fix(kube): Update kube scripts to pull from ghcr

e2e/k8s/scripts/create_secrets.sh

@@ -0,0 +1,56 @@
+#!/usr/bin/env bash
+# Shared helper for creating platform K8s secrets.
+# Sourced by setup_local_minikube_cpu.sh, setup_local_minikube_gpu.sh, and setup_local_kind_cpu.sh.
+
+# create_platform_secrets NAMESPACE [NGC_API_KEY_VALUE]
+#
+# Creates the standard set of platform secrets in the given namespace:
+#   - ngc-api: NGC API key (generic secret)
+#   - nvcrimagepullsecret: NGC container registry pull secret
+#   - ghcr-pull: GHCR pull secret (when GITHUB_TOKEN is set)
+#   - huggingface-token: HF token (when HF_TOKEN is set)
+#
+# The NGC_API_KEY_VALUE argument defaults to $NGC_API_KEY. Pass a placeholder
+# value explicitly for setups that don't require a real key.
+create_platform_secrets() {
+    local namespace="${1:?namespace is required}"
+    local ngc_key="${2:-${NGC_API_KEY:-}}"
+    local kubectl_ns=(kubectl -n "${namespace}")
+
+    if [ -z "${ngc_key}" ]; then
+        log_warn "NGC_API_KEY not set, using placeholder for ngc-api secret"
+        ngc_key="local-dev-placeholder"
+    fi
+
+    log_info "Creating NGC API secret..."
+    "${kubectl_ns[@]}" create secret generic ngc-api \
+      --from-literal=NGC_API_KEY="${ngc_key}" \
+      --dry-run=client -o yaml | "${kubectl_ns[@]}" apply -f -
+
+    log_info "Creating NGC image pull secret..."
+    "${kubectl_ns[@]}" create secret docker-registry nvcrimagepullsecret \
+      --docker-server=nvcr.io \
+      --docker-username='$oauthtoken' \
+      --docker-password="${ngc_key}" \
+      --dry-run=client -o yaml | "${kubectl_ns[@]}" apply -f -
+
+    if [ -n "${GITHUB_TOKEN:-}" ]; then
+        log_info "Creating GHCR image pull secret..."
+        "${kubectl_ns[@]}" create secret docker-registry ghcr-pull \
+          --docker-server=ghcr.io \
+          --docker-username=x-access-token \
+          --docker-password="${GITHUB_TOKEN}" \
+          --dry-run=client -o yaml | "${kubectl_ns[@]}" apply -f -
+    else
+        log_warn "GITHUB_TOKEN not set, skipping GHCR image pull secret"
+    fi
+
+    if [ -n "${HF_TOKEN:-}" ]; then
+        log_info "Creating HuggingFace token secret..."
+        "${kubectl_ns[@]}" create secret generic huggingface-token \
+          --from-literal=HF_TOKEN="${HF_TOKEN}" \
+          --dry-run=client -o yaml | "${kubectl_ns[@]}" apply -f -
+    else
+        log_warn "HF_TOKEN not set, skipping HuggingFace token secret"
+    fi
+}

e2e/k8s/scripts/install_helm_e2e.sh

@@ -239,6 +239,13 @@ if [ -n "${NMP_E2E_PULL_POLICY}" ]; then
     )
 fi
 
+if [ -n "${GITHUB_TOKEN:-}" ]; then
+    HELM_ARGS+=(
+        --set "imagePullSecrets[0].name=ghcr-pull"
+        --set "imagePullSecrets[1].name=nvcrimagepullsecret"
+    )
+fi
+
 log_info "Helm install inputs:"
 printf '  release: %s\n' "${HELM_RELEASE_NAME}"
 printf '  namespace: %s\n' "${NAMESPACE}"

e2e/k8s/scripts/setup_local_kind_cpu.sh

@@ -4,6 +4,9 @@
 
 set -euo pipefail
 
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+source "${SCRIPT_DIR}/create_secrets.sh"
+
 KIND_CLUSTER_NAME="${KIND_CLUSTER_NAME:-nmp-e2e}"
 KIND_NODE_IMAGE="${KIND_NODE_IMAGE:-kindest/node:v1.33.7@sha256:d26ef333bdb2cbe9862a0f7c3803ecc7b4303d8cea8e814b481b09949d353040}"
 KUBE_NAMESPACE="${KUBE_NAMESPACE:-default}"
@@ -93,24 +96,7 @@ fi
 KUBECTL_NS=(kubectl -n "${KUBE_NAMESPACE}")
 
