[Cameron Childress (cchildress)]

Allow the overrides config map to set the kube-proxy image over the discovered one from kube-system.

Right now we discover the kube-proxy image by copying the image path from the daemonset running in kube-system. If we can't find one we just default to registry.k8s.io.

This would allow an override in the overrides config map to declare a registry for fetching kube-proxy. It's valid to declare just the image path within the registry and we will assume it has all versions of kube-proxy for us to chose from, or you can set a specific version.

[Copilot]

🟡 Changes recommended

Digest validation allows malformed pinned images to reach managed kube-proxy DaemonSets, while conflict detection misses conflicting image overrides supplied through command elements.

2 open issues

• Reject malformed or incorrectly cased image digests · New
• Check command flags for kube-proxy image conflicts · New

What changed in this PR

Adds managed kube-proxy image overrides to the operator’s ConfigMap, allowing private repositories or pinned versions to take precedence over cluster-discovered images.

Changes:

• Integrates images.kubeProxy with override validation, conflict detection, hashing, reporting, and controller arguments.
• Adds shared image-reference parsing and resolves unversioned repositories using the provider image tag or API server version.
• Adds tests, CLI output, documentation, and configuration examples.

File	Description
internal/​operator/​override/​validate.go	Validates image override entries.
internal/​operator/​override/​resolve.go	Checks the target controller container exists.
internal/​operator/​override/​parse.go	Parses image settings with field-based source attribution.
internal/​operator/​override/​merge.go	Applies the image flag after argument overrides.
internal/​operator/​override/​images.go	Implements image entry conversion, conflicts, and flag injection.
internal/​operator/​override/​images_test.go	Tests parsing, validation, merging, conflicts, and hashing.
internal/​operator/​override/​doc.go	Adds image settings to the override schema.
internal/​operator/​override/​compose.go	Includes image settings in conflict detection.
internal/​operator/​kubeproxy_image_override_test.go	Tests rendered deployment integration and scoped withholding.
internal/​net/​controller/​kubeproxy_image.go	Resolves configured, discovered, and fallback images.
internal/​net/​controller/​kubeproxy_image_test.go	Tests image selection and discovery failures.
internal/​net/​config/​kube_proxy_image.go	Adds shared image-reference parsing and flag naming.
internal/​net/​config/​kube_proxy_image_test.go	Tests image-reference parsing and rejection.
internal/​net/​config/​config.go	Documents expanded image-setting behavior.
docs/​net/​configuration.md	Explains repository overrides and precedence.
docs/​content/​reference/​workload-overrides.md	Documents the image override schema and behavior.
docs/​content/​reference/​networking/​configuration.md	Describes image selection and operator integration.
designs/​managed-kube-proxy.md	Records image resolution and restart behavior.
designs/​component-workload-overrides.md	Describes image settings within the override design.
deploy/​unbounded-operator/​examples/​component-overrides.example.yaml	Adds a private kube-proxy repository example.
cmd/​unbounded-net-controller/​main.go	Uses shared image resolution during controller startup.
cmd/​kubectl-unbounded/​app/​overrides_test.go	Tests listing and validating image overrides.
cmd/​kubectl-unbounded/​app/​overrides_list.go	Displays image changes in override listings.

_{Review effort: Balanced}