Private OCIRepository with `spec.secretRef` can't be authenticated.

[Stasky745]

What happened?

I have a private OCIRepository using a secret sourced by ExternalSecrets, and that is not getting authenticated even after using --registry-config / DOCKER_CONFIG, which means the every HelmRelease sourced from that registry is not rendered.

My suspicion is on pkg/source/oci/client.go → resolveRegistryConfig. It's documented as:

1. secretRef
2. --registry-config
3. docker default

But in reality it is (1) xor (2, 3):

if repo.SecretRef == nil {
    return f.RegistryConfig, noCleanup, nil   // steps 2 & 3 reachable ONLY here
}

Possible fix

Fall back to f.RegistryConfig on the two failure branches (sec == nil, configJSON == "") rather than erroring. loadCredentials("") already routes to NewStoreFromDocker(), which honors DOCKER_CONFIG, so a mounted dockerconfigjson would work end-to-end.

This might also happen to HelmRepositories, not only OciRepositories.

Steps to reproduce

Create an OCIRepository with secretRef:

# ./cluster/sources.yaml
apiVersion: source.toolkit.fluxcd.io/v1
kind: OCIRepository
metadata: { name: example-chart, namespace: flux-system }
spec:
  interval: 30m
  url: oci://registry.example.com/org/charts/example-chart
  ref: { tag: 1.0.0 }
  secretRef: { name: registry-creds }   # produced by an ExternalSecret in my case

And a HelmRelease with chartRef to it, and:

flate build hr --path ./cluster
# → INFO skipped (missing secret) ... secret flux-system/registry-creds
#      missing .dockerconfigjson (must be type kubernetes.io/dockerconfigjson)
# → the HelmRelease renders nothing

flate build hr --path ./cluster --registry-config /path/to/valid/config.json
# → byte-identical output; the flag is never consulted

Relevant logs or output

flate build hr --path ./cluster
# → INFO skipped (missing secret) ... secret flux-system/registry-creds
#      missing .dockerconfigjson (must be type kubernetes.io/dockerconfigjson)
# → the HelmRelease renders nothing

flate build hr --path ./cluster --registry-config /path/to/valid/config.json
# → byte-identical output; the flag is never consulted

Version

v0.4.12