Do not create keychain if not a single Secret exists for image

Author: Andrey Klimentyev

pkg/registry_checker/indexers.go

@@ -208,10 +208,6 @@ func (ci ControllerIndexers) GetKeychainForImage(image string) *keychain {
 		}
 	}
 
-	if len(refSet) == 0 {
-		return nil
-	}
-
 	var dereferencedPullSecrets []corev1.Secret
 	for ref := range refSet {
 		secretObj, exists, err := ci.secretIndexer.GetByKey(ref)
@@ -225,6 +221,10 @@ func (ci ControllerIndexers) GetKeychainForImage(image string) *keychain {
 		dereferencedPullSecrets = append(dereferencedPullSecrets, *secretPtr)
 	}
 
+	if len(dereferencedPullSecrets) == 0 {
+		return nil
+	}
+
 	kr, err := credentialprovidersecrets.MakeDockerKeyring(dereferencedPullSecrets, credentialprovider.NewDockerKeyring())
 	if err != nil {
 		panic(err)