *\n * ---------------------------------------------------------------------------------------------------\n *\n * This combines 3 different types of actions: \'Mutate\', \'Validate\', and \'Watch\'. The order\n * of the actions is required, but each action is optional. In this example, when a ConfigMap is created\n * with the name `example-2`, then add a label and annotation, validate that the ConfigMap has the label\n * `pepr`, and log the request.\n */\nWhen(a.ConfigMap)\n  .IsCreated()\n  .WithName("example-2")\n  .Mutate(request => {\n    // This Mutate Action will mutate the request before it is persisted to the cluster\n\n    // Use `request.Merge()` to merge the new data with the existing data\n    request.Merge({\n      metadata: {\n        labels: {\n          pepr: "was-here",\n        },\n        annotations: {\n          "pepr.dev": "annotations-work-too",\n        },\n      },\n    });\n  })\n  .Validate(request => {\n    // This Validate Action will validate the request before it is persisted to the cluster\n\n    // Approve the request if the ConfigMap has the label \'pepr\'\n    if (request.HasLabel("pepr")) {\n      return request.Approve();\n    }\n\n    // Otherwise, deny the request with an error message (optional)\n    return request.Deny("ConfigMap must have label \'pepr\'");\n  })\n  .Watch((cm, phase) => {\n    // This Watch Action will watch the ConfigMap after it has been persisted to the cluster\n    Log.info(cm, `ConfigMap was ${phase} with the name example-2`);\n  });\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (CM Example 2a)                               *\n * ---------------------------------------------------------------------------------------------------\n *\n * This action shows a simple validation that will deny any ConfigMap that has the\n * annotation `evil`. Note that the `Deny()` function takes an optional second parameter that is a\n * user-defined status code to return.\n */\nWhen(a.ConfigMap)\n  .IsCreated()\n  .Validate(request => {\n    if (request.HasAnnotation("evil")) {\n      return request.Deny("No evil CM annotations allowed.", 400);\n    }\n\n    return request.Approve();\n  });\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (CM Example 3)                                *\n * ---------------------------------------------------------------------------------------------------\n *\n * This action combines different styles. Unlike the previous actions, this one will look\n * for any ConfigMap in the `pepr-demo` namespace that has the label `change=by-label` during either\n * CREATE or UPDATE. Note that all conditions added such as `WithName()`, `WithLabel()`, `InNamespace()`,\n * are ANDs so all conditions must be true for the request to be processed.\n */\nWhen(a.ConfigMap)\n  .IsCreatedOrUpdated()\n  .WithLabel("change", "by-label")\n  .Mutate(request => {\n    // The K8s object e are going to mutate\n    const cm = request.Raw;\n\n    // Get the username and uid of the K8s request\n    const { username, uid } = request.Request.userInfo;\n\n    // Store some data about the request in the configmap\n    cm.data["username"] = username;\n    cm.data["uid"] = uid;\n\n    // You can still mix other ways of making changes too\n    request.SetAnnotation("pepr.dev", "making-waves");\n  });\n\n// This action validates the label `change=by-label` is deleted\nWhen(a.ConfigMap)\n  .IsDeleted()\n  .WithLabel("change", "by-label")\n  .Validate(request => {\n    // Log and then always approve the request\n    Log.info("CM with label \'change=by-label\' was deleted.");\n    return request.Approve();\n  });\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (CM Example 4)                                *\n * ---------------------------------------------------------------------------------------------------\n *\n * This action show how you can use the `Mutate()` function without an inline function.\n * This is useful if you want to keep your actions small and focused on a single task,\n * or if you want to reuse the same function in multiple actions.\n */\nWhen(a.ConfigMap).IsCreated().WithName("example-4").Mutate(example4Cb);\n\n// This function uses the complete type definition, but is not required.\nfunction example4Cb(cm: PeprMutateRequest<a.ConfigMap>) {\n  cm.SetLabel("pepr.dev/first", "true");\n  cm.SetLabel("pepr.dev/second", "true");\n  cm.SetLabel("pepr.dev/third", "true");\n}\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (CM Example 4a)                                *\n * ---------------------------------------------------------------------------------------------------\n *\n * This is the same as Example 4, except this only operates on a CM in the `pepr-demo-2` namespace.\n * Note because the Capability defines namespaces, the namespace specified here must be one of those.\n * Alternatively, you can remove the namespace from the Capability definition and specify it here.\n */\nWhen(a.ConfigMap)\n  .IsCreated()\n  .InNamespace("pepr-demo-2")\n  .WithName("example-4a")\n  .Mutate(example4Cb);\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (CM Example 5)                                *\n * ---------------------------------------------------------------------------------------------------\n *\n * This action is a bit more complex. It will look for any ConfigMap in the `pepr-demo`\n * namespace that has the label `chuck-norris` during CREATE. When it finds one, it will fetch a\n * random Chuck Norris joke from the API and add it to the ConfigMap. This is a great example of how\n * you can use Pepr to make changes to your K8s objects based on external data.\n *\n * Note the use of the `async` keyword. This is required for any action that uses `await` or `fetch()`.\n *\n * Also note we are passing a type to the `fetch()` function. This is optional, but it will help you\n * avoid mistakes when working with the data returned from the API. You can also use the `as` keyword to\n * cast the data returned from the API.\n *\n * These are equivalent:\n * ```ts\n * const joke = await fetch<TheChuckNorrisJoke>("https://icanhazdadjoke.com/");\n * const joke = await fetch("https://icanhazdadjoke.com/") as TheChuckNorrisJoke;\n * ```\n *\n * Alternatively, you can drop the type completely:\n *\n * ```ts\n * fetch("https://icanhazdadjoke.com")\n * ```\n */\ninterface TheChuckNorrisJoke {\n  id: string;\n  joke: string;\n  status: number;\n}\n\nWhen(a.ConfigMap)\n  .IsCreated()\n  .WithLabel("chuck-norris")\n  .Mutate(async change => {\n    // Try/catch is not needed as a response object will always be returned\n    const response = await fetch<TheChuckNorrisJoke>(\n      "https://icanhazdadjoke.com/",\n      {\n        headers: {\n          Accept: "application/json",\n        },\n      },\n    );\n\n    // Instead, check the `response.ok` field\n    if (response.ok) {\n      // Add the Chuck Norris joke to the configmap\n      change.Raw.data["chuck-says"] = response.data.joke;\n      return;\n    }\n\n    // You can also assert on different HTTP response codes\n    if (response.status === fetchStatus.NOT_FOUND) {\n      // Do something else\n      return;\n    }\n  });\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (Secret Base64 Handling)                      *\n * ---------------------------------------------------------------------------------------------------\n *\n * The K8s JS client provides incomplete support for base64 encoding/decoding handling for secrets,\n * unlike the GO client. To make this less painful, Pepr automatically handles base64 encoding/decoding\n * secret data before and after the action is executed.\n */\nWhen(a.Secret)\n  .IsCreated()\n  .WithName("secret-1")\n  .Mutate(request => {\n    const secret = request.Raw;\n\n    // This will be encoded at the end of all processing back to base64: "Y2hhbmdlLXdpdGhvdXQtZW5jb2Rpbmc="\n    secret.data.magic = "change-without-encoding";\n\n    // You can modify the data directly, and it will be encoded at the end of all processing\n    secret.data.example += " - modified by Pepr";\n  });\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (Untyped Custom Resource)                     *\n * ---------------------------------------------------------------------------------------------------\n *\n * Out of the box, Pepr supports all the standard Kubernetes objects. However, you can also create\n * your own types. This is useful if you are working with an Operator that creates custom resources.\n * There are two ways to do this, the first is to use the `When()` function with a `GenericKind`,\n * the second is to create a new class that extends `GenericKind` and use the `RegisterKind()` function.