insecure registry

internal/config/defaults.go

@@ -103,7 +103,8 @@ func applyRegistryDefaults(r *RegistryConfig, m *MetaConfig) {
 	if r.URL == "" {
 		r.URL = DefaultRegistryURL
 	}
-	if r.PullSecret == "" {
+	// Insecure (in-cluster) registries need no imagePullSecret.
+	if r.PullSecret == "" && !r.Insecure {
 		r.PullSecret = DefaultPullSecret
 	}
 	if r.Repository == "" {

internal/config/types.go

@@ -40,8 +40,13 @@ type MetaConfig struct {
 
 type RegistryConfig struct {
 	URL        string `yaml:"url"`
-	Repository string `yaml:"repository,omitempty"` // default: ${tenant}/${name}
-	PullSecret string `yaml:"pull_secret,omitempty"` // default: regcred
+	Repository string `yaml:"repository,omitempty"`  // default: ${tenant}/${name}
+	PullSecret string `yaml:"pull_secret,omitempty"` // default: regcred; set to "" to disable
+	// Insecure marks the registry as HTTP-only (no TLS). Skips docker login,
+	// omits imagePullSecrets from manifests, and configures buildkitd for
+	// plain-HTTP pushes. Typical for in-cluster registries accessed via
+	// ClusterIP/service DNS rather than an Ingress.
+	Insecure bool `yaml:"insecure,omitempty"`
 }
 
 // ------------------------------------------------------------