From f7890b7310fcf66672107ab29d5507555363110c Mon Sep 17 00:00:00 2001
From: Alice Frosi <afrosi@redhat.com>
Date: Thu, 22 Oct 2026 09:38:39 +0000
Subject: [PATCH 1/2] Require E2E_NODE_IMAGE_UPDATE2_REF for EKS

Assisted-by: AI
Signed-off-by: Alice Frosi <afrosi@redhat.com>
(cherry picked from commit 497a7c1bf73577146053b31af1e1def0c307cd23)
---
 test/e2e/e2eutil/env.go | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/test/e2e/e2eutil/env.go b/test/e2e/e2eutil/env.go
index 815d6abf..65681ec8 100644
--- a/test/e2e/e2eutil/env.go
+++ b/test/e2e/e2eutil/env.go
@@ -141,7 +141,7 @@ func New(t *testing.T) *Env {
 	case "eks":
 		nodeImageRef = requireEnv(t, "E2E_NODE_IMAGE_REF")
 		updateRef = requireEnv(t, "E2E_NODE_IMAGE_UPDATE_REF")
-		update2Ref = os.Getenv("E2E_NODE_IMAGE_UPDATE2_REF")
+		update2Ref = requireEnv(t, "E2E_NODE_IMAGE_UPDATE2_REF")
 		registryHost = os.Getenv("E2E_REGISTRY_HOST")
 		if registryHost == "" {
 			registryHost = extractRegistryHost(updateRef)

From 90baf2a5e2790ade76b8f7d584678e879eddc303 Mon Sep 17 00:00:00 2001
From: Alice Frosi <afrosi@redhat.com>
Date: Thu, 22 Oct 2026 09:38:47 +0000
Subject: [PATCH 2/2] Support pre-built pull secret via E2E_NODE_PULL_SECRET

This is helpful for the EKS infrastructure and testing because the
second upgrade image is built from the first one and pushed to the EKS
registry. Therefore, the images might come from different registries and
could requires multiple credentials.

Assisted-by: AI
Signed-off-by: Alice Frosi <afrosi@redhat.com>
(cherry picked from commit 7304f7b01d7eb6f3f169fe2c264ce67d3d965ef8)
---
 Makefile                |  2 ++
 test/e2e/e2eutil/env.go | 25 +++++++++++++++++--------
 2 files changed, 19 insertions(+), 8 deletions(-)

diff --git a/Makefile b/Makefile
index d3c4e1fc..aafcdeef 100644
--- a/Makefile
+++ b/Makefile
@@ -130,6 +130,7 @@ EKS_REGISTRY_HOST ?=
 EKS_REGISTRY_USER ?=
 EKS_REGISTRY_PASSWORD ?=
 EKS_IMAGE_PULL_SECRET ?=
+EKS_NODE_PULL_SECRET ?=
 
 .PHONY: e2e-eks
 e2e-eks: ## Run e2e tests against EKS. V=1 for verbose. RUN=<regex> to filter.
@@ -149,6 +150,7 @@ e2e-eks: ## Run e2e tests against EKS. V=1 for verbose. RUN=<regex> to filter.
 		$(if $(RELEASED_OPERATOR_TAG),E2E_OPERATOR_RELEASE_TAG=$(RELEASED_OPERATOR_TAG)) \
 		$(if $(RELEASED_OPERATOR_IMG),E2E_OPERATOR_RELEASED_IMG=$(RELEASED_OPERATOR_IMG)) \
 		$(if $(EKS_IMAGE_PULL_SECRET),E2E_IMAGE_PULL_SECRET=$(EKS_IMAGE_PULL_SECRET)) \
+		E2E_NODE_PULL_SECRET="$(EKS_NODE_PULL_SECRET)" \
 		ARTIFACTS="$(ARTIFACTS)" \
 		go test -timeout 30m -count=1 -parallel 2 $(if $(V),-v) $(if $(RUN),-run '$(RUN)') .
 
diff --git a/test/e2e/e2eutil/env.go b/test/e2e/e2eutil/env.go
index 65681ec8..86adf2fe 100644
--- a/test/e2e/e2eutil/env.go
+++ b/test/e2e/e2eutil/env.go
@@ -358,13 +358,22 @@ func (e *Env) RegistryPassword() string {
 func (e *Env) createNodePullSecret(t *testing.T) {
 	t.Helper()
 
-	authStr := base64.StdEncoding.EncodeToString(
-		[]byte(e.registryUser + ":" + e.registryPassword),
-	)
-	dockerCfg := fmt.Sprintf(
-		`{"auths":{%q:{"auth":"%s"}}}`,
-		e.registryHost, authStr,
-	)
+	var dockerCfgBytes []byte
+	if envSecret := os.Getenv("E2E_NODE_PULL_SECRET"); envSecret != "" {
+		var err error
+		dockerCfgBytes, err = base64.StdEncoding.DecodeString(envSecret)
+		if err != nil {
+			t.Fatalf("decoding E2E_NODE_PULL_SECRET: %v", err)
+		}
+	} else {
+		authStr := base64.StdEncoding.EncodeToString(
+			[]byte(e.registryUser + ":" + e.registryPassword),
+		)
+		dockerCfgBytes = []byte(fmt.Sprintf(
+			`{"auths":{%q:{"auth":"%s"}}}`,
+			e.registryHost, authStr,
+		))
+	}
 
 	secretName := e.testID + "-node-pull-secret"
 	secret := &corev1.Secret{
@@ -374,7 +383,7 @@ func (e *Env) createNodePullSecret(t *testing.T) {
 		},
 		Type: corev1.SecretTypeDockerConfigJson,
 		Data: map[string][]byte{
-			corev1.DockerConfigJsonKey: []byte(dockerCfg),
+			corev1.DockerConfigJsonKey: dockerCfgBytes,
 		},
 	}