Only send the ECR pull secret for images that need it

[r33drichards]

Every Fleet template carried imagePullSecret: ecr-credentials, including for images that are pulled anonymously.

That is not merely redundant. The gateway's admission policy reads the secret's presence as "enforce the private-registry allowlist":

image_configuration_allowed { input.method != "PATCH"; not has_pull_secret }
image_configuration_allowed { input.method != "PATCH"
                              template.imagePullSecret == ecr_pull_secret
                              allowed_image }

So attaching it unconditionally forced every template into the second branch, and any public image outside the allowlist was refused before a pull was ever attempted — with the generic 403 k8s request is not allowed, which gives no hint that the image was the problem.

The fix

Send the secret only for the account's private ECR (*.dkr.ecr.*.amazonaws.com), the one registry it actually authenticates. Public registries — public.ecr.aws, ghcr.io, quay.io, Docker Hub — take the not has_pull_secret branch, as they always should have.

Verification

Against the live gateway, with requests identical but for the image:

image	main	this branch
ghcr.io/trycua/minecraft-workspace:latest (not allowlisted)	403 k8s request is not allowed	admitted
public.ecr.aws/k5j5w0x5/cua-windows-2022 (allowlisted)	admitted	admitted

The allowlisted path is unchanged, so this loosens nothing that was previously enforced for private images — a private ECR ref still carries the secret and still faces the allowlist.

Admission runs before any pull, so the ghcr image did not need to exist for this to be conclusive.

Tests

tests/test_pull_secret.py covers the predicate and, more importantly, the built template for a public image, a public non-ECR registry, and a private ECR ref. Confirmed they fail without the source change (stashing only the source, not the tests).

Why now

This unblocks booting a containerDisk published to GHCR, which is what the upcoming Minecraft guide needs: readers pull a prebuilt workspace image instead of installing Minecraft inside a Fleet instance by hand. It also removes an ECR dependency for anyone publishing their own images.

Co-Authored-By: Claude Opus 5 (1M context) noreply@anthropic.com

🤖 Generated with Claude Code

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!