📖 Document how to configure global pull secrets

docs/css/extra.css

@@ -7,4 +7,19 @@
 .md-nav__item--active > .md-nav__link, /* Active top-level items */
 .md-nav__item--nested > .md-nav__link { /* Nested top-level items */
     font-weight: bold;
-}
+}
+
+.tags-list {
+    list-style: none;
+    padding: 0;
+  }
+
+  .tag {
+    display: inline-block;
+    background-color: red;
+    border-radius: 3px;
+    padding: 2px 8px;
+    margin: 2px;
+    font-size: 0.9em;
+    color: white;
+  }

docs/howto/configure-global-pull-secrets.md

@@ -0,0 +1,53 @@
+---
+tags:
+  - alpha
+---
+
+# Configure global pull secrets for allowing components to pull private images
+
+**Note: The UX for how auth info for using private images is provided is an active work in progress.**  
+
+To configure `catalogd` and `operator-controller` to use authentication information for pulling private images (catalog/bundle images etc), the components can be informed about a kubernetes `Secret` object that contains the relevant auth information. The `Secret` must be of type `kubernetes.io/dockerconfigjson`. 
+
+Once the `Secret` is created, `catalogd` and `operator-controller` needs to be redeployed with an additional field, `--global-pull-secret=<secret-namespace>/<secret-name>` passed to the respective binaries.
+
+For eg, create a `Secret` using locally available `config.json`: 
+
+```sh
+$ kubectl create secret docker-registry test-secret \
+  --from-file=.dockerconfigjson=$HOME/.docker/config.json \
+  --namespace olmv1-system
+secret/test-secret created
+```
+
+Verify that the Secret is created: 
+
+```sh
+$ kubectl get secret test-secret -n olmv1-system -o yaml 
+apiVersion: v1
+data:
+  .dockerconfigjson: ewogICJh....
+kind: Secret
+metadata:
+  creationTimestamp: "2024-10-25T12:05:46Z"
+  name: test-secret
+  namespace: olmv1-system
+  resourceVersion: "237734"
+  uid: 880138f1-5d98-4bb0-9e45-45e8ebaff647
+type: kubernetes.io/dockerconfigjson
+```
+
+Modify the `config/base/manager/manager.yaml` file for `catalogd` and `operator-controller` to include the new field in the binary args: 
+
+```yaml
+ - command:
+        - ./manager
+        args:
+        - ...
+        - ...
+        - ...
+        - --global-pull-secret=olmv1-system/test-secret
+```
+
+With the above configuration, creating a `ClusterCatalog` or a `ClusterExention` whose content is packaged in a private container image hosted in an image registry, will become possible.
+

docs/overrides/main.html

@@ -0,0 +1,14 @@
+{% extends "base.html" %}
+
+{% block content %}
+<div class="tags">
+  {% if page.meta.tags %}
+    <ul class="tags-list">
+      {% for tag in page.meta.tags %}
+        <li class="tag">{{ tag }}</li>
+      {% endfor %}
+    </ul>
+  {% endif %}
+</div>
+{{ super() }}
+{% endblock %}

docs/tutorials/install-extension.md

@@ -14,6 +14,8 @@ After you add a catalog to your cluster, you can install an extension by creatin
 * The name, and optionally version, or channel, of the [supported extension](../project/olmv1_limitations.md) to be installed
 * An existing namespace in which to install the extension
 
+**Note** To install ClusterExentions that are shipped as private container images hosted in an image registry, please see [How to conifgure global pull secrets](../howto/configure-global-pull-secrets.md).
+
 ### ServiceAccount for ClusterExtension Installation and Management
 
 Adhering to OLM v1's "Secure by Default" tenet, OLM v1 does not have the permissions

mkdocs.yml

@@ -4,6 +4,7 @@ site_name: Operator Lifecycle Manager
 theme:
   logo: assets/logo.svg
   name: "material"
+  custom_dir: docs/overrides
   palette:
     primary: black
   features:
@@ -36,6 +37,7 @@ nav:
     - Uninstall an Extension: tutorials/uninstall-extension.md
   - How-To Guides:
     - Catalog queries: howto/catalog-queries.md
+    - Configure Global pull secrets: howto/configure-global-pull-secrets.md
     - Channel-Based Upgrades: howto/how-to-channel-based-upgrades.md
     - Version Pinning: howto/how-to-pin-version.md
     - Version Range Upgrades: howto/how-to-version-range-upgrades.md