\n *\n * This example shows how to use the `When()` function with a `GenericKind`. Note that you\n * must specify the `group`, `version`, and `kind` of the object (if applicable). This is how Pepr knows\n * if the action should be triggered or not. Since we are using a `GenericKind`,\n * Pepr will not be able to provide any intellisense for the object, so you will need to refer to the\n * Kubernetes API documentation for the object you are working with.\n *\n * You will need to wait for the CRD in `hello-pepr.samples.yaml` to be created, then you can apply\n *\n * ```yaml\n * apiVersion: pepr.dev/v1\n * kind: Unicorn\n * metadata:\n *   name: example-1\n *   namespace: pepr-demo\n * spec:\n *   message: replace-me\n *   counter: 0\n * ```\n */\nWhen(a.GenericKind, {\n  group: "pepr.dev",\n  version: "v1",\n  kind: "Unicorn",\n})\n  .IsCreated()\n  .WithName("example-1")\n  .Mutate(request => {\n    request.Merge({\n      spec: {\n        message: "Hello Pepr without type data!",\n        counter: Math.random(),\n      },\n    });\n  });\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (Typed Custom Resource)                       *\n * ---------------------------------------------------------------------------------------------------\n *\n * This example shows how to use the `RegisterKind()` function to create a new type. This is useful\n * if you are working with an Operator that creates custom resources and you want to have intellisense\n * for the object. Note that you must specify the `group`, `version`, and `kind` of the object (if applicable)\n * as this is how Pepr knows if the action should be triggered or not.\n *\n * Once you register a new Kind with Pepr, you can use the `When()` function with the new Kind. Ideally,\n * you should register custom Kinds at the top of your Capability file or Pepr Module so they are available\n * to all actions, but we are putting it here for demonstration purposes.\n *\n * You will need to wait for the CRD in `hello-pepr.samples.yaml` to be created, then you can apply\n *\n * ```yaml\n * apiVersion: pepr.dev/v1\n * kind: Unicorn\n * metadata:\n *   name: example-2\n *   namespace: pepr-demo\n * spec:\n *   message: replace-me\n *   counter: 0\n * ```*\n */\nclass UnicornKind extends a.GenericKind {\n  spec: {\n    /**\n     * JSDoc comments can be added to explain more details about the field.\n     *\n     * @example\n     * ```ts\n     * request.Raw.spec.message = "Hello Pepr!";\n     * ```\n     * */\n    message: string;\n    counter: number;\n  };\n}\n\nRegisterKind(UnicornKind, {\n  group: "pepr.dev",\n  version: "v1",\n  kind: "Unicorn",\n});\n\nWhen(UnicornKind)\n  .IsCreated()\n  .WithName("example-2")\n  .Mutate(request => {\n    request.Merge({\n      spec: {\n        message: "Hello Pepr with type data!",\n        counter: Math.random(),\n      },\n    });\n  });\n\n/**\n * A callback function that is called once the Pepr Store is fully loaded.\n */\nStore.onReady(data => {\n  Log.info(data, "Pepr Store Ready");\n});\n';
-var packageJSON = { name: "pepr", description: "Kubernetes application engine", author: "Defense Unicorns", homepage: "https://github.com/defenseunicorns/pepr", license: "Apache-2.0", bin: "dist/cli.js", repository: "defenseunicorns/pepr", engines: { node: ">=18.0.0" }, version: "0.32.3", main: "dist/lib.js", types: "dist/lib.d.ts", scripts: { "gen-data-json": "node hack/build-template-data.js", prebuild: "rm -fr dist/* && npm run gen-data-json", build: "tsc && node build.mjs", "build:image": "npm run build && docker buildx build --tag pepr:dev .", test: "npm run test:unit && npm run test:journey", "test:unit": "npm run gen-data-json && jest src --coverage --detectOpenHandles --coverageDirectory=./coverage", "test:journey": "npm run test:journey:k3d && npm run test:journey:build && npm run test:journey:image && npm run test:journey:run", "test:journey:prep": "if [ ! -d ./pepr-upgrade-test ]; then git clone https://github.com/defenseunicorns/pepr-upgrade-test.git ; fi", "test:journey-wasm": "npm run test:journey:k3d && npm run test:journey:build && npm run test:journey:image && npm run test:journey:run-wasm", "test:journey:k3d": "k3d cluster delete pepr-dev && k3d cluster create pepr-dev --k3s-arg '--debug@server:0' --wait && kubectl rollout status deployment -n kube-system", "test:journey:build": "npm run build && npm pack", "test:journey:image": "docker buildx build --tag pepr:dev . && k3d image import pepr:dev -c pepr-dev", "test:journey:run": "jest --detectOpenHandles journey/entrypoint.test.ts && npm run test:journey:prep && npm run test:journey:upgrade", "test:journey:run-wasm": "jest --detectOpenHandles journey/entrypoint-wasm.test.ts", "test:journey:upgrade": "npm run test:journey:k3d && npm run test:journey:image && jest --detectOpenHandles journey/pepr-upgrade.test.ts", "format:check": "eslint src && prettier src --check", "format:fix": "eslint src --fix && prettier src --write" }, dependencies: { "@types/ramda": "0.30.0", express: "4.19.2", "fast-json-patch": "3.1.1", "kubernetes-fluent-client": "2.6.2", pino: "9.2.0", "pino-pretty": "11.2.1", "prom-client": "15.1.2", ramda: "0.30.1" }, devDependencies: { "@commitlint/cli": "19.3.0", "@commitlint/config-conventional": "19.2.2", "@jest/globals": "29.7.0", "@types/eslint": "8.56.10", "@types/express": "4.17.21", "@types/node": "18.x.x", "@types/node-forge": "1.3.11", "@types/prompts": "2.4.9", "@types/uuid": "9.0.8", jest: "29.7.0", nock: "13.5.4", "ts-jest": "29.1.5" }, peerDependencies: { "@typescript-eslint/eslint-plugin": "6.15.0", "@typescript-eslint/parser": "6.15.0", commander: "11.1.0", esbuild: "0.19.10", eslint: "8.56.0", "node-forge": "1.3.1", prettier: "3.1.1", prompts: "2.4.2", typescript: "5.3.3", uuid: "9.0.1" } };
+var packageJSON = { name: "pepr", description: "Kubernetes application engine", author: "Defense Unicorns", homepage: "https://github.com/defenseunicorns/pepr", license: "Apache-2.0", bin: "dist/cli.js", repository: "defenseunicorns/pepr", engines: { node: ">=18.0.0" }, version: "0.32.4", main: "dist/lib.js", types: "dist/lib.d.ts", scripts: { "gen-data-json": "node hack/build-template-data.js", prebuild: "rm -fr dist/* && npm run gen-data-json", build: "tsc && node build.mjs", "build:image": "npm run build && docker buildx build --tag pepr:dev .", test: "npm run test:unit && npm run test:journey", "test:unit": "npm run gen-data-json && jest src --coverage --detectOpenHandles --coverageDirectory=./coverage", "test:journey": "npm run test:journey:k3d && npm run test:journey:build && npm run test:journey:image && npm run test:journey:run", "test:journey:prep": "if [ ! -d ./pepr-upgrade-test ]; then git clone https://github.com/defenseunicorns/pepr-upgrade-test.git ; fi", "test:journey-wasm": "npm run test:journey:k3d && npm run test:journey:build && npm run test:journey:image && npm run test:journey:run-wasm", "test:journey:k3d": "k3d cluster delete pepr-dev && k3d cluster create pepr-dev --k3s-arg '--debug@server:0' --wait && kubectl rollout status deployment -n kube-system", "test:journey:build": "npm run build && npm pack", "test:journey:image": "docker buildx build --tag pepr:dev . && k3d image import pepr:dev -c pepr-dev", "test:journey:run": "jest --detectOpenHandles journey/entrypoint.test.ts && npm run test:journey:prep && npm run test:journey:upgrade", "test:journey:run-wasm": "jest --detectOpenHandles journey/entrypoint-wasm.test.ts", "test:journey:upgrade": "npm run test:journey:k3d && npm run test:journey:image && jest --detectOpenHandles journey/pepr-upgrade.test.ts", "format:check": "eslint src && prettier src --check", "format:fix": "eslint src --fix && prettier src --write" }, dependencies: { "@types/ramda": "0.30.0", express: "4.19.2", "fast-json-patch": "3.1.1", "kubernetes-fluent-client": "2.6.2", pino: "9.2.0", "pino-pretty": "11.2.1", "prom-client": "15.1.2", ramda: "0.30.1" }, devDependencies: { "@commitlint/cli": "19.3.0", "@commitlint/config-conventional": "19.2.2", "@fast-check/jest": "^1.8.2", "@jest/globals": "29.7.0", "@types/eslint": "8.56.10", "@types/express": "4.17.21", "@types/node": "18.x.x", "@types/node-forge": "1.3.11", "@types/prompts": "2.4.9", "fast-check": "^3.19.0", "@types/uuid": "10.0.0", jest: "29.7.0", nock: "13.5.4", "ts-jest": "29.1.5" }, peerDependencies: { "@typescript-eslint/eslint-plugin": "6.15.0", "@typescript-eslint/parser": "6.15.0", commander: "11.1.0", esbuild: "0.19.10", eslint: "8.56.0", "node-forge": "1.3.1", prettier: "3.1.1", prompts: "2.4.2", typescript: "5.3.3", uuid: "9.0.1" } };
 
