feat: enable running ZITADEL offline (#1894)

* feat: enable running ZITADEL offline

* refactor: move operator image to common images

* test: remove empty test

operator/database/kinds/backups/backups.go

@@ -24,6 +24,7 @@ func Adapt(
 	tolerations []corev1.Toleration,
 	version string,
 	features []string,
+	customImageRegistry string,
 ) (
 	operator.QueryFunc,
 	operator.DestroyFunc,
@@ -51,6 +52,7 @@ func Adapt(
 			tolerations,
 			version,
 			features,
+			customImageRegistry,
 		)(monitor, desiredTree, currentTree)
 	default:
 		return nil, nil, nil, nil, nil, false, errors.Errorf("unknown database kind %s", desiredTree.Common.Kind)

operator/database/kinds/backups/bucket/adapt.go

@@ -9,6 +9,7 @@ import (
 	"github.com/caos/orbos/pkg/secret/read"
 	"github.com/caos/orbos/pkg/tree"
 	"github.com/caos/zitadel/operator"
+	"github.com/caos/zitadel/operator/common"
 	"github.com/caos/zitadel/operator/database/kinds/backups/bucket/backup"
 	"github.com/caos/zitadel/operator/database/kinds/backups/bucket/clean"
 	"github.com/caos/zitadel/operator/database/kinds/backups/bucket/restore"
@@ -32,6 +33,7 @@ func AdaptFunc(
 	tolerations []corev1.Toleration,
 	version string,
 	features []string,
+	customImageRegistry string,
 ) operator.AdaptFunc {
 	return func(
 		monitor mntr.Monitor,
@@ -66,6 +68,8 @@ func AdaptFunc(
 			return nil, nil, nil, nil, nil, false, err
 		}
 
+		image := common.BackupImage.Reference(customImageRegistry, version)
+
 		_, destroyB, err := backup.AdaptFunc(
 			internalMonitor,
 			name,
@@ -81,7 +85,7 @@ func AdaptFunc(
 			nodeselector,
 			tolerations,
 			features,
-			version,
+			image,
 		)
 		if err != nil {
 			return nil, nil, nil, nil, nil, false, err
@@ -100,7 +104,7 @@ func AdaptFunc(
 			checkDBReady,
 			secretName,
 			secretKey,
-			version,
+			image,
 		)
 		if err != nil {
 			return nil, nil, nil, nil, nil, false, err
@@ -117,7 +121,7 @@ func AdaptFunc(
 			checkDBReady,
 			secretName,
 			secretKey,
-			version,
+			image,
 		)
 		if err != nil {
 			return nil, nil, nil, nil, nil, false, err
@@ -183,7 +187,7 @@ func AdaptFunc(
 					nodeselector,
 					tolerations,
 					features,
-					version,
+					image,
 				)
 				if err != nil {
 					return nil, err
@@ -202,7 +206,7 @@ func AdaptFunc(
 					checkDBReady,
 					secretName,
 					secretKey,
-					version,
+					image,
 				)
 				if err != nil {
 					return nil, err
@@ -219,7 +223,7 @@ func AdaptFunc(
 					checkDBReady,
 					secretName,
 					secretKey,
-					version,
+					image,
 				)
 				if err != nil {
 					return nil, err

operator/database/kinds/backups/bucket/adapt_test.go

@@ -71,6 +71,7 @@ func TestBucket_Secrets(t *testing.T) {
 		tolerations,
 		version,
 		features,
+		"",
 	)(
 		monitor,
 		desired,
@@ -143,6 +144,7 @@ func TestBucket_AdaptBackup(t *testing.T) {
 		tolerations,
 		version,
 		features,
+		"",
 	)(
 		monitor,
 		desired,
@@ -217,6 +219,7 @@ func TestBucket_AdaptInstantBackup(t *testing.T) {
 		tolerations,
 		version,
 		features,
+		"",
 	)(
 		monitor,
 		desired,
@@ -292,6 +295,7 @@ func TestBucket_AdaptRestore(t *testing.T) {
 		tolerations,
 		version,
 		features,
+		"",
 	)(
 		monitor,
 		desired,
@@ -367,6 +371,7 @@ func TestBucket_AdaptClean(t *testing.T) {
 		tolerations,
 		version,
 		features,
+		"",
 	)(
 		monitor,
 		desired,

