kctrl: Add secret flag for package repo add/update

cli/pkg/kctrl/cmd/package/repository/add_or_update.go

@@ -37,6 +37,7 @@ type AddOrUpdateOptions struct {
 	URL                  string
 	SemverTagConstraints string
 	CreateNamespace      bool
+	SecretRef            string
 
 	DryRun bool
 
@@ -78,6 +79,7 @@ func NewAddCmd(o *AddOrUpdateOptions, flagsFactory cmdcore.FlagsFactory) *cobra.
 	// TODO consider how to support other repository types
 	cmd.Flags().StringVar(&o.URL, "url", "", "OCI registry url for package repository bundle (required)")
 	cmd.Flags().StringVar(&o.SemverTagConstraints, "semver-tag-constraints", "", "tag/semver constraint when tag is not present in URL (If both tags and semver are present, then tag gets precedence)")
+	cmd.Flags().StringVar(&o.SecretRef, "secret-ref", "", "SecretRef name for imgpkgbundle, optional")
 	cmd.Flags().BoolVar(&o.DryRun, "dry-run", false, "Print YAML for resources being applied to the cluster without applying them, optional")
 
 	cmd.Flags().BoolVar(&o.CreateNamespace, "create-namespace", false, "Create the package repository namespace if not present (default false)")
@@ -119,6 +121,7 @@ func NewUpdateCmd(o *AddOrUpdateOptions, flagsFactory cmdcore.FlagsFactory) *cob
 
 	cmd.Flags().StringVarP(&o.URL, "url", "", "", "OCI registry url for package repository bundle (required)")
 	cmd.Flags().StringVarP(&o.SemverTagConstraints, "semver-tag-constraints", "", "", "tag/semver constraint when tag is not present in URL (If both tags and semver are present, then tag gets precedence)")
+	cmd.Flags().StringVarP(&o.SecretRef, "secret-ref", "", "", "SecretRef name for imgpkgbundle, optional")
 
 	o.WaitFlags.Set(cmd, flagsFactory, &cmdcore.WaitFlagsOpts{
 		AllowDisableWait: true,
@@ -257,6 +260,10 @@ func (o *AddOrUpdateOptions) updateExistingPackageRepository(pkgr *kcpkg.Package
 		ImgpkgBundle: &kappctrl.AppFetchImgpkgBundle{Image: o.URL},
 	}
 
+	if o.SecretRef != "" {
+		pkgr.Spec.Fetch.ImgpkgBundle.SecretRef = &kappctrl.AppFetchLocalRef{Name: o.SecretRef}
+	}
+
 	ref, err := name.ParseReference(o.URL, name.WeakValidation)
 	if err != nil {
 		return pkgr, fmt.Errorf("Parsing OCI registry URL: %s", err)
@@ -316,6 +323,10 @@ func (o AddOrUpdateOptions) dryRun() error {
 		},
 	}
 
+	if o.SecretRef != "" {
+		packageRepo.Spec.Fetch.ImgpkgBundle.SecretRef = &kappctrl.AppFetchLocalRef{Name: o.SecretRef}
+	}
+
 	ref, err := name.ParseReference(o.URL, name.WeakValidation)
 	if err != nil {
 		return fmt.Errorf("Parsing OCI registry URL: %s", err)

cli/test/e2e/package_repo_dry_run_test.go

@@ -71,3 +71,32 @@ status:
 		require.Contains(t, tagSemverOutput, tagSemverExpectedOutput)
 	})
 }
+
+func TestPackageRepoSecretRefDryRun(t *testing.T) {
+	env := BuildEnv(t)
+	logger := Logger{}
+	kappCtrl := Kctrl{t, env.Namespace, env.KctrlBinaryPath, logger}
+
+	logger.Section("dry-run package repo add", func() {
+		expectedOutput := `apiVersion: packaging.carvel.dev/v1alpha1
+kind: PackageRepository
+metadata:
+  creationTimestamp: null
+  name: test-repo
+  namespace: kctrl-test
+spec:
+  fetch:
+    imgpkgBundle:
+      image: registry.carvel.dev/project/repo:1.0.0
+      secretRef:
+        name: regcred
+status:
+  conditions: null
+  friendlyDescription: ""
+  observedGeneration: 0`
+
+		output := kappCtrl.Run([]string{"package", "repo", "add", "-r", "test-repo", "--url",
+			"registry.carvel.dev/project/repo:1.0.0", "--semver-tag-constraints", "1.0.0", "--secret-ref", "regcred", "--dry-run"})
+		require.Contains(t, output, expectedOutput)
+	})
+}