From 2e0bf2d7429076079f75abf687e07a38cdd761ba Mon Sep 17 00:00:00 2001
From: Alice Frosi <afrosi@redhat.com>
Date: Thu, 22 Oct 2026 09:38:39 +0000
Subject: [PATCH 1/2] Require E2E_NODE_IMAGE_UPDATE2_REF for EKS

Assisted-by: AI
Signed-off-by: Alice Frosi <afrosi@redhat.com>
---
 test/e2e/e2eutil/env.go | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/test/e2e/e2eutil/env.go b/test/e2e/e2eutil/env.go
index e7dfdf08..c93a9437 100644
--- a/test/e2e/e2eutil/env.go
+++ b/test/e2e/e2eutil/env.go
@@ -138,7 +138,7 @@ func New(t *testing.T) *Env {
 	case "eks":
 		nodeImageRef = requireEnv(t, "E2E_NODE_IMAGE_REF")
 		updateRef = requireEnv(t, "E2E_NODE_IMAGE_UPDATE_REF")
-		update2Ref = os.Getenv("E2E_NODE_IMAGE_UPDATE2_REF")
+		update2Ref = requireEnv(t, "E2E_NODE_IMAGE_UPDATE2_REF")
 		registryHost = os.Getenv("E2E_REGISTRY_HOST")
 		if registryHost == "" {
 			registryHost = extractRegistryHost(updateRef)

From 9e0b5b11fad052f3fc9aedf5423bbe33884e0f16 Mon Sep 17 00:00:00 2001
From: Alice Frosi <afrosi@redhat.com>
Date: Thu, 22 Oct 2026 09:38:47 +0000
Subject: [PATCH 2/2] Support pre-built pull secret via E2E_NODE_PULL_SECRET

This is helpful for the EKS infrastructure and testing because the
second upgrade image is built from the first one and pushed to the EKS
registry. Therefore, the images might come from different registries and
could requires multiple credentials.

Assisted-by: AI
Signed-off-by: Alice Frosi <afrosi@redhat.com>
---
 Makefile                |  2 ++
 test/e2e/e2eutil/env.go | 25 +++++++++++++++++--------
 2 files changed, 19 insertions(+), 8 deletions(-)

diff --git a/Makefile b/Makefile
index c5b42af8..e70e2142 100644
--- a/Makefile
+++ b/Makefile
@@ -130,6 +130,7 @@ EKS_REGISTRY_HOST ?=
 EKS_REGISTRY_USER ?=
 EKS_REGISTRY_PASSWORD ?=
 EKS_IMAGE_PULL_SECRET ?=
+EKS_NODE_PULL_SECRET ?=
 
 .PHONY: e2e-eks
 e2e-eks: ## Run e2e tests against EKS. V=1 for verbose. RUN=<regex> to filter.
@@ -149,6 +150,7 @@ e2e-eks: ## Run e2e tests against EKS. V=1 for verbose. RUN=<regex> to filter.
 		$(if $(RELEASED_OPERATOR_TAG),E2E_OPERATOR_RELEASE_TAG=$(RELEASED_OPERATOR_TAG)) \
 		$(if $(RELEASED_OPERATOR_IMG),E2E_OPERATOR_RELEASED_IMG=$(RELEASED_OPERATOR_IMG)) \
 		$(if $(EKS_IMAGE_PULL_SECRET),E2E_IMAGE_PULL_SECRET=$(EKS_IMAGE_PULL_SECRET)) \
+		E2E_NODE_PULL_SECRET="$(EKS_NODE_PULL_SECRET)" \
 		ARTIFACTS="$(ARTIFACTS)" \
 		go test -timeout 60m -count=1 -parallel 2 $(if $(V),-v) $(if $(RUN),-run '$(RUN)') .
 
diff --git a/test/e2e/e2eutil/env.go b/test/e2e/e2eutil/env.go
index c93a9437..e3d60ddb 100644
--- a/test/e2e/e2eutil/env.go
+++ b/test/e2e/e2eutil/env.go
@@ -355,13 +355,22 @@ func (e *Env) RegistryPassword() string {
 func (e *Env) createNodePullSecret(t *testing.T) {
 	t.Helper()
 
-	authStr := base64.StdEncoding.EncodeToString(
-		[]byte(e.registryUser + ":" + e.registryPassword),
-	)
-	dockerCfg := fmt.Sprintf(
-		`{"auths":{%q:{"auth":"%s"}}}`,
-		e.registryHost, authStr,
-	)
+	var dockerCfgBytes []byte
+	if envSecret := os.Getenv("E2E_NODE_PULL_SECRET"); envSecret != "" {
+		var err error
+		dockerCfgBytes, err = base64.StdEncoding.DecodeString(envSecret)
+		if err != nil {
+			t.Fatalf("decoding E2E_NODE_PULL_SECRET: %v", err)
+		}
+	} else {
+		authStr := base64.StdEncoding.EncodeToString(
+			[]byte(e.registryUser + ":" + e.registryPassword),
+		)
+		dockerCfgBytes = []byte(fmt.Sprintf(
+			`{"auths":{%q:{"auth":"%s"}}}`,
+			e.registryHost, authStr,
+		))
+	}
 
 	secretName := e.testID + "-node-pull-secret"
 	secret := &corev1.Secret{
@@ -371,7 +380,7 @@ func (e *Env) createNodePullSecret(t *testing.T) {
 		},
 		Type: corev1.SecretTypeDockerConfigJson,
 		Data: map[string][]byte{
-			corev1.DockerConfigJsonKey: []byte(dockerCfg),
+			corev1.DockerConfigJsonKey: dockerCfgBytes,
 		},
 	}