 // src/templates/pepr.code-snippets.json
 var pepr_code_snippets_default = {
@@ -2140,6 +2174,9 @@ function build_default(program2) {
   ).option(
     "-v, --version <version>. Example: '0.27.3'",
     "The version of the Pepr image to use in the deployment manifests."
+  ).option(
+    "--withPullSecret <imagePullSecret>",
+    "Image Pull Secret: Use image pull secret for controller Deployment."
   ).addOption(
     new import_commander.Option(
       "--registry <GitHub|Iron Bank>",
@@ -2208,10 +2245,18 @@ function build_default(program2) {
     if (image !== "") {
       assets.image = image;
     }
+    if (opts.withPullSecret) {
+      if (sanitizeResourceName(opts.withPullSecret) !== opts.withPullSecret) {
+        console.error(
+          "Invalid imagePullSecret. Please provide a valid name as defined in RFC 1123."
+        );
+        process.exit(1);
+      }
+    }
     const yamlFile = `pepr-module-${uuid}.yaml`;
     const chartPath = `${uuid}-chart`;
     const yamlPath = (0, import_path2.resolve)(outputDir, yamlFile);
-    const yaml = await assets.allYaml(opts.rbacMode);
+    const yaml = await assets.allYaml(opts.rbacMode, opts.withPullSecret);
     try {
       validateCapabilityNames(assets.capabilities);
     } catch (e) {
@@ -2359,7 +2404,32 @@ async function buildModule(reloader, entryPoint = peprTS2, embed = true) {
 // src/cli/deploy.ts
 var import_prompts = __toESM(require("prompts"));
 function deploy_default(program2) {
-  program2.command("deploy").description("Deploy a Pepr Module").option("-i, --image [image]", "Override the image tag").option("--confirm", "Skip confirmation prompt").option("--force", "Force deploy the module, override manager field").action(async (opts) => {
+  program2.command("deploy").description("Deploy a Pepr Module").option("-i, --image [image]", "Override the image tag").option("--confirm", "Skip confirmation prompt").option("--pullSecret <name>", "Deploy imagePullSecret for Controller private registry").option("--docker-server <server>", "Docker server address").option("--docker-username <username>", "Docker registry username").option("--docker-email <email>", "Email for Docker registry").option("--docker-password <password>", "Password for Docker registry").option("--force", "Force deploy the module, override manager field").action(async (opts) => {
+    let imagePullSecret;
+    if (opts.pullSecret && opts.pullSecret.length > 0 && (!opts.dockerServer || !opts.dockerUsername || !opts.dockerEmail || !opts.dockerPassword)) {
+      console.error(
+        "Error: Must provide docker server, username, email, and password when providing pull secret"
+      );
+      process.exit(1);
+    } else if (opts.pullSecret && opts.pullSecret !== sanitizeName(opts.pullSecret)) {
+      console.error(
+        "Invalid imagePullSecret name. Please provide a valid name as defined in RFC 1123."
+      );
+      process.exit(1);
+    } else if (opts.pullSecret) {
+      imagePullSecret = {
+        auths: {
+          [opts.dockerServer]: {
+            username: opts.dockerUsername,
+            password: opts.dockerPassword,
+            email: opts.dockerEmail,
+            auth: Buffer.from(`${opts.dockerUsername}:${opts.dockerPassword}`).toString("base64")
+          }
+        }
+      };
+      await deployImagePullSecret(imagePullSecret, opts.pullSecret);
+      return;
+    }
     if (!opts.confirm) {
       const confirm2 = await (0, import_prompts.default)({
         type: "confirm",
@@ -2504,19 +2574,19 @@ function monitor_default(program2) {
     kc.loadFromDefault();
     const log = new import_client_node4.Log(kc);
     const logStream = new import_stream.default.PassThrough();
-    logStream.on("data", (chunk) => {
+    logStream.on("data", async (chunk) => {
       const respMsg = `"msg":"Check response"`;
-      const lines = chunk.toString().split("\n");
+      const lines = await chunk.toString().split("\n");
       for (const line of lines) {
         if (line.includes(respMsg)) {
           try {
-            const payload = JSON.parse(line);
+            const payload = JSON.parse(line.trim());
             const isMutate = payload.res.patchType || payload.res.warnings;
             const name2 = `${payload.namespace}${payload.name}`;
-            const uid = payload.uid;
+            const uid = payload.res.uid;
             if (isMutate) {
-              const plainPatch = atob(payload.res.patch) || "";
-              const patch = JSON.stringify(JSON.parse(plainPatch), null, 2);
+              const plainPatch = payload.res?.patch !== void 0 && payload.res?.patch !== null ? atob(payload.res.patch) : "";
+              const patch = plainPatch !== "" && JSON.stringify(JSON.parse(plainPatch), null, 2);
               const patchType = payload.res.patchType || payload.res.warnings || "";
               const allowOrDeny = payload.res.allowed ? "\u{1F500}" : "\u{1F6AB}";
               console.log(`

