feat: add global.imageRegistry to prefix all chart images

[alexandrust88]

What

Adds an optional global.imageRegistry value to the chart. When set, it is prepended to every image rendered by the chart:

• server.image — server StatefulSet and the server test pod (templates/server-statefulset.yaml, templates/tests/server-test.yaml)
• injector.image — agent-injector Deployment (templates/injector-deployment.yaml)
• injector.agentImage — the AGENT_INJECT_VAULT_IMAGE value used for injected Vault Agent sidecars (templates/injector-deployment.yaml)
• csi.image — CSI provider DaemonSet (templates/csi-daemonset.yaml)
• csi.agent.image — CSI Vault Agent sidecar (templates/csi-daemonset.yaml)

A new vault.imageRegistry helper in templates/_helpers.tpl performs the prefixing. When global.imageRegistry is empty (the default), image rendering is unchanged — each component's image.repository is used exactly as before — so the change is fully backwards compatible.

Why

When mirroring images to a single private registry (air-gapped or otherwise restricted environments), operators currently have to override each component's image.repository independently and keep all of them in sync. A single global.imageRegistry value lets the entire chart be repointed at one mirror in one place, matching the common pattern used by many other Helm charts.

This is a registry-prefix-only global. It does not reintroduce a shared global.image, so it does not recreate the cross-subchart collision that led to removing global image configuration in #68 / #103: each component keeps its own image.repository, and only the registry host is prefixed.

How it works

The helper returns the registry prefix (with a trailing slash) when the value is set, and an empty string otherwise:

{{- define "vault.imageRegistry" -}}
{{- if .Values.global.imageRegistry -}}
{{- printf "%s/" (.Values.global.imageRegistry | trimSuffix "/") -}}
{{- end -}}
{{- end -}}

Each image line is prefixed with {{ include "vault.imageRegistry" . }}, for example:

image: {{ include "vault.imageRegistry" . }}{{ .Values.server.image.repository }}:{{ .Values.server.image.tag | default "latest" }}

Example

global:
  imageRegistry: registry.example.com

Renders:

Component	Result
server	registry.example.com/hashicorp/vault:2.0.2
injector	registry.example.com/hashicorp/vault-k8s:1.7.4
injector agent (AGENT_INJECT_VAULT_IMAGE)	registry.example.com/hashicorp/vault:2.0.2
csi provider	registry.example.com/hashicorp/vault-csi-provider:1.7.2
csi agent	registry.example.com/hashicorp/vault:2.0.2

Leaving global.imageRegistry unset keeps hashicorp/vault:2.0.2 etc. — identical to current behavior.

Changes

• templates/_helpers.tpl — new vault.imageRegistry helper
• templates/server-statefulset.yaml, templates/tests/server-test.yaml, templates/injector-deployment.yaml, templates/csi-daemonset.yaml — wire the helper into all image references
• values.yaml — document global.imageRegistry (defaults to "")
• values.schema.json — add global.imageRegistry (string)
• test/unit/server-statefulset.bats, test/unit/injector-deployment.bats, test/unit/csi-daemonset.bats — add tests for set and unset behavior
• CHANGELOG.md — add entry under Unreleased

Tests

• Added unit tests asserting the prefixed result when global.imageRegistry is set, and the unchanged default when it is unset, for the server StatefulSet, injector Deployment (both the injector image and the injected agent image), and CSI DaemonSet (provider and agent containers).
• helm lint passes.
• Run locally with:

  bats ./test/unit

Backwards compatibility

No behavior change when global.imageRegistry is unset; rendered output is identical to before. No existing values are renamed or removed.

PCI review checklist

• I have documented a clear reason for, and description of, the change I am making.
• If applicable, I've documented a plan to revert these changes if they require more than reverting the pull request.
• If applicable, I've documented the impact of any changes to security controls.

Revert plan: revert this PR. The change is additive and gated on global.imageRegistry being set. With it unset, rendered manifests are byte-identical to the previous behavior, so no data migration or follow-up cleanup is required.

Impact on security controls: none. No access control methods, authentication, authorization, or logging pipelines are added, removed, or modified. The only effect is an optional registry-host prefix applied to image references, which can additionally help enforce pulling images from an approved internal registry.

[hashicorp-cla-app]

All committers have signed the CLA.