helm: honour global.imageRegistry for all chart images (air-gapped installs)

[dudizimber]

Summary

The KubeBlocks Helm chart (deploy/helm) cannot be pointed at a private registry with a single value. It exposes several independent registry keys and does not honour a global.imageRegistry, so an umbrella chart that vendors KubeBlocks has to know and set each one individually.

This matters for air-gapped and mirrored installs, where every image must come from one internal registry.

Current behaviour

Retargeting the chart requires at least three separate overrides:

kubeblocks:
  image:
    registry: my-mirror.example.com/ns          # kubeblocks + kubeblocks-tools
  dataProtection:
    image:
      registry: my-mirror.example.com/ns        # kubeblocks-dataprotection + datasafed
  addonChartsImage:
    registry: my-mirror.example.com/ns

Images in a default render (chart 1.2.0-alpha.1):

docker.io/apecloud/kubeblocks:1.2.0-alpha.1
docker.io/apecloud/kubeblocks-tools:1.2.0-alpha.1
docker.io/apecloud/kubeblocks-dataprotection:1.2.0-alpha.1
docker.io/apecloud/datasafed:0.2.3

Worth calling out: datasafed is not rendered as a container image: field. It is injected into the dataprotection controller as an env var (templates/dataprotection.yaml):

value: "{{ .Values.dataProtection.image.registry | default $dataProtectionImageRegistry }}/{{ .Values.dataProtection.image.datasafed.repository }}:{{ .Values.dataProtection.image.datasafed.tag | default "latest" }}"

so anyone building an image list with helm template | grep image: will miss it and their air-gapped backups will fail at first use, not at install time. A single global key would remove that class of mistake.

Requested change

Honour .Values.global.imageRegistry as a fallback for all four images, following the Bitnami convention already familiar to most chart consumers:

• when global.imageRegistry is set, it replaces the effective registry for every image
• when unset, behaviour is unchanged

The existing per-image registry keys should keep working and, ideally, keep taking precedence when explicitly set.

This is backwards compatible — charts that do not set global.imageRegistry render exactly as they do today.

Context

Found while building air-gap image mirroring for FalkorDB Enterprise, which vendors this chart as a subchart. Of the images in our default install, KubeBlocks is the only remaining component that cannot be retargeted with a single value.

Happy to open a PR if the approach sounds right.

[shanshanying]

Hi @dudizimber

Thanks for raising this.

The current chart supports retargeting all KubeBlocks images through a single value:

image:
  registry: my-mirror.example.com/ns

When dataProtection.image.registry and addonChartsImage.registry are unset, they fall back to image.registry. This covers:

• kubeblocks
• kubeblocks-tools
• kubeblocks-dataprotection
• datasafed
• kubeblocks-charts