What

In order to mount the WASM plugin for RHCL, the Istio control plane needs to directly pull the productised WASM image container from the RH container catalog. In order to do this, the istio CP needs to know what pull secret to use to pull the image from the protected registry. To tell Istio this it needs to be configured as part of the WASMPlugin resource 

url: oci://private-registry:5000/openid-connect/openid:latest
imagePullPolicy: IfNotPresent
imagePullSecret: wasm-plugin-secret

Currently the customer needs to create a secret names `wasm-plugin-secret` in the namespace of each gateway in order to allow the image to be pulled. This is a cumbersome process.

Options

• look at loading the image into a private container registry (we hit issues with this previously but it would be good to revisit)
• Look at whether we could define an ImageStream to force the image to be pulled onto the cluster and so "be already present"