operator/database/kinds/backups/bucket/backup/adapt.go

@@ -21,7 +21,6 @@ const (
 	backupNameEnv            = "BACKUP_NAME"
 	cronJobNamePrefix        = "backup-"
 	internalSecretName       = "client-certs"
-	image                    = "ghcr.io/caos/zitadel-crbackup"
 	rootSecretName           = "cockroachdb.client.root"
 	timeout                  = 15 * time.Minute
 	Normal                   = "backup"
@@ -43,7 +42,7 @@ func AdaptFunc(
 	nodeselector map[string]string,
 	tolerations []corev1.Toleration,
 	features []string,
-	version string,
+	image string,
 ) (
 	queryFunc operator.QueryFunc,
 	destroyFunc operator.DestroyFunc,
@@ -63,8 +62,8 @@ func AdaptFunc(
 		secretName,
 		secretKey,
 		backupName,
-		version,
 		command,
+		image,
 	)
 
 	destroyers := []operator.DestroyFunc{}

operator/database/kinds/backups/bucket/backup/adapt_test.go

@@ -29,7 +29,7 @@ func TestBackup_AdaptInstantBackup1(t *testing.T) {
 	tolerations := []corev1.Toleration{
 		{Key: "testKey", Operator: "testOp"}}
 	backupName := "testName"
-	version := "testVersion"
+	image := "testImage"
 	secretKey := "testKey"
 	secretName := "testSecretName"
 	jobName := GetJobName(backupName)
@@ -49,13 +49,13 @@ func TestBackup_AdaptInstantBackup1(t *testing.T) {
 			secretName,
 			secretKey,
 			backupName,
-			version,
 			getBackupCommand(
 				timestamp,
 				databases,
 				bucketName,
 				backupName,
 			),
+			image,
 		),
 	)
 
@@ -77,7 +77,7 @@ func TestBackup_AdaptInstantBackup1(t *testing.T) {
 		nodeselector,
 		tolerations,
 		features,
-		version,
+		image,
 	)
 
 	assert.NoError(t, err)
@@ -101,7 +101,7 @@ func TestBackup_AdaptInstantBackup2(t *testing.T) {
 	tolerations := []corev1.Toleration{
 		{Key: "testKey2", Operator: "testOp2"}}
 	backupName := "testName2"
-	version := "testVersion2"
+	image := "testImage2"
 	secretKey := "testKey2"
 	secretName := "testSecretName2"
 	jobName := GetJobName(backupName)
@@ -121,13 +121,13 @@ func TestBackup_AdaptInstantBackup2(t *testing.T) {
 			secretName,
 			secretKey,
 			backupName,
-			version,
 			getBackupCommand(
 				timestamp,
 				databases,
 				bucketName,
 				backupName,
 			),
+			image,
 		),
 	)
 
@@ -149,7 +149,7 @@ func TestBackup_AdaptInstantBackup2(t *testing.T) {
 		nodeselector,
 		tolerations,
 		features,
-		version,
+		image,
 	)
 
 	assert.NoError(t, err)
@@ -173,7 +173,7 @@ func TestBackup_AdaptBackup1(t *testing.T) {
 	tolerations := []corev1.Toleration{
 		{Key: "testKey", Operator: "testOp"}}
 	backupName := "testName"
-	version := "testVersion"
+	image := "testImage"
 	secretKey := "testKey"
 	secretName := "testSecretName"
 	jobName := GetJobName(backupName)
@@ -194,13 +194,13 @@ func TestBackup_AdaptBackup1(t *testing.T) {
 			secretName,
 			secretKey,
 			backupName,
-			version,
 			getBackupCommand(
 				timestamp,
 				databases,
 				bucketName,
 				backupName,
 			),
+			image,
 		),
 	)
 
@@ -221,7 +221,7 @@ func TestBackup_AdaptBackup1(t *testing.T) {
 		nodeselector,
 		tolerations,
 		features,
-		version,
+		image,
 	)
 
 	assert.NoError(t, err)
@@ -245,7 +245,7 @@ func TestBackup_AdaptBackup2(t *testing.T) {
 	tolerations := []corev1.Toleration{
 		{Key: "testKey2", Operator: "testOp2"}}
 	backupName := "testName2"
-	version := "testVersion2"
+	image := "testImage2"
 	secretKey := "testKey2"
 	secretName := "testSecretName2"
 	jobName := GetJobName(backupName)
@@ -266,13 +266,13 @@ func TestBackup_AdaptBackup2(t *testing.T) {
 			secretName,
 			secretKey,
 			backupName,
-			version,
 			getBackupCommand(
 				timestamp,
 				databases,
 				bucketName,
 				backupName,
 			),
+			image,
 		),
 	)
 