 log_info "Creating Kubernetes secrets in namespace ${KUBE_NAMESPACE}..."
-"${KUBECTL_NS[@]}" create secret generic ngc-api \
-  --from-literal=NGC_API_KEY="${NGC_API_KEY}" \
-  --dry-run=client -o yaml | "${KUBECTL_NS[@]}" apply -f -
-
-"${KUBECTL_NS[@]}" create secret docker-registry nvcrimagepullsecret \
-  --docker-server=nvcr.io \
-  --docker-username="\$oauthtoken" \
-  --docker-password="${NGC_API_KEY}" \
-  --dry-run=client -o yaml | "${KUBECTL_NS[@]}" apply -f -
-
-if [ -n "${HF_TOKEN:-}" ]; then
-    log_info "Creating HuggingFace token secret..."
-    "${KUBECTL_NS[@]}" create secret generic huggingface-token \
-      --from-literal=HF_TOKEN="${HF_TOKEN}" \
-      --dry-run=client -o yaml | "${KUBECTL_NS[@]}" apply -f -
-else
-    log_warn "HF_TOKEN not set, skipping HuggingFace token secret"
-fi
+create_platform_secrets "${KUBE_NAMESPACE}"
 
 log_info "Creating Gateway ${KUBE_NAMESPACE}/${KUBE_GATEWAY_NAME}..."
 kubectl apply -f - <<EOF

e2e/k8s/scripts/setup_local_minikube_cpu.sh

@@ -4,6 +4,9 @@
 
 set -euo pipefail
 
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+source "${SCRIPT_DIR}/create_secrets.sh"
+
 MINIKUBE_PROFILE="${MINIKUBE_PROFILE:-minikube-auth}"
 KUBE_NAMESPACE="${KUBE_NAMESPACE:-default}"
 INGRESS_NODEPORT="${INGRESS_NODEPORT:-30080}"
@@ -90,23 +93,8 @@ fi
 
 KUBECTL_NS=(kubectl -n "${KUBE_NAMESPACE}")
 
-log_info "Creating placeholder platform secrets in namespace ${KUBE_NAMESPACE}..."
-${KUBECTL_NS[@]} create secret generic ngc-api \
-  --from-literal=NGC_API_KEY="${NGC_API_KEY:-local-dev-placeholder}" \
-  --dry-run=client -o yaml | ${KUBECTL_NS[@]} apply -f -
-
-${KUBECTL_NS[@]} create secret docker-registry nvcrimagepullsecret \
-  --docker-server="${NVCI_DOCKER_SERVER:-docker.io}" \
-  --docker-username="${NVCI_DOCKER_USERNAME:-local}" \
-  --docker-password="${NVCI_DOCKER_PASSWORD:-local-dev-placeholder}" \
-  --dry-run=client -o yaml | ${KUBECTL_NS[@]} apply -f -
-
-if [ -n "${HF_TOKEN:-}" ]; then
-    log_info "Creating HuggingFace token secret..."
-    ${KUBECTL_NS[@]} create secret generic huggingface-token \
-      --from-literal=HF_TOKEN="${HF_TOKEN}" \
-      --dry-run=client -o yaml | ${KUBECTL_NS[@]} apply -f -
-fi
+log_info "Creating platform secrets in namespace ${KUBE_NAMESPACE}..."
+create_platform_secrets "${KUBE_NAMESPACE}"
 
 MINIKUBE_IP="$(minikube ip -p "${MINIKUBE_PROFILE}")"
 

e2e/k8s/scripts/setup_local_minikube_gpu.sh

@@ -10,6 +10,9 @@
 
 set -euo pipefail
 
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+source "${SCRIPT_DIR}/create_secrets.sh"
+
 MINIKUBE_PROFILE="${MINIKUBE_PROFILE:-minikube}"
 
 GREEN='\033[0;32m'
@@ -131,27 +134,7 @@ if [ "${KUBE_NAMESPACE}" != "default" ]; then
 fi
 
 log_info "Creating Kubernetes secrets in namespace '${KUBE_NAMESPACE}'..."
-
-log_info "Creating NGC API secret..."
-${KUBECTL_NS} create secret generic ngc-api \
-  --from-literal=NGC_API_KEY="$NGC_API_KEY" \
-  --dry-run=client -o yaml | ${KUBECTL_NS} apply -f -
-
-log_info "Creating NGC image pull secret..."
-${KUBECTL_NS} create secret docker-registry nvcrimagepullsecret \
-  --docker-server=nvcr.io \
-  --docker-username='$oauthtoken' \
-  --docker-password="$NGC_API_KEY" \
-  --dry-run=client -o yaml | ${KUBECTL_NS} apply -f -
-
-if [ -n "${HF_TOKEN:-}" ]; then
-    log_info "Creating HuggingFace token secret..."
-    ${KUBECTL_NS} create secret generic huggingface-token \
-      --from-literal=HF_TOKEN=$HF_TOKEN \
-      --dry-run=client -o yaml | ${KUBECTL_NS} apply -f -
-else
-    log_warn "HF_TOKEN not set, skipping HuggingFace token secret"
-fi
+create_platform_secrets "${KUBE_NAMESPACE}"
 
 MINIKUBE_IP=$(minikube ip -p "${MINIKUBE_PROFILE}")
 CLUSTER_URL="http://${MINIKUBE_IP}"