package/dist/controller.js

@@ -51,7 +51,7 @@ if (process.env.LOG_LEVEL) {
 var logger_default = Log;
 
 // src/templates/data.json
-var packageJSON = { name: "pepr", description: "Kubernetes application engine", author: "Defense Unicorns", homepage: "https://github.com/defenseunicorns/pepr", license: "Apache-2.0", bin: "dist/cli.js", repository: "defenseunicorns/pepr", engines: { node: ">=18.0.0" }, version: "0.32.3", main: "dist/lib.js", types: "dist/lib.d.ts", scripts: { "gen-data-json": "node hack/build-template-data.js", prebuild: "rm -fr dist/* && npm run gen-data-json", build: "tsc && node build.mjs", "build:image": "npm run build && docker buildx build --tag pepr:dev .", test: "npm run test:unit && npm run test:journey", "test:unit": "npm run gen-data-json && jest src --coverage --detectOpenHandles --coverageDirectory=./coverage", "test:journey": "npm run test:journey:k3d && npm run test:journey:build && npm run test:journey:image && npm run test:journey:run", "test:journey:prep": "if [ ! -d ./pepr-upgrade-test ]; then git clone https://github.com/defenseunicorns/pepr-upgrade-test.git ; fi", "test:journey-wasm": "npm run test:journey:k3d && npm run test:journey:build && npm run test:journey:image && npm run test:journey:run-wasm", "test:journey:k3d": "k3d cluster delete pepr-dev && k3d cluster create pepr-dev --k3s-arg '--debug@server:0' --wait && kubectl rollout status deployment -n kube-system", "test:journey:build": "npm run build && npm pack", "test:journey:image": "docker buildx build --tag pepr:dev . && k3d image import pepr:dev -c pepr-dev", "test:journey:run": "jest --detectOpenHandles journey/entrypoint.test.ts && npm run test:journey:prep && npm run test:journey:upgrade", "test:journey:run-wasm": "jest --detectOpenHandles journey/entrypoint-wasm.test.ts", "test:journey:upgrade": "npm run test:journey:k3d && npm run test:journey:image && jest --detectOpenHandles journey/pepr-upgrade.test.ts", "format:check": "eslint src && prettier src --check", "format:fix": "eslint src --fix && prettier src --write" }, dependencies: { "@types/ramda": "0.30.0", express: "4.19.2", "fast-json-patch": "3.1.1", "kubernetes-fluent-client": "2.6.2", pino: "9.2.0", "pino-pretty": "11.2.1", "prom-client": "15.1.2", ramda: "0.30.1" }, devDependencies: { "@commitlint/cli": "19.3.0", "@commitlint/config-conventional": "19.2.2", "@jest/globals": "29.7.0", "@types/eslint": "8.56.10", "@types/express": "4.17.21", "@types/node": "18.x.x", "@types/node-forge": "1.3.11", "@types/prompts": "2.4.9", "@types/uuid": "9.0.8", jest: "29.7.0", nock: "13.5.4", "ts-jest": "29.1.5" }, peerDependencies: { "@typescript-eslint/eslint-plugin": "6.15.0", "@typescript-eslint/parser": "6.15.0", commander: "11.1.0", esbuild: "0.19.10", eslint: "8.56.0", "node-forge": "1.3.1", prettier: "3.1.1", prompts: "2.4.2", typescript: "5.3.3", uuid: "9.0.1" } };
+var packageJSON = { name: "pepr", description: "Kubernetes application engine", author: "Defense Unicorns", homepage: "https://github.com/defenseunicorns/pepr", license: "Apache-2.0", bin: "dist/cli.js", repository: "defenseunicorns/pepr", engines: { node: ">=18.0.0" }, version: "0.32.4", main: "dist/lib.js", types: "dist/lib.d.ts", scripts: { "gen-data-json": "node hack/build-template-data.js", prebuild: "rm -fr dist/* && npm run gen-data-json", build: "tsc && node build.mjs", "build:image": "npm run build && docker buildx build --tag pepr:dev .", test: "npm run test:unit && npm run test:journey", "test:unit": "npm run gen-data-json && jest src --coverage --detectOpenHandles --coverageDirectory=./coverage", "test:journey": "npm run test:journey:k3d && npm run test:journey:build && npm run test:journey:image && npm run test:journey:run", "test:journey:prep": "if [ ! -d ./pepr-upgrade-test ]; then git clone https://github.com/defenseunicorns/pepr-upgrade-test.git ; fi", "test:journey-wasm": "npm run test:journey:k3d && npm run test:journey:build && npm run test:journey:image && npm run test:journey:run-wasm", "test:journey:k3d": "k3d cluster delete pepr-dev && k3d cluster create pepr-dev --k3s-arg '--debug@server:0' --wait && kubectl rollout status deployment -n kube-system", "test:journey:build": "npm run build && npm pack", "test:journey:image": "docker buildx build --tag pepr:dev . && k3d image import pepr:dev -c pepr-dev", "test:journey:run": "jest --detectOpenHandles journey/entrypoint.test.ts && npm run test:journey:prep && npm run test:journey:upgrade", "test:journey:run-wasm": "jest --detectOpenHandles journey/entrypoint-wasm.test.ts", "test:journey:upgrade": "npm run test:journey:k3d && npm run test:journey:image && jest --detectOpenHandles journey/pepr-upgrade.test.ts", "format:check": "eslint src && prettier src --check", "format:fix": "eslint src --fix && prettier src --write" }, dependencies: { "@types/ramda": "0.30.0", express: "4.19.2", "fast-json-patch": "3.1.1", "kubernetes-fluent-client": "2.6.2", pino: "9.2.0", "pino-pretty": "11.2.1", "prom-client": "15.1.2", ramda: "0.30.1" }, devDependencies: { "@commitlint/cli": "19.3.0", "@commitlint/config-conventional": "19.2.2", "@fast-check/jest": "^1.8.2", "@jest/globals": "29.7.0", "@types/eslint": "8.56.10", "@types/express": "4.17.21", "@types/node": "18.x.x", "@types/node-forge": "1.3.11", "@types/prompts": "2.4.9", "fast-check": "^3.19.0", "@types/uuid": "10.0.0", jest: "29.7.0", nock: "13.5.4", "ts-jest": "29.1.5" }, peerDependencies: { "@typescript-eslint/eslint-plugin": "6.15.0", "@typescript-eslint/parser": "6.15.0", commander: "11.1.0", esbuild: "0.19.10", eslint: "8.56.0", "node-forge": "1.3.1", prettier: "3.1.1", prompts: "2.4.2", typescript: "5.3.3", uuid: "9.0.1" } };
 
 // src/lib/k8s.ts
 var import_kubernetes_fluent_client = require("kubernetes-fluent-client");

package/dist/lib/assets/deploy.d.ts

@@ -1,3 +1,5 @@
 import { Assets } from ".";
+import { ImagePullSecret } from "../types";
+export declare function deployImagePullSecret(imagePullSecret: ImagePullSecret, name: string): Promise<void>;
 export declare function deploy(assets: Assets, force: boolean, webhookTimeout?: number): Promise<void>;
 //# sourceMappingURL=deploy.d.ts.map

package/dist/lib/assets/deploy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deploy.d.ts","sourceRoot":"","sources":["../../../src/lib/assets/deploy.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,MAAM,EAAE,MAAM,GAAG,CAAC;AAS3B,wBAAsB,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,cAAc,CAAC,EAAE,MAAM,iBA8CnF"}
+{"version":3,"file":"deploy.d.ts","sourceRoot":"","sources":["../../../src/lib/assets/deploy.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,MAAM,EAAE,MAAM,GAAG,CAAC;AAO3B,OAAO,EAAoB,eAAe,EAAE,MAAM,UAAU,CAAC;AAE7D,wBAAsB,qBAAqB,CAAC,eAAe,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,iBA0BzF;AACD,wBAAsB,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,cAAc,CAAC,EAAE,MAAM,iBA8CnF"}