@@ -293,7 +293,7 @@ func TestBackup_AdaptBackup2(t *testing.T) {
 		nodeselector,
 		tolerations,
 		features,
-		version,
+		image,
 	)
 
 	assert.NoError(t, err)

operator/database/kinds/backups/bucket/backup/job.go

@@ -52,8 +52,8 @@ func getJobSpecDef(
 	secretName string,
 	secretKey string,
 	backupName string,
-	version string,
 	command string,
+	image string,
 ) batchv1.JobSpec {
 	return batchv1.JobSpec{
 		Template: corev1.PodTemplateSpec{
@@ -63,7 +63,7 @@ func getJobSpecDef(
 				Tolerations:   tolerations,
 				Containers: []corev1.Container{{
 					Name:  backupName,
-					Image: image + ":" + version,
+					Image: image,
 					Command: []string{
 						"/bin/bash",
 						"-c",

operator/database/kinds/backups/bucket/backup/job_test.go

@@ -1,11 +1,12 @@
 package backup
 
 import (
+	"testing"
+
 	"github.com/caos/zitadel/operator/helpers"
 	"github.com/stretchr/testify/assert"
 	batchv1 "k8s.io/api/batch/v1"
 	corev1 "k8s.io/api/core/v1"
-	"testing"
 )
 
 func TestBackup_JobSpec1(t *testing.T) {
@@ -13,10 +14,10 @@ func TestBackup_JobSpec1(t *testing.T) {
 	tolerations := []corev1.Toleration{
 		{Key: "testKey", Operator: "testOp"}}
 	backupName := "testName"
-	version := "testVersion"
 	command := "test"
 	secretKey := "testKey"
 	secretName := "testSecretName"
+	image := "testImage"
 
 	equals := batchv1.JobSpec{
 		Template: corev1.PodTemplateSpec{
@@ -26,7 +27,7 @@ func TestBackup_JobSpec1(t *testing.T) {
 				Tolerations:   tolerations,
 				Containers: []corev1.Container{{
 					Name:  backupName,
-					Image: image + ":" + version,
+					Image: image,
 					Command: []string{
 						"/bin/bash",
 						"-c",
@@ -62,7 +63,7 @@ func TestBackup_JobSpec1(t *testing.T) {
 		},
 	}
 
-	assert.Equal(t, equals, getJobSpecDef(nodeselector, tolerations, secretName, secretKey, backupName, version, command))
+	assert.Equal(t, equals, getJobSpecDef(nodeselector, tolerations, secretName, secretKey, backupName, command, image))
 }
 
 func TestBackup_JobSpec2(t *testing.T) {
@@ -70,10 +71,10 @@ func TestBackup_JobSpec2(t *testing.T) {
 	tolerations := []corev1.Toleration{
 		{Key: "testKey2", Operator: "testOp2"}}
 	backupName := "testName2"
-	version := "testVersion2"
 	command := "test2"
 	secretKey := "testKey2"
 	secretName := "testSecretName2"
+	image := "testImage2"
 
 	equals := batchv1.JobSpec{
 		Template: corev1.PodTemplateSpec{
@@ -83,7 +84,7 @@ func TestBackup_JobSpec2(t *testing.T) {
 				Tolerations:   tolerations,
 				Containers: []corev1.Container{{
 					Name:  backupName,
-					Image: image + ":" + version,
+					Image: image,
 					Command: []string{
 						"/bin/bash",
 						"-c",
@@ -119,5 +120,5 @@ func TestBackup_JobSpec2(t *testing.T) {
 		},
 	}
 
