feat: add imagePullSecrets support for container-based skills

docker/skills-init/Dockerfile

@@ -17,7 +17,7 @@ FROM alpine:3.23
 ARG PYTHON_UID=1001
 ARG PYTHON_GID=1001
 
-RUN apk upgrade --no-cache && apk add --no-cache git
+RUN apk upgrade --no-cache && apk add --no-cache git jq
 COPY --from=krane-builder /build/krane /usr/local/bin/krane
 
 # Run as the same UID/GID as the main agent container (python user) so that

go/api/config/crd/bases/kagent.dev_agents.yaml

@@ -13319,6 +13319,31 @@ spec:
                     maxItems: 20
                     minItems: 1
                     type: array
+                  imagePullSecrets:
+                    description: |-
+                      ImagePullSecrets is a list of references to secrets in the same namespace to use for
+                      pulling skill images from private registries. Each referenced secret must be of type
+                      kubernetes.io/dockerconfigjson. The credentials from all secrets are merged and made
+                      available to the skills-init container at /.kagent/.docker/config.json; krane will
+                      use them automatically when pulling images.
+                    items:
+                      description: |-
+                        LocalObjectReference contains enough information to let you locate the
+                        referenced object inside the same namespace.
+                      properties:
+                        name:
+                          default: ""
+                          description: |-
+                            Name of the referent.
+                            This field is effectively required, but due to backwards compatibility is
+                            allowed to be empty. Instances of this type with an empty value here are
+                            almost certainly wrong.
+                            More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                          type: string
+                      type: object
+                      x-kubernetes-map-type: atomic
+                    maxItems: 20
+                    type: array
                   initContainer:
                     description: Configuration for the skills-init init container.
                     properties:

go/api/config/crd/bases/kagent.dev_sandboxagents.yaml

@@ -10969,6 +10969,31 @@ spec:
                     maxItems: 20
                     minItems: 1
                     type: array
+                  imagePullSecrets:
+                    description: |-
+                      ImagePullSecrets is a list of references to secrets in the same namespace to use for
+                      pulling skill images from private registries. Each referenced secret must be of type
+                      kubernetes.io/dockerconfigjson. The credentials from all secrets are merged and made
+                      available to the skills-init container at /.kagent/.docker/config.json; krane will
+                      use them automatically when pulling images.
+                    items:
+                      description: |-
+                        LocalObjectReference contains enough information to let you locate the
+                        referenced object inside the same namespace.
+                      properties:
+                        name:
+                          default: ""
+                          description: |-
+                            Name of the referent.
+                            This field is effectively required, but due to backwards compatibility is
+                            allowed to be empty. Instances of this type with an empty value here are
+                            almost certainly wrong.
+                            More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                          type: string
+                      type: object
+                      x-kubernetes-map-type: atomic
+                    maxItems: 20
+                    type: array
                   initContainer:
                     description: Configuration for the skills-init init container.
                     properties:

go/api/v1alpha2/agent_types.go

@@ -97,6 +97,15 @@ type SkillForAgent struct {
 	// +optional
 	Refs []string `json:"refs,omitempty"`
 
+	// ImagePullSecrets is a list of references to secrets in the same namespace to use for
+	// pulling skill images from private registries. Each referenced secret must be of type
+	// kubernetes.io/dockerconfigjson. The credentials from all secrets are merged and made
+	// available to the skills-init container at /.kagent/.docker/config.json; krane will
+	// use them automatically when pulling images.
+	// +optional
+	// +kubebuilder:validation:MaxItems=20
+	ImagePullSecrets []corev1.LocalObjectReference `json:"imagePullSecrets,omitempty"`
+
 	// Reference to a Secret containing git credentials.
 	// Applied to all gitRefs entries.
 	// The secret should contain a `token` key for HTTPS auth,

go/core/internal/controller/translator/agent/adk_api_translator.go

@@ -1214,6 +1214,17 @@ var skillsInitScriptTmpl string
 // skillsScriptTemplate is the shell script template for fetching skills from Git and OCI.
 var skillsScriptTemplate = template.Must(template.New("skills-init").Parse(skillsInitScriptTmpl))
 
+// dockerAuthInitData holds the secret names for the docker-auth-init script template.
+type dockerAuthInitData struct {
+	Secrets []string
+}
+
+//go:embed docker-auth-init.sh.tmpl
+var dockerAuthInitScriptTmpl string
+
+// dockerAuthInitTemplate is the shell script template for merging Docker auth credentials.
+var dockerAuthInitTemplate = template.Must(template.New("docker-auth-init").Parse(dockerAuthInitScriptTmpl))
+
 // buildSkillsScript renders the unified skills-init shell script.
 func buildSkillsScript(data skillsInitData) (string, error) {
 	var buf bytes.Buffer
@@ -1324,6 +1335,9 @@ func prepareSkillsInitData(
 // buildSkillsInitContainer creates the unified init container and associated volumes
 // for fetching skills from both Git repositories and OCI registries.
 // If authSecretRef is non-nil a single Secret volume is created and mounted at /git-auth.
+// If imagePullSecrets is non-empty, a docker-auth-init container is prepended that merges
+// all kubernetes.io/dockerconfigjson secrets into /.kagent/.docker/config.json; krane
+// reads the directory via the DOCKER_CONFIG env var and uses those credentials automatically.
 func buildSkillsInitContainer(
 	gitRefs []v1alpha2.GitRepo,
 	authSecretRef *corev1.LocalObjectReference,
@@ -1332,14 +1346,15 @@ func buildSkillsInitContainer(
 	securityContext *corev1.SecurityContext,
 	env []corev1.EnvVar,
 	resources corev1.ResourceRequirements,
-) (container corev1.Container, volumes []corev1.Volume, err error) {
+	imagePullSecrets []corev1.LocalObjectReference,
+) (containers []corev1.Container, volumes []corev1.Volume, err error) {
 	data, err := prepareSkillsInitData(gitRefs, authSecretRef, ociRefs, insecureOCI)
 	if err != nil {
-		return corev1.Container{}, nil, err
+		return nil, nil, err
 	}
 	script, err := buildSkillsScript(data)
 	if err != nil {
-		return corev1.Container{}, nil, err
+		return nil, nil, err
 	}
 	initSecCtx := securityContext
 	if initSecCtx != nil {
@@ -1367,7 +1382,60 @@ func buildSkillsInitContainer(
 		})
 	}
 