package/dist/lib/assets/index.d.ts

@@ -19,7 +19,7 @@ export declare class Assets {
     deploy: (force: boolean, webhookTimeout?: number) => Promise<void>;
     zarfYaml: (path: string) => string;
     zarfYamlChart: (path: string) => string;
-    allYaml: (rbacMode: string) => Promise<string>;
+    allYaml: (rbacMode: string, imagePullSecret?: string) => Promise<string>;
     generateHelmChart: (basePath: string) => Promise<void>;
 }
 //# sourceMappingURL=index.d.ts.map

package/dist/lib/assets/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/lib/assets/index.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,EAAE,MAAM,EAAU,MAAM,QAAQ,CAAC;AACxC,OAAO,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AAC5C,OAAO,EAAE,aAAa,EAAE,MAAM,QAAQ,CAAC;AAcvC,qBAAa,MAAM;IAYf,QAAQ,CAAC,MAAM,EAAE,YAAY;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM;IACrB,QAAQ,CAAC,IAAI,CAAC;IAbhB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,YAAY,EAAG,aAAa,CAAC;IACtC,YAAY,EAAG,gBAAgB,EAAE,CAAC;IAElC,KAAK,EAAE,MAAM,CAAC;IACd,cAAc,EAAE,MAAM,CAAC;IACvB,IAAI,EAAE,MAAM,CAAC;gBAGF,MAAM,EAAE,YAAY,EACpB,IAAI,EAAE,MAAM,EACZ,IAAI,CAAC,oBAAQ;IAcxB,OAAO,SAAU,MAAM,UAErB;IAEF,MAAM,UAAiB,OAAO,mBAAmB,MAAM,mBAGrD;IAEF,QAAQ,SAAU,MAAM,YAA0B;IAElD,aAAa,SAAU,MAAM,YAA+B;IAE5D,OAAO,aAAoB,MAAM,qBAQ/B;IAEF,iBAAiB,aAAoB,MAAM,mBAoGzC;CACH"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/lib/assets/index.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,EAAE,MAAM,EAAU,MAAM,QAAQ,CAAC;AACxC,OAAO,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AAC5C,OAAO,EAAE,aAAa,EAAE,MAAM,QAAQ,CAAC;AAcvC,qBAAa,MAAM;IAYf,QAAQ,CAAC,MAAM,EAAE,YAAY;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM;IACrB,QAAQ,CAAC,IAAI,CAAC;IAbhB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,YAAY,EAAG,aAAa,CAAC;IACtC,YAAY,EAAG,gBAAgB,EAAE,CAAC;IAElC,KAAK,EAAE,MAAM,CAAC;IACd,cAAc,EAAE,MAAM,CAAC;IACvB,IAAI,EAAE,MAAM,CAAC;gBAGF,MAAM,EAAE,YAAY,EACpB,IAAI,EAAE,MAAM,EACZ,IAAI,CAAC,oBAAQ;IAcxB,OAAO,SAAU,MAAM,UAErB;IAEF,MAAM,UAAiB,OAAO,mBAAmB,MAAM,mBAGrD;IAEF,QAAQ,SAAU,MAAM,YAA0B;IAElD,aAAa,SAAU,MAAM,YAA+B;IAE5D,OAAO,aAAoB,MAAM,oBAAoB,MAAM,qBAQzD;IAEF,iBAAiB,aAAoB,MAAM,mBAoGzC;CACH"}

package/dist/lib/assets/pods.d.ts

@@ -1,5 +1,4 @@
 /// <reference types="node" />
-import { V1EnvVar } from "@kubernetes/client-node";
 import { kind } from "kubernetes-fluent-client";
 import { Assets } from ".";
 /** Generate the pepr-system namespace */
@@ -18,109 +17,7 @@ export declare function namespace(namespaceLabels?: Record<string, string>): {
         labels?: undefined;
     };
 };
-export declare function watcher(assets: Assets, hash: string, buildTimestamp: string): {
-    apiVersion: string;
-    kind: string;
-    metadata: {
-        name: string;
-        namespace: string;
-        annotations: {
-            "pepr.dev/description": string;
-        };
-        labels: {
-            app: string;
-            "pepr.dev/controller": string;
-            "pepr.dev/uuid": string;
-        };
-    };
-    spec: {
-        replicas: number;
-        strategy: {
-            type: string;
-        };
-        selector: {
-            matchLabels: {
-                app: string;
-                "pepr.dev/controller": string;
-            };
-        };
-        template: {
-            metadata: {
-                annotations: {
-                    buildTimestamp: string;
-                };
-                labels: {
-                    app: string;
-                    "pepr.dev/controller": string;
-                };
-            };
-            spec: {
-                terminationGracePeriodSeconds: number;
-                serviceAccountName: string;
-                securityContext: {
-                    runAsUser: number;
-                    runAsGroup: number;
-                    runAsNonRoot: boolean;
-                    fsGroup: number;
-                };
-                containers: {
-                    name: string;
-                    image: string;
-                    imagePullPolicy: string;
-                    command: string[];
-                    readinessProbe: {
-                        httpGet: {
-                            path: string;
-                            port: number;
-                            scheme: string;
-                        };
-                    };
-                    livenessProbe: {
-                        httpGet: {
-                            path: string;
-                            port: number;
-                            scheme: string;
-                        };
-                    };
-                    ports: {
-                        containerPort: number;
-                    }[];
-                    resources: {
-                        requests: {
-                            memory: string;
-                            cpu: string;
-                        };
-                        limits: {
-                            memory: string;
-                            cpu: string;
-                        };
-                    };
-                    securityContext: {
-                        runAsUser: number;
-                        runAsGroup: number;
-                        runAsNonRoot: boolean;
-                        allowPrivilegeEscalation: boolean;
-                        capabilities: {
-                            drop: string[];
-                        };
-                    };
-                    volumeMounts: {
-                        name: string;
-                        mountPath: string;
-                        readOnly: boolean;
-                    }[];
-                    env: V1EnvVar[];
-                }[];
-                volumes: {
-                    name: string;
-                    secret: {
-                        secretName: string;
-                    };
-                }[];
-            };
-        };
-    };
-} | null;
-export declare function deployment(assets: Assets, hash: string, buildTimestamp: string): kind.Deployment;
+export declare function watcher(assets: Assets, hash: string, buildTimestamp: string, imagePullSecret?: string): kind.Deployment | null;
+export declare function deployment(assets: Assets, hash: string, buildTimestamp: string, imagePullSecret?: string): kind.Deployment;
 export declare function moduleSecret(name: string, data: Buffer, hash: string): kind.Secret;
 //# sourceMappingURL=pods.d.ts.map

package/dist/lib/assets/pods.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pods.d.ts","sourceRoot":"","sources":["../../../src/lib/assets/pods.ts"],"names":[],"mappings":";AAGA,OAAO,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,MAAM,0BAA0B,CAAC;AAGhD,OAAO,EAAE,MAAM,EAAE,MAAM,GAAG,CAAC;AAI3B,yCAAyC;AACzC,wBAAgB,SAAS,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;;;;;;;;;;;;;;EAmBjE;AAED,wBAAgB,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;SAiJ3E;AAED,wBAAgB,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC,UAAU,CAuIhG;AAED,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC,MAAM,CAuBlF"}
+{"version":3,"file":"pods.d.ts","sourceRoot":"","sources":["../../../src/lib/assets/pods.ts"],"names":[],"mappings":";AAIA,OAAO,EAAE,IAAI,EAAE,MAAM,0BAA0B,CAAC;AAGhD,OAAO,EAAE,MAAM,EAAE,MAAM,GAAG,CAAC;AAI3B,yCAAyC;AACzC,wBAAgB,SAAS,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;;;;;;;;;;;;;;EAmBjE;AAED,wBAAgB,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,eAAe,CAAC,EAAE,MAAM,0BAuJrG;AAED,wBAAgB,UAAU,CACxB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,cAAc,EAAE,MAAM,EACtB,eAAe,CAAC,EAAE,MAAM,GACvB,IAAI,CAAC,UAAU,CA6IjB;AAED,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC,MAAM,CAuBlF"}

