[deckhouse-cli] Fix mirror pull to use edition-scope during pull

internal/mirror/installer/installer.go

@@ -95,11 +95,13 @@ func NewService(
 	return &Service{
 		registryService: registryService,
 		layout:          layout,
-		downloadList:    NewImageDownloadList(registryService.GetRoot()),
-		pullerService:   puller.NewPullerService(logger, userLogger),
-		options:         options,
-		logger:          logger,
-		userLogger:      userLogger,
+		// GetRoot() is edition-agnostic (e.g. <registry>/deckhouse); the installer
+		// lives at <root>/installer:<tag>, outside the edition segment.
+		downloadList:  NewImageDownloadList(registryService.GetRoot()),
+		pullerService: puller.NewPullerService(logger, userLogger),
+		options:       options,
+		logger:        logger,
+		userLogger:    userLogger,
 	}
 }
 

internal/mirror/modules/layout.go

@@ -28,6 +28,7 @@ import (
 	regimage "github.com/deckhouse/deckhouse-cli/pkg/registry/image"
 )
 
+// ModulesDownloadList is a to-do list grouped by module name.
 type ModulesDownloadList struct {
 	rootURL string
 	list    map[string]*ImageDownloadList
@@ -40,44 +41,24 @@ func NewModulesDownloadList(rootURL string) *ModulesDownloadList {
 	}
 }
 
-func (l *ModulesDownloadList) Module(moduleName string) *ImageDownloadList {
-	return l.list[moduleName]
-}
-
-func (l *ModulesDownloadList) FillModulesImages(modules []string) {
-	for _, moduleName := range modules {
-		list := NewImageDownloadList(filepath.Join(l.rootURL, moduleName))
-		list.FillForTag("")
-		l.list[moduleName] = list
-	}
-}
-
+// ImageDownloadList queues image refs for a single module for the puller.
+//   - Values: nil until the puller fills them with metadata.
+//   - rootURL: module-scoped path, used to build refs for display, not HTTP.
 type ImageDownloadList struct {
 	rootURL string
 
-	Module                map[string]*puller.ImageMeta
-	ModuleReleaseChannels map[string]*puller.ImageMeta
-	ModuleExtra           map[string]*puller.ImageMeta
+	Module                map[puller.ImageRef]*puller.ImageMeta
+	ModuleReleaseChannels map[puller.ImageRef]*puller.ImageMeta
+	ModuleExtra           map[puller.ImageRef]*puller.ImageMeta
 }
 
 func NewImageDownloadList(rootURL string) *ImageDownloadList {
 	return &ImageDownloadList{
 		rootURL: rootURL,
 
-		Module:                make(map[string]*puller.ImageMeta),
-		ModuleReleaseChannels: make(map[string]*puller.ImageMeta),
-		ModuleExtra:           make(map[string]*puller.ImageMeta),
-	}
-}
-
-func (l *ImageDownloadList) FillForTag(tag string) {
-	// If we are to pull only the specific requested version, we should not pull any release channels at all.
-	if tag != "" {
-		return
-	}
-
-	for _, channel := range internal.GetAllDefaultReleaseChannels() {
-		l.ModuleReleaseChannels[l.rootURL+":"+channel] = nil
+		Module:                make(map[puller.ImageRef]*puller.ImageMeta),
+		ModuleReleaseChannels: make(map[puller.ImageRef]*puller.ImageMeta),
+		ModuleExtra:           make(map[puller.ImageRef]*puller.ImageMeta),
 	}
 }
 

internal/mirror/modules/modules.go

@@ -121,7 +121,7 @@ func NewService(
 		options.Filter = filter
 	}
 
-	rootURL := registryService.GetRoot()
+	rootURL := registryService.DeckhouseService().GetRoot()
 
