Repository: kyma-project/cli (go)

Issue:
`--k3d-args` is not being passed to `k3d registry create`
<!-- Thank you for your contribution. Before you submit the issue:
1. Search open and closed issues for duplicates.
2. Read the contributing guidelines.
-->

**Description**

<!-- Provide a clear and concise description of the problem.
Describe where it appears, when it occurred, and what it affects.  -->

<!-- Provide relevant technical details such as the browser name and version, or the operating system. -->
Podman uses a network named `podman`  instead of `bridge`, so setting different default network pod k3d is required.
However a k3d flag passed to Kyma CLI doesn't get passed down to (some of?) the k3dcommand.

**Expected result**

<!-- Describe what you expect to happen. -->
* --k3d-args flags passed to k3d commands

**Actual result**
* --k3d-args flags aren't passed to `k3d registry create` command

<!-- Describe what happens instead. -->

**Steps to reproduce**

<!-- List the steps to follow to reproduce the bug. Attach any files, links, code samples, or screenshots that could help in investigating the problem. -->
`kyma provision k3d --k3d-arg="--default-network podman"`
```
Error: Executing 'k3d registry create kyma-registry --port 5001' failed with output 'INFO[0000] Creating node 'k3d-kyma-registry'
FATA[0000] Failed to create registry: failed to create registry node 'k3d-kyma-registry': runtime failed to create node 'k3d-kyma-registry': failed to create container for node 'k3d-kyma-registry': docker failed to create container 'k3d-kyma-registry': Error response from daemon: container create: unable to find network with name or ID bridge: network not found
```

**Troubleshooting**

<!-- Describe the steps you have already taken to solve the issue. -->


Pull request description:
provision/k3d: Add "k3d-registry-arg" Flag
## Changes
The `--k3d-registry-arg` flag was added to the `kyma provision k3d` command. The arguments passed through this flag are passed on to the `k3d registry create` command and offer extra control over registry creation before cluster provisioning.

Closes #1475 

Patch:
diff --git a/cmd/kyma/alpha/create/module/module.go b/cmd/kyma/alpha/create/module/module.go
index 4a5072fe..7dd10402 100644
--- a/cmd/kyma/alpha/create/module/module.go
+++ b/cmd/kyma/alpha/create/module/module.go
@@ -131,6 +131,10 @@ Build module my-domain/modB in version 3.2.1 and push it to a local registry "un
 			"the security scan configuration.",
 	)
 
+	cmd.Flags().StringVar(
+		&o.PrivateKeyPath, "key", "", "Specifies the path where a private key is used for signing.",
+	)
+
 	return cmd
 }
 
@@ -152,19 +156,7 @@ func (cmd *command) Run(ctx context.Context) error {
 		cli.AlphaWarn()
 	}
 
-	if err := cmd.opts.ValidateVersion(); err != nil {
-		return err
-	}
-
-	if err := cmd.opts.ValidatePath(); err != nil {
-		return err
-	}
-
-	if err := cmd.opts.ValidateChannel(); err != nil {
-		return err
-	}
-
-	if err := cmd.opts.ValidateTarget(); err != nil {
+	if err := cmd.opts.Validate(); err != nil {
 		return err
 	}
 
@@ -256,6 +248,21 @@ func (cmd *command) Run(ctx context.Context) error {
 		}
 		cmd.CurrentStep.Successf("Module successfully pushed to %q", cmd.opts.RegistryURL)
 
+		if cmd.opts.PrivateKeyPath != "" {
+			signCfg := &module.ComponentSignConfig{
+				Name:    modDef.Name,
+				Version: modDef.Version,
+				KeyPath: cmd.opts.PrivateKeyPath,
+			}
+
+			cmd.NewStep("Fetching and signing component descriptor...")
+			if err = module.Sign(signCfg, remote); err != nil {
+				cmd.CurrentStep.Failure()
+				return err
+			}
+			cmd.CurrentStep.Success()
+		}
+
 		cmd.NewStep("Generating module template")
 		t, err := module.Template(componentVersionAccess, cmd.opts.Channel, cmd.opts.Target, modDef.DefaultCR, cmd.opts.RegistryCredSelector)
 		if err != nil {
diff --git a/cmd/kyma/alpha/create/module/opts.go b/cmd/kyma/alpha/create/module/opts.go
index c3912e1a..fca73791 100644
--- a/cmd/kyma/alpha/create/module/opts.go
+++ b/cmd/kyma/alpha/create/module/opts.go
@@ -36,6 +36,7 @@ type Options struct {
 	ArchiveVersionOverwrite bool
 	RegistryCredSelector    string
 	SecurityScanConfig      string
+	PrivateKeyPath          string
 }
 