package/dist/lib/assets/yaml.d.ts

@@ -2,5 +2,5 @@ import { Assets } from ".";
 export declare function overridesFile({ hash, name, image, config, apiToken }: Assets, path: string): Promise<void>;
 export declare function zarfYaml({ name, image, config }: Assets, path: string): string;
 export declare function zarfYamlChart({ name, image, config }: Assets, path: string): string;
-export declare function allYaml(assets: Assets, rbacMode: string): Promise<string>;
+export declare function allYaml(assets: Assets, rbacMode: string, imagePullSecret?: string): Promise<string>;
 //# sourceMappingURL=yaml.d.ts.map

package/dist/lib/assets/yaml.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"yaml.d.ts","sourceRoot":"","sources":["../../../src/lib/assets/yaml.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,MAAM,EAAE,MAAM,GAAG,CAAC;AAO3B,wBAAsB,aAAa,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,iBAwHhG;AACD,wBAAgB,QAAQ,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,UA0BrE;AAED,wBAAgB,aAAa,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,UA2B1E;AAED,wBAAsB,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,mBAyC7D"}
+{"version":3,"file":"yaml.d.ts","sourceRoot":"","sources":["../../../src/lib/assets/yaml.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,MAAM,EAAE,MAAM,GAAG,CAAC;AAO3B,wBAAsB,aAAa,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,iBAwHhG;AACD,wBAAgB,QAAQ,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,UA0BrE;AAED,wBAAgB,aAAa,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,UA2B1E;AAED,wBAAsB,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,eAAe,CAAC,EAAE,MAAM,mBAwCvF"}

package/dist/lib/types.d.ts

@@ -2,6 +2,19 @@ import { GenericClass, GroupVersionKind, KubernetesObject } from "kubernetes-flu
 import { WatchAction } from "kubernetes-fluent-client/dist/fluent/types";
 import { PeprMutateRequest } from "./mutate-request";
 import { PeprValidateRequest } from "./validate-request";
+/**
+ * Specifically for deploying images with a private registry
+ */
+export interface ImagePullSecret {
+    auths: {
+        [server: string]: {
+            username: string;
+            password: string;
+            email: string;
+            auth: string;
+        };
+    };
+}
 /**
  * Specifically for parsing logs in monitor mode
  */