-	assert.Equal(t, equals, getJobSpecDef(nodeselector, tolerations, secretName, secretKey, backupName, version, command))
+	assert.Equal(t, equals, getJobSpecDef(nodeselector, tolerations, secretName, secretKey, backupName, command, image))
 }

operator/database/kinds/backups/bucket/clean/adapt.go

@@ -18,7 +18,6 @@ const (
 	certPath           = "/cockroach/cockroach-certs"
 	secretPath         = "/secrets/sa.json"
 	internalSecretName = "client-certs"
-	image              = "ghcr.io/caos/zitadel-crbackup"
 	rootSecretName     = "cockroachdb.client.root"
 	jobPrefix          = "backup-"
 	jobSuffix          = "-clean"
@@ -36,7 +35,7 @@ func AdaptFunc(
 	checkDBReady operator.EnsureFunc,
 	secretName string,
 	secretKey string,
-	version string,
+	image string,
 ) (
 	queryFunc operator.QueryFunc,
 	destroyFunc operator.DestroyFunc,
@@ -52,8 +51,9 @@ func AdaptFunc(
 		tolerations,
 		secretName,
 		secretKey,
-		version,
-		command)
+		command,
+		image,
+	)
 
 	destroyJ, err := job.AdaptFuncToDestroy(jobDef.Namespace, jobDef.Name)
 	if err != nil {

operator/database/kinds/backups/bucket/clean/adapt_test.go

@@ -24,7 +24,7 @@ func TestBackup_Adapt1(t *testing.T) {
 	tolerations := []corev1.Toleration{
 		{Key: "testKey", Operator: "testOp"}}
 	backupName := "testName"
-	version := "testVersion"
+	image := "testImage"
 	secretKey := "testKey"
 	secretName := "testSecretName"
 	jobName := GetJobName(backupName)
@@ -42,10 +42,10 @@ func TestBackup_Adapt1(t *testing.T) {
 		tolerations,
 		secretName,
 		secretKey,
-		version,
 		getCommand(
 			databases,
 		),
+		image,
 	)
 
 	client.EXPECT().ApplyJob(jobDef).Times(1).Return(nil)
@@ -62,7 +62,7 @@ func TestBackup_Adapt1(t *testing.T) {
 		checkDBReady,
 		secretName,
 		secretKey,
-		version,
+		image,
 	)
 
 	assert.NoError(t, err)
@@ -82,7 +82,7 @@ func TestBackup_Adapt2(t *testing.T) {
 	tolerations := []corev1.Toleration{
 		{Key: "testKey2", Operator: "testOp2"}}
 	backupName := "testName2"
-	version := "testVersion2"
+	image := "testImage2"
 	secretKey := "testKey2"
 	secretName := "testSecretName2"
 	jobName := GetJobName(backupName)
@@ -100,10 +100,10 @@ func TestBackup_Adapt2(t *testing.T) {
 		tolerations,
 		secretName,
 		secretKey,
-		version,
 		getCommand(
 			databases,
 		),
+		image,
 	)
 
 	client.EXPECT().ApplyJob(jobDef).Times(1).Return(nil)
@@ -120,7 +120,7 @@ func TestBackup_Adapt2(t *testing.T) {
 		checkDBReady,
 		secretName,
 		secretKey,
-		version,
+		image,
 	)
 
 	assert.NoError(t, err)

operator/database/kinds/backups/bucket/clean/job.go

@@ -15,8 +15,8 @@ func getJob(
 	tolerations []corev1.Toleration,
 	secretName string,
 	secretKey string,
-	version string,
 	command string,
+	image string,
 ) *batchv1.Job {
 
 	return &batchv1.Job{
@@ -33,7 +33,7 @@ func getJob(
 					RestartPolicy: corev1.RestartPolicyNever,
 					Containers: []corev1.Container{{
 						Name:  nameLabels.Name(),
-						Image: image + ":" + version,
+						Image: image,
 						Command: []string{
 							"/bin/bash",
 							"-c",

operator/database/kinds/backups/bucket/clean/job_test.go

@@ -1,25 +1,26 @@
 package clean
 
 import (
+	"testing"
+
 	"github.com/caos/orbos/pkg/labels"
 	"github.com/caos/zitadel/operator/helpers"
 	"github.com/stretchr/testify/assert"
 	batchv1 "k8s.io/api/batch/v1"
 	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"testing"
 )
 
 func TestBackup_Job1(t *testing.T) {
 	nodeselector := map[string]string{"test": "test"}
 	tolerations := []corev1.Toleration{
 		{Key: "testKey", Operator: "testOp"}}
-	version := "testVersion"
 	command := "test"
 	secretKey := "testKey"
 	secretName := "testSecretName"
 	jobName := "testJob"
 	namespace := "testNs"
+	image := "testImage"
 
 	k8sLabels := map[string]string{
 		"app.kubernetes.io/component":  "testComponent",
@@ -47,7 +48,7 @@ func TestBackup_Job1(t *testing.T) {
 						Tolerations:   tolerations,
 						Containers: []corev1.Container{{
 							Name:  jobName,
-							Image: image + ":" + version,
+							Image: image,
 							Command: []string{
 								"/bin/bash",
 								"-c",
@@ -84,19 +85,19 @@ func TestBackup_Job1(t *testing.T) {
 			},
 		}
 
