add support for imagePullSecrets in postgres deployment

helm/kagent/templates/_helpers.tpl

@@ -146,3 +146,16 @@ A2A Base URL - computes the default URL based on the controller service name if
 {{- printf "http://%s-controller.%s.svc.cluster.local:%d" (include "kagent.fullname" .) (include "kagent.namespace" .) (.Values.controller.service.ports.port | int) -}}
 {{- end -}}
 {{- end -}}
+
+{{/*
+imagePullSecrets from global values (for subchart usage).
+Reads .Values.global.imagePullSecrets set by the parent chart.
+*/}}
+{{- define "kagent.imagePullSecrets" -}}
+{{- $global := ((.Values.global).imagePullSecrets) | default list -}}
+{{- if $global -}}
+imagePullSecrets:
+{{- toYaml $global | nindent 2 }}
+{{- end -}}
+{{- end -}}
+

helm/kagent/templates/postgresql.yaml

@@ -48,6 +48,7 @@ spec:
         {{- include "kagent.selectorLabels" . | nindent 8 }}
         app.kubernetes.io/component: database
     spec:
+      {{- include "kagent.imagePullSecrets" $ | nindent 6 }}
       serviceAccountName: {{ $fullname }}
       securityContext:
         fsGroup: 999

helm/kagent/tests/postgresql_test.yaml

@@ -293,3 +293,28 @@ tests:
       - hasDocuments:
           count: 1
 
+  - it: should not render imagePullSecret by default
+    template: postgresql.yaml
+    documentIndex: 2
+    asserts:
+      - isKind:
+          of: Deployment
+      - notExists:
+          path: spec.template.spec.imagePullSecrets
+
+  - it: should render imagePullSecret when available 
+    template: postgresql.yaml
+    documentIndex: 2
+    set:
+      global.imagePullSecrets:
+      - name: secret1
+      - name: secret2
+    asserts:
+      - isKind:
+          of: Deployment
+      - equal:
+          path: spec.template.spec.imagePullSecrets
+          value:
+            - name: secret1
+            - name: secret2
+