kata-deploy: helm chart does not apply imagePullSecrets to the verification and RBAC cleanup jobs

Author: david-long1Created Sep 19, 2026Updated Sep 19, 2026

The kata-deploy chart renders .Values.imagePullSecrets on the DaemonSet, kata-monitor, the install/cleanup/reconcile Jobs and the per-node Jobs, but not on templates/verification-job.yaml or templates/kata-cleanup-rbac-job.yaml. Those two are the only workloads that pull kubectlImage themselves.

When kubectlImage comes from a private mirror, both Jobs sit in ImagePullBackOff: verification fails on every install and upgrade, and the post-delete hook never removes the kept RBAC.

Repro: helm template kata-deploy ./tools/packaging/kata-deploy/helm-chart/kata-deploy --set 'imagePullSecrets[0].name=regcred' --show-only templates/verification-job.yaml | grep imagePullSecrets prints nothing, while the same command on the daemonset template does.

Source: kata-containers/kata-containers