-	container = corev1.Container{
+	// If imagePullSecrets are specified, build a docker-auth-init container that merges all
+	// kubernetes.io/dockerconfigjson secrets into a single config.json using jq, then mount
+	// the result into the skills-init container so krane can authenticate to private registries.
+	if len(imagePullSecrets) > 0 {
+		// Shared EmptyDir volume for the merged Docker config.
+		volumes = append(volumes, corev1.Volume{
+			Name: "kagent-docker-config",
+			VolumeSource: corev1.VolumeSource{
+				EmptyDir: &corev1.EmptyDirVolumeSource{},
+			},
+		})
+
+		// Mount each imagePullSecret as a read-only directory under /docker-secrets/<name>.
+		authInitVolumeMounts := []corev1.VolumeMount{
+			{Name: "kagent-docker-config", MountPath: "/docker-config-out"},
+		}
+		for _, secret := range imagePullSecrets {
+			volName := "pull-secret-" + secret.Name
+			volumes = append(volumes, corev1.Volume{
+				Name: volName,
+				VolumeSource: corev1.VolumeSource{
+					Secret: &corev1.SecretVolumeSource{
+						SecretName: secret.Name,
+					},
+				},
+			})
+			authInitVolumeMounts = append(authInitVolumeMounts, corev1.VolumeMount{
+				Name:      volName,
+				MountPath: "/docker-secrets/" + secret.Name,
+				ReadOnly:  true,
+			})
+		}
+
+		mergeScript, err := buildDockerAuthMergeScript(imagePullSecrets)
+		if err != nil {
+			return nil, nil, err
+		}
+		dockerAuthInitContainer := corev1.Container{
+			Name:         "docker-auth-init",
+			Image:        DefaultSkillsInitImageConfig.Image(),
+			Command:      []string{"/bin/sh", "-c", mergeScript},
+			VolumeMounts: authInitVolumeMounts,
+		}
+		containers = append(containers, dockerAuthInitContainer)
+
+		// Mount the merged config into skills-init so krane picks it up via DOCKER_CONFIG.
+		volumeMounts = append(volumeMounts, corev1.VolumeMount{
+			Name:      "kagent-docker-config",
+			MountPath: "/.kagent/.docker",
+			ReadOnly:  true,
+		})
+	}
+
+	skillsInitContainer := corev1.Container{
 		Name:            "skills-init",
 		Image:           DefaultSkillsInitImageConfig.Image(),
 		Command:         []string{"/bin/sh", "-c", script},
@@ -1377,7 +1445,31 @@ func buildSkillsInitContainer(
 		Resources:       resources,
 	}
 
-	return container, volumes, nil
+	// If a merged Docker config is available, point krane to it via DOCKER_CONFIG.
+	if len(imagePullSecrets) > 0 {
+		skillsInitContainer.Env = append(skillsInitContainer.Env, corev1.EnvVar{
+			Name:  "DOCKER_CONFIG",
+			Value: "/.kagent/.docker",
+		})
+	}
+
+	containers = append(containers, skillsInitContainer)
+	return containers, volumes, nil
+}
+
+// buildDockerAuthMergeScript renders the docker-auth-init shell script from the template.
+// It merges the .auths sections from all kubernetes.io/dockerconfigjson secrets
+// (mounted under /docker-secrets/<name>/) into a single config.json using jq.
+func buildDockerAuthMergeScript(imagePullSecrets []corev1.LocalObjectReference) (string, error) {
+	names := make([]string, len(imagePullSecrets))
+	for i, s := range imagePullSecrets {
+		names[i] = s.Name
+	}
+	var buf bytes.Buffer
+	if err := dockerAuthInitTemplate.Execute(&buf, dockerAuthInitData{Secrets: names}); err != nil {
+		return "", fmt.Errorf("failed to render docker-auth-init script: %w", err)
+	}
+	return buf.String(), nil
 }
 
 func (a *adkApiTranslator) runPlugins(ctx context.Context, agent v1alpha2.AgentObject, outputs *AgentOutputs) error {

go/core/internal/controller/translator/agent/docker-auth-init.sh.tmpl

@@ -0,0 +1,9 @@
+set -e
+mkdir -p /docker-config-out
+merged='{"auths":{}}'
+{{- range .Secrets }}
+if [ -f /docker-secrets/{{ . }}/.dockerconfigjson ]; then
+  merged="$(printf '%s\n%s\n' "$merged" "$(cat /docker-secrets/{{ . }}/.dockerconfigjson)" | jq -s '.[0].auths * .[1].auths | {"auths": .}')"
+fi
+{{- end }}
+printf '%s' "$merged" > /docker-config-out/config.json