-	assert.Equal(t, equals, getJob(namespace, nameLabels, nodeselector, tolerations, secretName, secretKey, version, command))
+	assert.Equal(t, equals, getJob(namespace, nameLabels, nodeselector, tolerations, secretName, secretKey, command, image))
 }
 
 func TestBackup_Job2(t *testing.T) {
 	nodeselector := map[string]string{"test2": "test2"}
 	tolerations := []corev1.Toleration{
 		{Key: "testKey2", Operator: "testOp2"}}
-	version := "testVersion2"
 	command := "test2"
 	secretKey := "testKey2"
 	secretName := "testSecretName2"
 	jobName := "testJob2"
 	namespace := "testNs2"
+	image := "testImage2"
 	k8sLabels := map[string]string{
 		"app.kubernetes.io/component":  "testComponent2",
 		"app.kubernetes.io/managed-by": "testOp2",
@@ -123,7 +124,7 @@ func TestBackup_Job2(t *testing.T) {
 						Tolerations:   tolerations,
 						Containers: []corev1.Container{{
 							Name:  jobName,
-							Image: image + ":" + version,
+							Image: image,
 							Command: []string{
 								"/bin/bash",
 								"-c",
@@ -160,5 +161,5 @@ func TestBackup_Job2(t *testing.T) {
 			},
 		}
 
-	assert.Equal(t, equals, getJob(namespace, nameLabels, nodeselector, tolerations, secretName, secretKey, version, command))
+	assert.Equal(t, equals, getJob(namespace, nameLabels, nodeselector, tolerations, secretName, secretKey, command, image))
 }

operator/database/kinds/backups/bucket/restore/adapt.go

@@ -19,7 +19,6 @@ const (
 	secretPath         = "/secrets/sa.json"
 	jobPrefix          = "backup-"
 	jobSuffix          = "-restore"
-	image              = "ghcr.io/caos/zitadel-crbackup"
 	internalSecretName = "client-certs"
 	rootSecretName     = "cockroachdb.client.root"
 	timeout            = 15 * time.Minute
@@ -38,7 +37,7 @@ func AdaptFunc(
 	checkDBReady operator.EnsureFunc,
 	secretName string,
 	secretKey string,
-	version string,
+	image string,
 ) (
 	queryFunc operator.QueryFunc,
 	destroyFunc operator.DestroyFunc,
@@ -60,8 +59,8 @@ func AdaptFunc(
 		tolerations,
 		secretName,
 		secretKey,
-		version,
-		command)
+		command,
+		image)
 
 	destroyJ, err := job.AdaptFuncToDestroy(jobName, namespace)
 	if err != nil {

operator/database/kinds/backups/bucket/restore/adapt_test.go

@@ -26,7 +26,7 @@ func TestBackup_Adapt1(t *testing.T) {
 	timestamp := "testTs"
 	backupName := "testName2"
 	bucketName := "testBucket2"
-	version := "testVersion"
+	image := "testImage2"
 	secretKey := "testKey"
 	secretName := "testSecretName"
 	jobName := GetJobName(backupName)
@@ -44,13 +44,13 @@ func TestBackup_Adapt1(t *testing.T) {
 		tolerations,
 		secretName,
 		secretKey,
-		version,
 		getCommand(
 			timestamp,
 			databases,
 			bucketName,
 			backupName,
 		),
+		image,
 	)
 
 	client.EXPECT().ApplyJob(jobDef).Times(1).Return(nil)
@@ -69,7 +69,7 @@ func TestBackup_Adapt1(t *testing.T) {
 		checkDBReady,
 		secretName,
 		secretKey,
-		version,
+		image,
 	)
 
