feat(chart): air-gap-friendly Odoo + Postgres image refs (B.10)

templates/odoo-deployment.yaml

@@ -28,6 +28,14 @@ spec:
         # values.yaml would leave the existing pod alone.
         odoosky.io/addons-hash: {{ .Values.addons | toJson | sha256sum | trunc 16 }}
     spec:
+      {{- with .Values.imageMirror.pullSecret }}
+      # Air-gap support (B.10): when imageMirror.pullSecret is set,
+      # K8s authenticates against the mirror with this Secret to pull
+      # the upstream Odoo image. Default empty = anonymous (Docker
+      # Hub library images need no auth).
+      imagePullSecrets:
+        - name: {{ . }}
+      {{- end }}
       # fsGroup=101 makes the kubelet recursively chown the filestore
       # PVC's root inode to gid=101 on attach. Odoo runs as uid 101
       # and writes /var/lib/odoo/sessions on first request; without
@@ -59,7 +67,7 @@ spec:
         #      and create Odoo's tables. After base is installed,
         #      `-i base` is a no-op so subsequent boots add ~5s.
         - name: db-init
-          image: "{{ .Values.odoo.image }}:{{ .Values.odoo.tag }}"
+          image: "{{ if .Values.imageMirror.registry }}{{ .Values.imageMirror.registry }}/{{ end }}{{ .Values.odoo.image }}:{{ .Values.odoo.tag }}"
           imagePullPolicy: IfNotPresent
           # Override the official Odoo entrypoint so we can run psql
           # before odoo. The image ships with postgresql-client, so
@@ -194,7 +202,7 @@ spec:
         {{- end }}
       containers:
         - name: odoo
-          image: "{{ .Values.odoo.image }}:{{ .Values.odoo.tag }}"
+          image: "{{ if .Values.imageMirror.registry }}{{ .Values.imageMirror.registry }}/{{ end }}{{ .Values.odoo.image }}:{{ .Values.odoo.tag }}"
           imagePullPolicy: IfNotPresent
           # Pin the active database to our tenant code. Without this
           # Odoo runs in multi-DB mode and exposes /web/database/manager;

templates/postgres-statefulset.yaml

@@ -28,9 +28,16 @@ spec:
         {{- include "instance.labels" . | nindent 8 }}
         odoosky.io/role: postgres
     spec:
+      {{- with .Values.imageMirror.pullSecret }}
+      # Air-gap support (B.10) — see odoo-deployment.yaml for the
+      # full rationale. Same imageMirror.pullSecret is used for the
+      # postgres image too so customers configure mirror auth once.
+      imagePullSecrets:
+        - name: {{ . }}
+      {{- end }}
       containers:
         - name: postgres
-          image: "{{ .Values.postgres.image }}:{{ .Values.postgres.tag }}"
+          image: "{{ if .Values.imageMirror.registry }}{{ .Values.imageMirror.registry }}/{{ end }}{{ .Values.postgres.image }}:{{ .Values.postgres.tag }}"
           imagePullPolicy: IfNotPresent
           ports:
             - name: pg