 	return &Service{
 		workingDir:          workingDir,

internal/mirror/modules/root_scope_test.go

@@ -0,0 +1,64 @@
+/*
+Copyright 2026 Flant JSC
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package modules
+
+import (
+	"log/slog"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	dkplog "github.com/deckhouse/deckhouse/pkg/log"
+
+	"github.com/deckhouse/deckhouse-cli/pkg"
+	"github.com/deckhouse/deckhouse-cli/pkg/libmirror/util/log"
+	registryclient "github.com/deckhouse/deckhouse-cli/pkg/registry/client"
+	registryservice "github.com/deckhouse/deckhouse-cli/pkg/registry/service"
+)
+
+func TestNewService_UsesDeckhouseRoot(t *testing.T) {
+	tests := []struct {
+		name          string
+		edition       pkg.Edition
+		wantRootURL   string
+	}{
+		{
+			name:        "edition layout uses edition-scoped root",
+			edition:     pkg.FEEdition,
+			wantRootURL: "registry.example.com/deckhouse/fe",
+		},
+		{
+			name:        "flat layout uses root without edition",
+			edition:     pkg.NoEdition,
+			wantRootURL: "registry.example.com/deckhouse",
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			logger := dkplog.NewLogger(dkplog.WithLevel(slog.LevelWarn))
+			userLogger := log.NewSLogger(slog.LevelWarn)
+			client := registryclient.NewFromOptions("registry.example.com/deckhouse")
+
+			regSvc := registryservice.NewService(client, tc.edition, logger)
+			svc := NewService(regSvc, t.TempDir(), &Options{DryRun: true}, logger, userLogger)
+
+			require.Equal(t, tc.wantRootURL, svc.rootURL)
+			require.Equal(t, tc.wantRootURL, svc.modulesDownloadList.rootURL)
+		})
+	}
+}

internal/mirror/platform/layout.go

@@ -29,25 +29,28 @@ import (
 	regimage "github.com/deckhouse/deckhouse-cli/pkg/registry/image"
 )
 
+// ImageDownloadList queues image refs for the puller.
+//   - Values: nil until the puller fills them with metadata.
+//   - rootURL: used to build refs for display (logs, annotations), not HTTP.
 type ImageDownloadList struct {
 	rootURL string
 
-	Deckhouse                  map[string]*puller.ImageMeta
-	DeckhouseExtra             map[string]*puller.ImageMeta
-	DeckhouseInstall           map[string]*puller.ImageMeta
-	DeckhouseInstallStandalone map[string]*puller.ImageMeta
-	DeckhouseReleaseChannel    map[string]*puller.ImageMeta
+	Deckhouse                  map[puller.ImageRef]*puller.ImageMeta
+	DeckhouseExtra             map[puller.ImageRef]*puller.ImageMeta
+	DeckhouseInstall           map[puller.ImageRef]*puller.ImageMeta
+	DeckhouseInstallStandalone map[puller.ImageRef]*puller.ImageMeta
+	DeckhouseReleaseChannel    map[puller.ImageRef]*puller.ImageMeta
 }
 
 func NewImageDownloadList(rootURL string) *ImageDownloadList {
 	return &ImageDownloadList{
 		rootURL: rootURL,
 
-		Deckhouse:                  make(map[string]*puller.ImageMeta),
-		DeckhouseExtra:             make(map[string]*puller.ImageMeta),
-		DeckhouseInstall:           make(map[string]*puller.ImageMeta),
-		DeckhouseInstallStandalone: make(map[string]*puller.ImageMeta),
-		DeckhouseReleaseChannel:    make(map[string]*puller.ImageMeta),
+		Deckhouse:                  make(map[puller.ImageRef]*puller.ImageMeta),
+		DeckhouseExtra:             make(map[puller.ImageRef]*puller.ImageMeta),
+		DeckhouseInstall:           make(map[puller.ImageRef]*puller.ImageMeta),
+		DeckhouseInstallStandalone: make(map[puller.ImageRef]*puller.ImageMeta),
+		DeckhouseReleaseChannel:    make(map[puller.ImageRef]*puller.ImageMeta),
 	}
 }
 

internal/mirror/platform/platform.go

@@ -115,7 +115,7 @@ func NewService(
 		}
 	}
 
-	rootURL := registryService.GetRoot()
+	rootURL := registryService.DeckhouseService().GetRoot()
 