 	assert.NoError(t, err)
@@ -91,7 +91,7 @@ func TestBackup_Adapt2(t *testing.T) {
 	timestamp := "testTs"
 	backupName := "testName2"
 	bucketName := "testBucket2"
-	version := "testVersion2"
+	image := "testImage2"
 	secretKey := "testKey2"
 	secretName := "testSecretName2"
 	jobName := GetJobName(backupName)
@@ -109,13 +109,13 @@ func TestBackup_Adapt2(t *testing.T) {
 		tolerations,
 		secretName,
 		secretKey,
-		version,
 		getCommand(
 			timestamp,
 			databases,
 			bucketName,
 			backupName,
 		),
+		image,
 	)
 
 	client.EXPECT().ApplyJob(jobDef).Times(1).Return(nil)
@@ -134,7 +134,7 @@ func TestBackup_Adapt2(t *testing.T) {
 		checkDBReady,
 		secretName,
 		secretKey,
-		version,
+		image,
 	)
 
 	assert.NoError(t, err)

operator/database/kinds/backups/bucket/restore/job.go

@@ -15,9 +15,8 @@ func getJob(
 	tolerations []corev1.Toleration,
 	secretName string,
 	secretKey string,
-	version string,
 	command string,
-
+	image string,
 ) *batchv1.Job {
 	return &batchv1.Job{
 		ObjectMeta: v1.ObjectMeta{
@@ -33,7 +32,7 @@ func getJob(
 					RestartPolicy: corev1.RestartPolicyNever,
 					Containers: []corev1.Container{{
 						Name:  nameLabels.Name(),
-						Image: image + ":" + version,
+						Image: image,
 						Command: []string{
 							"/bin/bash",
 							"-c",

operator/database/kinds/backups/bucket/restore/job_test.go

@@ -1,25 +1,26 @@
 package restore
 
 import (
+	"testing"
+
 	"github.com/caos/orbos/pkg/labels"
 	"github.com/caos/zitadel/operator/helpers"
 	"github.com/stretchr/testify/assert"
 	batchv1 "k8s.io/api/batch/v1"
 	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"testing"
 )
 
 func TestBackup_Job1(t *testing.T) {
 	nodeselector := map[string]string{"test": "test"}
 	tolerations := []corev1.Toleration{
 		{Key: "testKey", Operator: "testOp"}}
-	version := "testVersion"
 	command := "test"
 	secretKey := "testKey"
 	secretName := "testSecretName"
 	jobName := "testJob"
 	namespace := "testNs"
+	image := "testImage"
 	k8sLabels := map[string]string{
 		"app.kubernetes.io/component":  "testComponent",
 		"app.kubernetes.io/managed-by": "testOp",
@@ -46,7 +47,7 @@ func TestBackup_Job1(t *testing.T) {
 						Tolerations:   tolerations,
 						Containers: []corev1.Container{{
 							Name:  jobName,
-							Image: image + ":" + version,
+							Image: image,
 							Command: []string{
 								"/bin/bash",
 								"-c",
@@ -83,19 +84,19 @@ func TestBackup_Job1(t *testing.T) {
 			},
 		}
 
-	assert.Equal(t, equals, getJob(namespace, nameLabels, nodeselector, tolerations, secretName, secretKey, version, command))
+	assert.Equal(t, equals, getJob(namespace, nameLabels, nodeselector, tolerations, secretName, secretKey, command, image))
 }
 
 func TestBackup_Job2(t *testing.T) {
 	nodeselector := map[string]string{"test2": "test2"}
 	tolerations := []corev1.Toleration{
 		{Key: "testKey2", Operator: "testOp2"}}
-	version := "testVersion2"
 	command := "test2"
 	secretKey := "testKey2"
 	secretName := "testSecretName2"
 	jobName := "testJob2"
 	namespace := "testNs2"
+	testImage := "testImage2"
 	k8sLabels := map[string]string{
 		"app.kubernetes.io/component":  "testComponent2",
 		"app.kubernetes.io/managed-by": "testOp2",
@@ -122,7 +123,7 @@ func TestBackup_Job2(t *testing.T) {
 						Tolerations:   tolerations,
 						Containers: []corev1.Container{{
 							Name:  jobName,
-							Image: image + ":" + version,
+							Image: testImage,
 							Command: []string{
 								"/bin/bash",
 								"-c",
@@ -159,5 +160,5 @@ func TestBackup_Job2(t *testing.T) {
 			},
 		}
 
