Multiple regcreds for the same registry - fetching image descriptor

[bartekle]

Preflight Checklist

• I have searched the issue tracker for an issue that matches the one I want to file, without success.
• I am not looking for support or already pursued the available support channels without success.
• I agree to follow the Code of Conduct.

Vault Secrets Webhook Version

1.22.2

Installation Type

Official Helm chart

Bank-Vaults Version

No response

Kubernetes Version

1.25.3

Kubernetes Distribution/Provisioner

T-Systems K8S

Expected Behavior

Vault Secrets Webhook (VSW) can iterate over regcred credentials at the same level as kubelet does and can choose valid credentials for fetching image descriptor.

Actual Behavior

VSW chooses first regcred for given registry and uses it for all images from this registry - which is not always the case and breaks mutation for given Pod, even though all images are correctly downloaded by kubelet on the node with set imagePullSecrets.

Steps To Reproduce

1. Create deployment with 2 images with different access credentials from the same registry (with incomplete args/command fields as it is not always convenient, especially for cached public images).
2. imagePullSecrets array have one of the registry credential secrets as first element
3. Observe failed mutation due to inability to fetch image descriptor for the second image (that has credential ref as 2nd element in imagePullSecrets array)

Configuration

Logs

Additional Information

No response