package/dist/lib/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/lib/types.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAC5F,OAAO,EAAE,WAAW,EAAE,MAAM,4CAA4C,CAAC;AAEzE,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAEzD;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE;QACN,OAAO,EAAE,MAAM,CAAC;KACjB,CAAC;CACH;AACD;;GAEG;AACH,MAAM,MAAM,WAAW,CAAC,CAAC,IAAI;KAC1B,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,MAAM,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;CAChE,CAAC;AAEF;;GAEG;AACH,oBAAY,KAAK;IACf,MAAM,WAAW;IACjB,MAAM,WAAW;IACjB,MAAM,WAAW;IACjB,cAAc,mBAAmB;IACjC,GAAG,MAAM;CACV;AAED,MAAM,WAAW,aAAa;IAC5B;;OAEG;IACH,IAAI,EAAE,MAAM,CAAC;IACb;;OAEG;IACH,WAAW,EAAE,MAAM,CAAC;IACpB;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;CACvB;AAED,MAAM,WAAW,gBAAiB,SAAQ,aAAa;IACrD,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,WAAW,EAAE,OAAO,CAAC;CACtB;AAED,MAAM,MAAM,YAAY,CAAC,CAAC,SAAS,YAAY,IAAI;IACjD,0FAA0F;IAC1F,kBAAkB,EAAE,MAAM,UAAU,CAAC,CAAC,CAAC,CAAC;IACxC,+EAA+E;IAC/E,SAAS,EAAE,MAAM,UAAU,CAAC,CAAC,CAAC,CAAC;IAC/B,gFAAgF;IAChF,SAAS,EAAE,MAAM,UAAU,CAAC,CAAC,CAAC,CAAC;IAC/B,+EAA+E;IAC/E,SAAS,EAAE,MAAM,UAAU,CAAC,CAAC,CAAC,CAAC;CAChC,CAAC;AAEF,MAAM,MAAM,OAAO,GAAG;IACpB,KAAK,EAAE,KAAK,CAAC;IACb,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;IAC7B,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;IAChC,QAAQ,CAAC,OAAO,EAAE;QAChB,IAAI,EAAE,MAAM,CAAC;QACb,UAAU,EAAE,MAAM,EAAE,CAAC;QACrB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC/B,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;KACrC,CAAC;IACF,QAAQ,CAAC,cAAc,CAAC,EAAE,YAAY,CAAC,YAAY,EAAE,YAAY,CAAC,YAAY,CAAC,CAAC,CAAC;IACjF,QAAQ,CAAC,gBAAgB,CAAC,EAAE,cAAc,CAAC,YAAY,EAAE,YAAY,CAAC,YAAY,CAAC,CAAC,CAAC;IACrF,QAAQ,CAAC,aAAa,CAAC,EAAE,WAAW,CAAC,YAAY,EAAE,YAAY,CAAC,YAAY,CAAC,CAAC,CAAC;CAChF,CAAC;AAEF,MAAM,MAAM,aAAa,CAAC,CAAC,SAAS,YAAY,IAAI,iBAAiB,CAAC,CAAC,CAAC,GAAG;IACzE;;;;;;;;;;;;;;;;OAgBG;IACH,SAAS,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,KAAK,aAAa,CAAC,CAAC,CAAC,CAAC;IAC7D;;;;;;;;;;;;;;;;OAgBG;IACH,cAAc,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,KAAK,aAAa,CAAC,CAAC,CAAC,CAAC;CACnE,CAAC;AAEF,MAAM,MAAM,eAAe,CAAC,CAAC,SAAS,YAAY,IAAI,aAAa,CAAC,CAAC,CAAC,GAAG;IACvE,6EAA6E;IAC7E,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,aAAa,CAAC,CAAC,CAAC,CAAC;CAC9C,CAAC;AAEF,MAAM,MAAM,UAAU,CAAC,CAAC,SAAS,YAAY,IAAI,eAAe,CAAC,CAAC,CAAC,GAAG;IACpE,kFAAkF;IAClF,WAAW,EAAE,CAAC,GAAG,UAAU,EAAE,MAAM,EAAE,KAAK,eAAe,CAAC,CAAC,CAAC,CAAC;CAC9D,CAAC;AAEF,MAAM,MAAM,iBAAiB,CAAC,CAAC,SAAS,YAAY,IAAI,iBAAiB,CAAC,CAAC,CAAC,GAAG;IAC7E;;;;;;;OAOG;IACH,MAAM,EAAE,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,KAAK,iBAAiB,CAAC,CAAC,CAAC,CAAC;CAC5E,CAAC;AAEF,MAAM,MAAM,mBAAmB,CAAC,CAAC,SAAS,YAAY,IAAI;IACxD;;;;;;;;;;OAUG;IACH,KAAK,EAAE,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC;IAEzD;;;;;;;;;;OAUG;IACH,SAAS,EAAE,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC;CAC9D,CAAC;AAEF,MAAM,MAAM,iBAAiB,CAAC,CAAC,SAAS,YAAY,IAAI,mBAAmB,CAAC,CAAC,CAAC,GAAG;IAC/E;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,QAAQ,EAAE,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,KAAK,mBAAmB,CAAC,CAAC,CAAC,CAAC;CAClF,CAAC;AAEF,MAAM,MAAM,YAAY,CAAC,CAAC,SAAS,YAAY,EAAE,CAAC,SAAS,gBAAgB,GAAG,YAAY,CAAC,CAAC,CAAC,IAAI,CAC/F,GAAG,EAAE,iBAAiB,CAAC,CAAC,CAAC,KACtB,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,GAAG,iBAAiB,CAAC,CAAC,CAAC,CAAC;AAEjF,MAAM,MAAM,cAAc,CAAC,CAAC,SAAS,YAAY,EAAE,CAAC,SAAS,gBAAgB,GAAG,YAAY,CAAC,CAAC,CAAC,IAAI,CACjG,GAAG,EAAE,mBAAmB,CAAC,CAAC,CAAC,KACxB,OAAO,CAAC,sBAAsB,CAAC,GAAG,sBAAsB,CAAC;AAE9D,MAAM,MAAM,sBAAsB,GAAG;IACnC,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/lib/types.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAC5F,OAAO,EAAE,WAAW,EAAE,MAAM,4CAA4C,CAAC;AAEzE,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAEzD;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE;QACL,CAAC,MAAM,EAAE,MAAM,GAAG;YAChB,QAAQ,EAAE,MAAM,CAAC;YACjB,QAAQ,EAAE,MAAM,CAAC;YACjB,KAAK,EAAE,MAAM,CAAC;YACd,IAAI,EAAE,MAAM,CAAC;SACd,CAAC;KACH,CAAC;CACH;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE;QACN,OAAO,EAAE,MAAM,CAAC;KACjB,CAAC;CACH;AACD;;GAEG;AACH,MAAM,MAAM,WAAW,CAAC,CAAC,IAAI;KAC1B,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,MAAM,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;CAChE,CAAC;AAEF;;GAEG;AACH,oBAAY,KAAK;IACf,MAAM,WAAW;IACjB,MAAM,WAAW;IACjB,MAAM,WAAW;IACjB,cAAc,mBAAmB;IACjC,GAAG,MAAM;CACV;AAED,MAAM,WAAW,aAAa;IAC5B;;OAEG;IACH,IAAI,EAAE,MAAM,CAAC;IACb;;OAEG;IACH,WAAW,EAAE,MAAM,CAAC;IACpB;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;CACvB;AAED,MAAM,WAAW,gBAAiB,SAAQ,aAAa;IACrD,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,WAAW,EAAE,OAAO,CAAC;CACtB;AAED,MAAM,MAAM,YAAY,CAAC,CAAC,SAAS,YAAY,IAAI;IACjD,0FAA0F;IAC1F,kBAAkB,EAAE,MAAM,UAAU,CAAC,CAAC,CAAC,CAAC;IACxC,+EAA+E;IAC/E,SAAS,EAAE,MAAM,UAAU,CAAC,CAAC,CAAC,CAAC;IAC/B,gFAAgF;IAChF,SAAS,EAAE,MAAM,UAAU,CAAC,CAAC,CAAC,CAAC;IAC/B,+EAA+E;IAC/E,SAAS,EAAE,MAAM,UAAU,CAAC,CAAC,CAAC,CAAC;CAChC,CAAC;AAEF,MAAM,MAAM,OAAO,GAAG;IACpB,KAAK,EAAE,KAAK,CAAC;IACb,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;IAC7B,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;IAChC,QAAQ,CAAC,OAAO,EAAE;QAChB,IAAI,EAAE,MAAM,CAAC;QACb,UAAU,EAAE,MAAM,EAAE,CAAC;QACrB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC/B,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;KACrC,CAAC;IACF,QAAQ,CAAC,cAAc,CAAC,EAAE,YAAY,CAAC,YAAY,EAAE,YAAY,CAAC,YAAY,CAAC,CAAC,CAAC;IACjF,QAAQ,CAAC,gBAAgB,CAAC,EAAE,cAAc,CAAC,YAAY,EAAE,YAAY,CAAC,YAAY,CAAC,CAAC,CAAC;IACrF,QAAQ,CAAC,aAAa,CAAC,EAAE,WAAW,CAAC,YAAY,EAAE,YAAY,CAAC,YAAY,CAAC,CAAC,CAAC;CAChF,CAAC;AAEF,MAAM,MAAM,aAAa,CAAC,CAAC,SAAS,YAAY,IAAI,iBAAiB,CAAC,CAAC,CAAC,GAAG;IACzE;;;;;;;;;;;;;;;;OAgBG;IACH,SAAS,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,KAAK,aAAa,CAAC,CAAC,CAAC,CAAC;IAC7D;;;;;;;;;;;;;;;;OAgBG;IACH,cAAc,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,KAAK,aAAa,CAAC,CAAC,CAAC,CAAC;CACnE,CAAC;AAEF,MAAM,MAAM,eAAe,CAAC,CAAC,SAAS,YAAY,IAAI,aAAa,CAAC,CAAC,CAAC,GAAG;IACvE,6EAA6E;IAC7E,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,aAAa,CAAC,CAAC,CAAC,CAAC;CAC9C,CAAC;AAEF,MAAM,MAAM,UAAU,CAAC,CAAC,SAAS,YAAY,IAAI,eAAe,CAAC,CAAC,CAAC,GAAG;IACpE,kFAAkF;IAClF,WAAW,EAAE,CAAC,GAAG,UAAU,EAAE,MAAM,EAAE,KAAK,eAAe,CAAC,CAAC,CAAC,CAAC;CAC9D,CAAC;AAEF,MAAM,MAAM,iBAAiB,CAAC,CAAC,SAAS,YAAY,IAAI,iBAAiB,CAAC,CAAC,CAAC,GAAG;IAC7E;;;;;;;OAOG;IACH,MAAM,EAAE,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,KAAK,iBAAiB,CAAC,CAAC,CAAC,CAAC;CAC5E,CAAC;AAEF,MAAM,MAAM,mBAAmB,CAAC,CAAC,SAAS,YAAY,IAAI;IACxD;;;;;;;;;;OAUG;IACH,KAAK,EAAE,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC;IAEzD;;;;;;;;;;OAUG;IACH,SAAS,EAAE,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC;CAC9D,CAAC;AAEF,MAAM,MAAM,iBAAiB,CAAC,CAAC,SAAS,YAAY,IAAI,mBAAmB,CAAC,CAAC,CAAC,GAAG;IAC/E;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,QAAQ,EAAE,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,KAAK,mBAAmB,CAAC,CAAC,CAAC,CAAC;CAClF,CAAC;AAEF,MAAM,MAAM,YAAY,CAAC,CAAC,SAAS,YAAY,EAAE,CAAC,SAAS,gBAAgB,GAAG,YAAY,CAAC,CAAC,CAAC,IAAI,CAC/F,GAAG,EAAE,iBAAiB,CAAC,CAAC,CAAC,KACtB,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,GAAG,iBAAiB,CAAC,CAAC,CAAC,CAAC;AAEjF,MAAM,MAAM,cAAc,CAAC,CAAC,SAAS,YAAY,EAAE,CAAC,SAAS,gBAAgB,GAAG,YAAY,CAAC,CAAC,CAAC,IAAI,CACjG,GAAG,EAAE,mBAAmB,CAAC,CAAC,CAAC,KACxB,OAAO,CAAC,sBAAsB,CAAC,GAAG,sBAAsB,CAAC;AAE9D,MAAM,MAAM,sBAAsB,GAAG;IACnC,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB,CAAC"}

