Summary

Add support for cascading registry, pullSecrets, and pullPolicy from global settings to nr-ebpf-agent.

Phase 1: Global.Images.Registry Support ✅

• Updated values.yaml with clarifying comments for all 3 images
• Added kernelHeaderInstaller configuration (previously hardcoded)
• Added helpers to _helpers.tpl for all 3 images
• Updated both daemonset templates to use new image helpers

Phase 2: Global.Images.PullSecrets Support ✅

• Updated both daemonsets (nr-ebpf-agent-daemonset.yaml, otel-collector-daemonset.yaml)
• Both use common library renderPullSecrets helper with concat
• Global and chart-level pullSecrets are concatenated together

Phase 3: Global.Images.PullPolicy Support ✅ (NEW)

• Added pullPolicy helpers to _helpers.tpl for all 3 images
• Updated both daemonsets to use pullPolicy helpers
• Configuration respects hierarchy: global setting → chart-level setting → default (IfNotPresent)

Configuration Hierarchy

For Image Registry:

1. global.images.registry (if set AND repository matches default)
2. Explicit repository configuration (takes precedence)

For ImagePullSecrets:

1. global.images.pullSecrets (highest priority)
2. Chart-level pullSecrets
   Both sources are concatenated to support flexible secret management.

For ImagePullPolicy:

1. global.images.pullPolicy (highest priority)
2. Chart-level image pullPolicy
3. Default: IfNotPresent

Implementation Details

Images covered:

• Kernel header installer init container

• eBPF agent main container

• OpenTelemetry collector container

• If global.images.registry is set AND repository matches default, uses global registry

• If repository is explicitly set to custom value, that takes precedence

• If global registry is not set, defaults to original docker.io paths

• kernel-header-installer is now configurable (was previously hardcoded)

• PullPolicy hierarchy ensures global settings cascade down when no explicit chart configuration is provided

Test Plan

Phase 1 (Registry):

• ✓ Global registry is used when set: my.private.registry.com/newrelic/newrelic-ebpf-agent
• ✓ Defaults to docker.io when global registry not configured
• ✓ Explicit repository configuration overrides global
• ✓ All 3 images respect the same configuration hierarchy

Phase 2 (PullSecrets):

• ✓ No pullSecrets set → No imagePullSecrets section rendered
• ✓ Global pullSecrets only → Uses global across all daemonsets
• ✓ Both global + chart pullSecrets → Uses both (global items first)

Phase 3 (PullPolicy):

• ✓ Global pullPolicy is used when set and no chart-level policy exists
• ✓ Defaults to IfNotPresent when neither global nor chart policy is set
• ✓ Explicit chart-level pullPolicy overrides global setting

Impact

Once merged, users can now configure nr-ebpf-agent with comprehensive global image settings:

```yaml
global:
images:
registry: "my.private.registry.com"
pullSecrets:
- name: my-registry-credentials
pullPolicy: Always
```