-	assert.Equal(t, equals, getJob(namespace, nameLabels, nodeselector, tolerations, secretName, secretKey, version, command))
+	assert.Equal(t, equals, getJob(namespace, nameLabels, nodeselector, tolerations, secretName, secretKey, command, testImage))
 }

operator/database/kinds/databases/databases.go

@@ -31,6 +31,7 @@ func Adapt(
 	tolerations []core.Toleration,
 	version string,
 	features []string,
+	customImageRegistry string,
 ) (
 	query operator.QueryFunc,
 	destroy operator.DestroyFunc,
@@ -45,7 +46,16 @@ func Adapt(
 
 	switch desiredTree.Common.Kind {
 	case "databases.caos.ch/CockroachDB":
-		return managed.Adapter(componentLabels, namespace, timestamp, nodeselector, tolerations, version, features)(internalMonitor, desiredTree, currentTree)
+		return managed.Adapter(
+			componentLabels,
+			namespace,
+			timestamp,
+			nodeselector,
+			tolerations,
+			version,
+			features,
+			customImageRegistry,
+		)(internalMonitor, desiredTree, currentTree)
 	case "databases.caos.ch/ProvidedDatabase":
 		return provided.Adapter()(internalMonitor, desiredTree, currentTree)
 	default:

operator/database/kinds/databases/managed/adapt.go

@@ -4,6 +4,8 @@ import (
 	"strconv"
 	"strings"
 
+	"github.com/caos/zitadel/operator/common"
+
 	"github.com/caos/zitadel/operator"
 
 	"github.com/caos/orbos/pkg/labels"
@@ -44,6 +46,7 @@ func Adapter(
 	tolerations []corev1.Toleration,
 	version string,
 	features []string,
+	customImageRegistry string,
 ) operator.AdaptFunc {
 
 	return func(
@@ -114,7 +117,7 @@ func Adapter(
 			cockroachSelector,
 			desiredKind.Spec.Force,
 			namespace,
-			image,
+			common.CockroachImage.Reference(customImageRegistry),
 			serviceAccountName,
 			desiredKind.Spec.ReplicaCount,
 			desiredKind.Spec.StorageCapacity,
@@ -219,6 +222,7 @@ func Adapter(
 						tolerations,
 						version,
 						features,
+						customImageRegistry,
 					)
 					if err != nil {
 						return nil, nil, nil, nil, nil, false, err

operator/database/kinds/databases/managed/adapt_backup_test.go

@@ -84,7 +84,7 @@ func TestManaged_AdaptBucketBackup(t *testing.T) {
 	bucket.SetBackup(k8sClient, namespace, labels, saJson)
 	k8sClient.EXPECT().WaitUntilStatefulsetIsReady(namespace, SfsName, true, true, 60*time.Second)
 
-	query, _, _, _, _, _, err := Adapter(componentLabels, namespace, timestamp, nodeselector, tolerations, version, features)(monitor, desired, &tree.Tree{})
+	query, _, _, _, _, _, err := Adapter(componentLabels, namespace, timestamp, nodeselector, tolerations, version, features, "")(monitor, desired, &tree.Tree{})
 	assert.NoError(t, err)
 
 	databases := []string{"test1", "test2"}
@@ -124,7 +124,7 @@ func TestManaged_AdaptBucketInstantBackup(t *testing.T) {
 
 	desired := getTreeWithDBAndBackup(t, masterkey, saJson, backupName)
 
-	query, _, _, _, _, _, err := Adapter(componentLabels, namespace, timestamp, nodeselector, tolerations, version, features)(monitor, desired, &tree.Tree{})
+	query, _, _, _, _, _, err := Adapter(componentLabels, namespace, timestamp, nodeselector, tolerations, version, features, "")(monitor, desired, &tree.Tree{})
 	assert.NoError(t, err)
 
 	databases := []string{"test1", "test2"}
@@ -165,7 +165,7 @@ func TestManaged_AdaptBucketCleanAndRestore(t *testing.T) {
 
 	desired := getTreeWithDBAndBackup(t, masterkey, saJson, backupName)
 
