feat(registry): add support for overriding image registry in Helm cha… by dadez73 · Pull Request #4261 · tektoncd/operator

dadez73 · 2026-10-13T15:11:38Z

Changes

Add a single registry value to the Helm chart to mirror every image to an internal registry (e.g. for air-gapped clusters), and make TEKTON_REGISTRY_OVERRIDE cover the images it previously missed.

Helm chart

New registry value (host[:port][/path]). It rewrites the registry of the operator's own images (operator, webhook, webhook proxy, pruner tkn) through a new tekton-operator.withRegistry helper.
It also sets TEKTON_REGISTRY_OVERRIDE on the operator containers, so the components the operator installs use the same mirror. A TEKTON_REGISTRY_OVERRIDE entry in operator.additionalEnvs takes precedence.

Operator

overrideImageRegistry now treats the first path component as a registry host only if it contains . or :, or is localhost (the Docker rule). Before this change, bitnami/postgresql lost its bitnami namespace; it now becomes <override>/bitnami/postgresql.
replaceContainersArgsImage only matches flags (args starting with -), skips the value after a matched flag, and ignores flags with no value. A flag's value is no longer read as a flag, and the last arg can no longer cause an out-of-range write.
The legacy pruner CronJob's tkn image (IMAGE_JOB_PRUNER_TKN) now goes through TEKTON_REGISTRY_OVERRIDE as well.

Docs

docs/AirGapImageConfiguration.md: documents the host-detection rule, the *-image* flags and pruner rewriting, and the new Helm registry value.

Tests

New cases in pkg/reconciler/common/transformers_test.go and the fixture testdata/test-replace-image-airgapped.yaml.

Submitter Checklist

These are the criteria that every PR should meet, please check them off as you
review them:

Run make test lint before submitting a PR
Includes tests (if functionality changed/added)
Includes docs (if user facing)
Commit messages follow commit message best practices

See the contribution guide for more details.

Release Notes

Helm chart: new `registry` value that mirrors all images (operator, webhook, proxy, pruner and the installed components through `TEKTON_REGISTRY_OVERRIDE`) to an internal registry.
`TEKTON_REGISTRY_OVERRIDE` now keeps the namespace of images that have no registry host (e.g. `bitnami/postgresql` becomes `<override>/bitnami/postgresql` instead of `<override>/postgresql`). It also applies to the legacy pruner `tkn` image.

linux-foundation-easycla · 2026-10-13T15:11:45Z

The committers listed above are authorized under a signed CLA.

✅ login: dadez73 / name: Davide Doninelli (246366e)

dadez73 · 2026-10-13T15:32:16Z

/easycla

codecov · 2026-10-15T07:38:31Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 30.28%. Comparing base (74f0ad1) to head (459e70e).
⚠️ Report is 48 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #4261      +/-   ##
==========================================
+ Coverage   30.25%   30.28%   +0.03%     
==========================================
  Files         478      478              
  Lines       23169    23179      +10     
==========================================
+ Hits         7010     7020      +10     
  Misses      16159    16159

Flag	Coverage Δ
unit-tests	`30.28% <ø> (+0.03%)`	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

jkhelil · 2026-10-15T07:40:10Z

+{{- include "tekton-operator.withRegistry" (dict "image" (printf "%s:%s" $image $tag) "registry" .Values.registry) -}}
 {{- end -}}

 {{- define "tekton-operator.pruner-image" -}}


for pruner image we shoulndt call withRegistry, otherwise there will be double override (the second is done pruner.go with TEKTON_REGISTRY_OVERRIDE

i missed it... thx!

jkhelil · 2026-10-15T07:41:30Z

 {{- end -}}
 {{- end -}}
-{{- printf "%s:%s" $image $tag -}}
+{{- include "tekton-operator.withRegistry" (dict "image" (printf "%s:%s" $image $tag) "registry" .Values.registry) -}}


same here for proxy webhook, it is already handled via IMAGE_PIPELINES_PROXY and TEKTON_REGISTRY_OVERRIDE
use withRegistry only for operator image (operator base image and webhook)

i missed it... thx!

jkhelil · 2026-10-15T07:51:10Z

@@ -211,14 +211,20 @@ func overrideImageRegistry(registry, imageName string) string {
 		return imageName


You may want to make this fonction idemptotent
if the image already starts with the override prefix, leave it alone. A second pass becomes a no-op.