 	return &Service{
 		deckhouseService: registryService.DeckhouseService(),

internal/mirror/platform/root_scope_test.go

@@ -0,0 +1,63 @@
+/*
+Copyright 2026 Flant JSC
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package platform
+
+import (
+	"log/slog"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	dkplog "github.com/deckhouse/deckhouse/pkg/log"
+
+	"github.com/deckhouse/deckhouse-cli/pkg"
+	"github.com/deckhouse/deckhouse-cli/pkg/libmirror/util/log"
+	registryclient "github.com/deckhouse/deckhouse-cli/pkg/registry/client"
+	registryservice "github.com/deckhouse/deckhouse-cli/pkg/registry/service"
+)
+
+func TestNewService_UsesDeckhouseRoot(t *testing.T) {
+	tests := []struct {
+		name        string
+		edition     pkg.Edition
+		wantRootURL string
+	}{
+		{
+			name:        "edition layout uses edition-scoped root",
+			edition:     pkg.FEEdition,
+			wantRootURL: "registry.example.com/deckhouse/fe",
+		},
+		{
+			name:        "flat layout uses root without edition",
+			edition:     pkg.NoEdition,
+			wantRootURL: "registry.example.com/deckhouse",
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			logger := dkplog.NewLogger(dkplog.WithLevel(slog.LevelWarn))
+			userLogger := log.NewSLogger(slog.LevelWarn)
+			client := registryclient.NewFromOptions("registry.example.com/deckhouse")
+
+			regSvc := registryservice.NewService(client, tc.edition, logger)
+			svc := NewService(regSvc, t.TempDir(), &Options{DryRun: true}, logger, userLogger)
+
+			require.Equal(t, tc.wantRootURL, svc.downloadList.rootURL)
+		})
+	}
+}

internal/mirror/puller/types.go

@@ -28,13 +28,16 @@ import (
 	regimage "github.com/deckhouse/deckhouse-cli/pkg/registry/image"
 )
 
+// ImageRef is a full image reference (e.g. registry.example.com/repo:tag).
+type ImageRef = string
+
 // ImageGetter is a function type for getting images from the registry
 type ImageGetter func(ctx context.Context, tag string, opts ...registry.ImageGetOption) (pkg.RegistryImage, error)
 
 // PullConfig encapsulates the configuration for pulling images
 type PullConfig struct {
 	Name             string
-	ImageSet         map[string]*ImageMeta
+	ImageSet         map[ImageRef]*ImageMeta
 	Layout           *regimage.ImageLayout
 	AllowMissingTags bool
 	GetterService    pkg.BasicService

internal/mirror/security/layout.go

@@ -29,29 +29,35 @@ import (
 	regimage "github.com/deckhouse/deckhouse-cli/pkg/registry/image"
 )
 
+// DatabaseName identifies a security database (trivy-db, trivy-bdu, ...).
+type DatabaseName = string
+
+// ImageDownloadList queues security database images for the puller.
+//   - Inner values: nil until the puller fills them with metadata.
+//   - rootURL: used to build refs for display (logs, annotations), not HTTP.
 type ImageDownloadList struct {
 	rootURL string
 
-	Security map[string]map[string]*puller.ImageMeta
+	Security map[DatabaseName]map[puller.ImageRef]*puller.ImageMeta
 }
 
 func NewImageDownloadList(rootURL string) *ImageDownloadList {
 	return &ImageDownloadList{
 		rootURL:  rootURL,
-		Security: make(map[string]map[string]*puller.ImageMeta),
+		Security: make(map[DatabaseName]map[puller.ImageRef]*puller.ImageMeta),
 	}
 }
 
 func (l *ImageDownloadList) FillSecurityImages() {
-	imageReferences := map[string]string{
+	imageReferences := map[DatabaseName]puller.ImageRef{
 		internal.SecurityTrivyDBSegment:     path.Join(l.rootURL, internal.SecuritySegment, internal.SecurityTrivyDBSegment) + ":2",
 		internal.SecurityTrivyBDUSegment:    path.Join(l.rootURL, internal.SecuritySegment, internal.SecurityTrivyBDUSegment) + ":1",
 		internal.SecurityTrivyJavaDBSegment: path.Join(l.rootURL, internal.SecuritySegment, internal.SecurityTrivyJavaDBSegment) + ":1",
 		internal.SecurityTrivyChecksSegment: path.Join(l.rootURL, internal.SecuritySegment, internal.SecurityTrivyChecksSegment) + ":0",
 	}
 
 	for name, ref := range imageReferences {
-		l.Security[name] = map[string]*puller.ImageMeta{
+		l.Security[name] = map[puller.ImageRef]*puller.ImageMeta{
 			ref: nil,
 		}
 	}
@@ -61,14 +67,14 @@ type ImageLayouts struct {
 	platform   v1.Platform
 	workingDir string
 
-	Security map[string]*regimage.ImageLayout
+	Security map[DatabaseName]*regimage.ImageLayout
 }
 
 func NewImageLayouts(rootFolder string) *ImageLayouts {
 	l := &ImageLayouts{
 		workingDir: rootFolder,
 		platform:   v1.Platform{Architecture: "amd64", OS: "linux"},
-		Security:   make(map[string]*regimage.ImageLayout, 1),
+		Security:   make(map[DatabaseName]*regimage.ImageLayout, 1),
 	}
 
 	return l