feat: BYO container registry support

[minmzzhang]

feat: BYO container registry support

Restructure registry configuration to support three deployment states:

• Fresh install: No registry configured (both disabled by default)
• Built-in Quay: quay.enabled=true uses hub/infra/quay/ vault path
• External/BYO: externalRegistry.enabled=true uses hub/infra/registry/ path

Changes:

• Add externalRegistry.enabled flag to supply-chain and qtodo charts
• Separate vault paths for built-in Quay vs external registry
• Templates conditionally select vault path based on enabled flags
• Update supply-chain.md with BYO registry setup instructions
• Add helm template method and oc monitoring commands to supply-chain.md
• Follow VP best practice: external registry secrets in local ~/values-secret.yaml

To enable supply-chain:

1. Uncomment openshift-pipelines namespace and subscription
2. Uncomment supply-chain vault role (JWT auth)
3. Configure registry (BYO or built-in Quay) in application overrides
   • For BYO registry:
     • Set externalRegistry.enabled=true and configure registry settings
     • Add registry credentials to ~/values-secret.yaml
   • For built-in Quay:
     • Enable openshift-storage namespace
     • Enable ODF, NooBaa MCG
     • Enable Quay operator subscription, quay-registry application
4. RHTAS (signing): Enable rhtas-operator subscription and trusted-artifact-signer namespace
5. RHTPA (SBOM): Enable rhtpa-operator subscription, ODF, NooBaa, and trusted-profile-analyzer

feat: unified registry configuration with multi-registry support

Refactor supply-chain and qtodo charts to use a single, option-agnostic
registry configuration instead of separate per-registry blocks.

Registry options (configure one in values-hub.yaml):

• Option 1: Built-in Quay Registry
• Option 2: BYO/External Registry (quay.io, ghcr.io, etc.)
• Option 3: Embedded OCP Image Registry

Key changes:

Supply-chain chart:

• Unified registry.* parameters (domain, org, user, vaultPath, passwordVaultKey)
• Use tpl function to resolve template expressions in registry.domain values
  passed as --set parameters from the validated patterns framework
• Embedded OCP registry automation (registry.embeddedOCP.ensureImageNamespaceRBAC):
  • Auto-create image namespace matching registry.org
  • Grant pipeline SA system:image-builder via RoleBinding
  • Enable default route on OCP image registry via Kubernetes API
    (curl-based Job using ServiceAccount token, no oc CLI dependency)
• ArgoCD hook annotations on the route-enabler Job (Sync + HookSucceeded)
• Rename qtodo-registry-pass to qtodo-quay-pass for clarity

Qtodo chart:

• Unified app.images.main.registry.* parameters
• Use tpl function in registry-external-secret.yaml for domain resolution

ztvp-certificates chart:

• Node-level image pull trust for kubelet (imagePullTrust.*)
• Create ConfigMap with ingress CA per registry hostname in openshift-config
• Patch image.config.openshift.io/cluster additionalTrustedCA
• RBAC for patching image.config.openshift.io resources

Documentation:

• Comprehensive supply-chain.md with configuration steps for all three
  registry options, vault paths, and example overrides
• Updated values-secret.yaml.template with registry credential examples

Signed-off-by: Min Zhang minzhang@redhat.com

[mlorenzofr]

It works with all three options provided.

Perhaps it could have been developed with a more general approach, instead of being case-specific, but that's just my personal opinion.

LGTM