I added the logic for idempotent function. It helps in cases registry already set i.e. registries that include a path. With TEKTON_REGISTRY_OVERRIDE=myreg.io/mirror, an image that had already been rewritten (myreg.io/mirror/tektoncd/x) was treated as having the host myreg.io, so it became myreg.io/mirror/mirror/tektoncd/x.

jkhelil · 2026-10-21T11:45:51Z

@dadez73 can you squash commits

…rt and components Ensure the image registry override is idempotent and update the documentation accordingly. Signed-off-by: Davide Doninelli <d.doninelli@gmail.com>

jkhelil

/approve

tekton-robot · 2026-11-03T15:18:02Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: jkhelil

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [jkhelil]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

jkhelil

/lgtm

tekton-robot added the release-note Denotes a PR that will be considered when it comes time to generate release notes. label Oct 13, 2026

tekton-robot requested review from anithapriyanatarajan and pramodbindal October 13, 2026 15:11

tekton-robot added the size/L Denotes a PR that changes 100-499 lines, ignoring generated files. label Oct 13, 2026

dadez73 force-pushed the feat/registry-override branch from 2ad25ed to 246366e Compare October 13, 2026 15:24

jkhelil reviewed Oct 15, 2026

View reviewed changes

jkhelil mentioned this pull request Oct 15, 2026

chore(helm): establish Helm chart test and CI infrastructure #4275

Open

feat(registry): add support for overriding image registry in Helm cha…

459e70e

…rt and components Ensure the image registry override is idempotent and update the documentation accordingly. Signed-off-by: Davide Doninelli <d.doninelli@gmail.com>

dadez73 force-pushed the feat/registry-override branch from 1f56ff0 to 459e70e Compare October 21, 2026 12:30

jkhelil reviewed Nov 3, 2026

View reviewed changes

tekton-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Nov 3, 2026

jkhelil reviewed Nov 3, 2026

View reviewed changes

tekton-robot assigned jkhelil Nov 3, 2026

tekton-robot added the lgtm Indicates that a PR is ready to be merged. label Nov 3, 2026

tekton-robot merged commit 4bf6f29 into tektoncd:main Nov 3, 2026
17 of 18 checks passed

		@@ -211,14 +211,20 @@ func overrideImageRegistry(registry, imageName string) string {
		return imageName

Conversation

dadez73 commented Oct 13, 2026

Changes

Submitter Checklist

Release Notes

Uh oh!

linux-foundation-easycla Bot commented Oct 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

dadez73 commented Oct 13, 2026

Uh oh!

codecov Bot commented Oct 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

jkhelil Oct 15, 2026

Choose a reason for hiding this comment

Uh oh!

dadez73 Oct 20, 2026

Choose a reason for hiding this comment

Uh oh!

jkhelil Oct 15, 2026

Choose a reason for hiding this comment

Uh oh!

dadez73 Oct 20, 2026

Choose a reason for hiding this comment

Uh oh!

jkhelil Oct 15, 2026

Choose a reason for hiding this comment

Uh oh!

dadez73 Oct 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

jkhelil commented Oct 21, 2026

Uh oh!

jkhelil left a comment

Choose a reason for hiding this comment

Uh oh!

tekton-robot commented Nov 3, 2026

Uh oh!

jkhelil left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

linux-foundation-easycla Bot commented Oct 13, 2026 •

edited

Loading

codecov Bot commented Oct 15, 2026 •

edited

Loading

dadez73 Oct 20, 2026 •

edited

Loading