-	query, _, _, _, _, _, err := Adapter(componentLabels, namespace, timestamp, nodeselector, tolerations, version, features)(monitor, desired, &tree.Tree{})
+	query, _, _, _, _, _, err := Adapter(componentLabels, namespace, timestamp, nodeselector, tolerations, version, features, "")(monitor, desired, &tree.Tree{})
 	assert.NoError(t, err)
 
 	databases := []string{"test1", "test2"}

operator/database/kinds/databases/managed/adapt_test.go

@@ -133,7 +133,16 @@ func TestManaged_Adapt1(t *testing.T) {
 	dbCurrent.EXPECT().SetCertificateKey(gomock.Any()).MinTimes(1).MaxTimes(1)
 	k8sClient.EXPECT().ApplySecret(gomock.Any()).MinTimes(1).MaxTimes(1)
 
-	query, _, _, _, _, _, err := Adapter(componentLabels, namespace, timestamp, nodeselector, tolerations, version, features)(monitor, desired, &tree.Tree{})
+	query, _, _, _, _, _, err := Adapter(
+		componentLabels,
+		namespace,
+		timestamp,
+		nodeselector,
+		tolerations,
+		version,
+		features,
+		"",
+	)(monitor, desired, &tree.Tree{})
 	assert.NoError(t, err)
 
 	ensure, err := query(k8sClient, queried)
@@ -245,7 +254,16 @@ func TestManaged_Adapt2(t *testing.T) {
 	dbCurrent.EXPECT().SetCertificateKey(gomock.Any()).MinTimes(1).MaxTimes(1)
 	k8sClient.EXPECT().ApplySecret(gomock.Any()).MinTimes(1).MaxTimes(1)
 
-	query, _, _, _, _, _, err := Adapter(componentLabels, namespace, timestamp, nodeselector, tolerations, version, features)(monitor, desired, &tree.Tree{})
+	query, _, _, _, _, _, err := Adapter(
+		componentLabels,
+		namespace,
+		timestamp,
+		nodeselector,
+		tolerations,
+		version,
+		features,
+		"",
+	)(monitor, desired, &tree.Tree{})
 	assert.NoError(t, err)
 
 	ensure, err := query(k8sClient, queried)

operator/database/kinds/orb/adapt.go

@@ -85,6 +85,7 @@ func AdaptFunc(
 			desiredKind.Spec.Tolerations,
 			desiredKind.Spec.Version,
 			features,
+			desiredKind.Spec.CustomImageRegistry,
 		)
 		if err != nil {
 			return nil, nil, nil, nil, nil, migrate, err

operator/database/kinds/orb/desired.go

@@ -19,8 +19,8 @@ type Spec struct {
 	Tolerations     []corev1.Toleration `json:"tolerations,omitempty" yaml:"tolerations,omitempty"`
 	Version         string              `json:"version,omitempty" yaml:"version,omitempty"`
 	SelfReconciling bool                `json:"selfReconciling" yaml:"selfReconciling"`
-	//Use this registry to pull the Database operator image from
-	//@default: ghcr.io
+	//Use this registry to pull container images from
+	//@default: <multiple public registries>
 	CustomImageRegistry string `json:"customImageRegistry,omitempty" yaml:"customImageRegistry,omitempty"`
 }
 

operator/database/kinds/orb/reconcile.go

@@ -24,11 +24,6 @@ func Reconcile(
 			return err
 		}
 
-		imageRegistry := spec.CustomImageRegistry
-		if imageRegistry == "" {
-			imageRegistry = "ghcr.io"
-		}
-
 		if spec.SelfReconciling {
 			desiredTree := &tree.Tree{
 				Common: &tree.Common{
@@ -37,7 +32,7 @@ func Reconcile(
 				},
 			}
 
-			if err := zitadelKubernetes.EnsureDatabaseArtifacts(monitor, treelabels.MustForAPI(desiredTree, mustDatabaseOperator(&spec.Version)), k8sClient, spec.Version, spec.NodeSelector, spec.Tolerations, imageRegistry, gitops); err != nil {
+			if err := zitadelKubernetes.EnsureDatabaseArtifacts(monitor, treelabels.MustForAPI(desiredTree, mustDatabaseOperator(&spec.Version)), k8sClient, spec.Version, spec.NodeSelector, spec.Tolerations, spec.CustomImageRegistry, gitops); err != nil {
 				recMonitor.Error(errors.Wrap(err, "Failed to deploy database-operator into k8s-cluster"))
 				return err
 			}