package/package.json

@@ -9,7 +9,7 @@
   "engines": {
     "node": ">=18.0.0"
   },
-  "version": "0.32.3",
+  "version": "0.32.4",
   "main": "dist/lib.js",
   "types": "dist/lib.d.ts",
   "scripts": {
@@ -44,13 +44,15 @@
   "devDependencies": {
     "@commitlint/cli": "19.3.0",
     "@commitlint/config-conventional": "19.2.2",
+    "@fast-check/jest": "^1.8.2",
     "@jest/globals": "29.7.0",
     "@types/eslint": "8.56.10",
     "@types/express": "4.17.21",
     "@types/node": "18.x.x",
     "@types/node-forge": "1.3.11",
     "@types/prompts": "2.4.9",
-    "@types/uuid": "9.0.8",
+    "fast-check": "^3.19.0",
+    "@types/uuid": "10.0.0",
     "jest": "29.7.0",
     "nock": "13.5.4",
     "ts-jest": "29.1.5"

package/src/lib/assets/deploy.ts

@@ -12,8 +12,35 @@ import { deployment, moduleSecret, namespace, watcher } from "./pods";
 import { clusterRole, clusterRoleBinding, serviceAccount, storeRole, storeRoleBinding } from "./rbac";
 import { peprStoreCRD } from "./store";
 import { webhookConfig } from "./webhooks";
-import { CapabilityExport } from "../types";
+import { CapabilityExport, ImagePullSecret } from "../types";
 
+export async function deployImagePullSecret(imagePullSecret: ImagePullSecret, name: string) {
+  try {
+    await K8s(kind.Namespace).Get("pepr-system");
+  } catch {
+    await K8s(kind.Namespace).Apply(namespace());
+  }
+
+  try {
+    await K8s(kind.Secret).Apply(
+      {
+        apiVersion: "v1",
+        kind: "Secret",
+        metadata: {
+          name,
+          namespace: "pepr-system",
+        },
+        type: "kubernetes.io/dockerconfigjson",
+        data: {
+          ".dockerconfigjson": Buffer.from(JSON.stringify(imagePullSecret)).toString("base64"),
+        },
+      },
+      { force: true },
+    );
+  } catch (e) {
+    Log.error(e);
+  }
+}
 export async function deploy(assets: Assets, force: boolean, webhookTimeout?: number) {
   Log.info("Establishing connection to Kubernetes");
 

package/src/lib/assets/index.ts

@@ -61,14 +61,14 @@ export class Assets {
 
   zarfYamlChart = (path: string) => zarfYamlChart(this, path);
 
-  allYaml = async (rbacMode: string) => {
+  allYaml = async (rbacMode: string, imagePullSecret?: string) => {
     this.capabilities = await loadCapabilities(this.path);
     // give error if namespaces are not respected
     for (const capability of this.capabilities) {
       namespaceComplianceValidator(capability, this.alwaysIgnore.namespaces);
     }
 
-    return allYaml(this, rbacMode);
+    return allYaml(this, rbacMode, imagePullSecret);
   };
 
   generateHelmChart = async (basePath: string) => {

package/src/lib/assets/pods.ts

@@ -31,7 +31,7 @@ export function namespace(namespaceLabels?: Record<string, string>) {
   }
 }
 
-export function watcher(assets: Assets, hash: string, buildTimestamp: string) {
+export function watcher(assets: Assets, hash: string, buildTimestamp: string, imagePullSecret?: string) {
   const { name, image, capabilities, config } = assets;
 
   let hasSchedule = false;
@@ -54,7 +54,7 @@ export function watcher(assets: Assets, hash: string, buildTimestamp: string) {
     return null;
   }
 
-  return {
+  const deploy: kind.Deployment = {
     apiVersion: "apps/v1",
     kind: "Deployment",
     metadata: {
@@ -176,13 +176,24 @@ export function watcher(assets: Assets, hash: string, buildTimestamp: string) {
       },
     },
   };
+
+  if (imagePullSecret) {
+    deploy.spec!.template.spec!.imagePullSecrets = [{ name: imagePullSecret }];
+  }
+
+  return deploy;
 }
 
-export function deployment(assets: Assets, hash: string, buildTimestamp: string): kind.Deployment {
+export function deployment(
+  assets: Assets,
+  hash: string,
+  buildTimestamp: string,
+  imagePullSecret?: string,
+): kind.Deployment {
   const { name, image, config } = assets;
   const app = name;
 
-  return {
+  const deploy: kind.Deployment = {
     apiVersion: "apps/v1",
     kind: "Deployment",
     metadata: {
@@ -313,6 +324,12 @@ export function deployment(assets: Assets, hash: string, buildTimestamp: string)
       },
     },
   };
+
+  if (imagePullSecret) {
+    deploy.spec!.template.spec!.imagePullSecrets = [{ name: imagePullSecret }];
+  }
+
+  return deploy;
 }
 
 export function moduleSecret(name: string, data: Buffer, hash: string): kind.Secret {

package/src/lib/assets/yaml.ts

@@ -190,9 +190,8 @@ export function zarfYamlChart({ name, image, config }: Assets, path: string) {
   return dumpYaml(zarfCfg, { noRefs: true });
 }
 
-export async function allYaml(assets: Assets, rbacMode: string) {
+export async function allYaml(assets: Assets, rbacMode: string, imagePullSecret?: string) {
   const { name, tls, apiToken, path } = assets;
-
   const code = await fs.readFile(path);
 
   // Generate a hash of the code
@@ -200,7 +199,7 @@ export async function allYaml(assets: Assets, rbacMode: string) {
 
   const mutateWebhook = await webhookConfig(assets, "mutate", assets.config.webhookTimeout);
   const validateWebhook = await webhookConfig(assets, "validate", assets.config.webhookTimeout);
-  const watchDeployment = watcher(assets, assets.hash, assets.buildTimestamp);
+  const watchDeployment = watcher(assets, assets.hash, assets.buildTimestamp, imagePullSecret);
 
   const resources = [
     namespace(assets.config.customLabels?.namespace),
@@ -209,7 +208,7 @@ export async function allYaml(assets: Assets, rbacMode: string) {
     serviceAccount(name),
     apiTokenSecret(name, apiToken),
     tlsSecret(name, tls),
-    deployment(assets, assets.hash, assets.buildTimestamp),
+    deployment(assets, assets.hash, assets.buildTimestamp, imagePullSecret),
     service(name),
     watcherService(name),
     moduleSecret(name, code, assets.hash),

package/src/lib/types.ts

@@ -7,6 +7,20 @@ import { WatchAction } from "kubernetes-fluent-client/dist/fluent/types";
 import { PeprMutateRequest } from "./mutate-request";
 import { PeprValidateRequest } from "./validate-request";
 
+/**
+ * Specifically for deploying images with a private registry
+ */
+export interface ImagePullSecret {
+  auths: {
+    [server: string]: {
+      username: string;
+      password: string;
+      email: string;
+      auth: string;
+    };
+  };
+}
+
 /**
  * Specifically for parsing logs in monitor mode
  */