 const (
@@ -107,3 +108,19 @@ func (o *Options) ValidateTarget() error {
 	}
 	return fmt.Errorf("target %s is invalid, allowed: %s", o.Target, valid)
 }
+
+func (o *Options) Validate() error {
+	if err := o.ValidateVersion(); err != nil {
+		return err
+	}
+
+	if err := o.ValidatePath(); err != nil {
+		return err
+	}
+
+	if err := o.ValidateChannel(); err != nil {
+		return err
+	}
+
+	return o.ValidateTarget()
+}
diff --git a/cmd/kyma/alpha/deploy/cmd.go b/cmd/kyma/alpha/deploy/cmd.go
index 192a7735..16d933d1 100644
--- a/cmd/kyma/alpha/deploy/cmd.go
+++ b/cmd/kyma/alpha/deploy/cmd.go
@@ -102,11 +102,11 @@ By default, Lifecycle Manager is deployed from the GitHub main branch.`,
 	cobraCmd.Flags().StringVar(
 		&o.LifecycleManager,
 		"lifecycle-manager",
-		"eu.gcr.io/kyma-project/lifecycle-manager:latest",
+		"",
 		`Installs Lifecycle Manager with the specified image:
 - Use "my-registry.org/lifecycle-manager:my-tag"" to use a custom version of Lifecycle Manager.
 - Use "europe-docker.pkg.dev/kyma-project/prod/lifecycle-manager@sha256:cb74b29cfe80c639c9ee9..." to use a custom version of Lifecycle Manager with a digest.
-- Specify a tag to override the default one. For example, when specifying "v20230220-7b8e9515",  the "eu.gcr.io/kyma-project/lifecycle-manager:v20230220-7b8e9515" tag is used.`,
+- Specify a tag to override the default one. For example, when specifying "v20230220-7b8e9515", the "eu.gcr.io/kyma-project/lifecycle-manager:v20230220-7b8e9515" tag is used.`,
 	)
 	cobraCmd.Flags().BoolVar(
 		&o.DryRun,
diff --git a/cmd/kyma/alpha/sign/module/module.go b/cmd/kyma/alpha/sign/module/module.go
index 3e78b3a9..4f444816 100644
--- a/cmd/kyma/alpha/sign/module/module.go
+++ b/cmd/kyma/alpha/sign/module/module.go
@@ -40,9 +40,6 @@ This command signs all module resources recursively based on an unsigned compone
 	cmd.Flags().StringVar(
 		&o.PrivateKeyPath, "key", "", "Specifies the path where a private key is used for signing.",
 	)
-	cmd.Flags().StringVar(
-		&o.SignatureName, "signature-name", "kyma-project.io/module-signature", "name of the signature to use.",
-	)
 	cmd.Flags().StringVar(
 		&o.RegistryURL, "registry", "", "Context URL of the repository for the module. "+
 			"The repository's URL is automatically added to the repository's contexts in the module.",
@@ -70,10 +67,9 @@ func (c *command) Run(_ []string) error {
 	}
 
 	signCfg := &module.ComponentSignConfig{
-		Name:          c.opts.Name,
-		Version:       c.opts.Version,
-		KeyPath:       c.opts.PrivateKeyPath,
-		SignatureName: c.opts.SignatureName,
+		Name:    c.opts.Name,
+		Version: c.opts.Version,
+		KeyPath: c.opts.PrivateKeyPath,
 	}
 
 	c.NewStep("Fetching and signing component descriptor...")
@@ -91,7 +87,7 @@ func (c *command) Run(_ []string) error {
 		Insecure:    c.opts.Insecure,
 	}
 
-	if err := module.Sign(signCfg, remote); err != nil {
+	if err = module.Sign(signCfg, remote); err != nil {
 		c.CurrentStep.Failure()
 		return err
 	}
diff --git a/cmd/kyma/alpha/sign/module/opts.go b/cmd/kyma/alpha/sign/module/opts.go
index b53ad7ff..f208665e 100644
--- a/cmd/kyma/alpha/sign/module/opts.go
+++ b/cmd/kyma/alpha/sign/module/opts.go
@@ -11,7 +11,6 @@ type Options struct {
 	RegistryURL     string
 	NameMappingMode string
 	PrivateKeyPath  string
-	SignatureName   string
 	Credentials     string
 	Token           string
 	Insecure        bool
diff --git a/cmd/kyma/alpha/verify/module/module.go b/cmd/kyma/alpha/verify/module/module.go
index 23c63ae8..71560b1a 100644
--- a/cmd/kyma/alpha/verify/module/module.go
+++ b/cmd/kyma/alpha/verify/module/module.go
@@ -41,9 +41,6 @@ Kyma modules can be cryptographically signed to ensure they are correct and dist
 	cmd.Flags().StringVar(
 		&o.PublicKeyPath, "key", "", "Specifies the path where a public key is used for signing.",
 	)
-	cmd.Flags().StringVar(
-		&o.SignatureName, "signature-name", "kyma-project.io/module-signature", "name of the signature to use.",
-	)
 	cmd.Flags().StringVar(
 		&o.RegistryURL, "registry", "", "Context URL of the repository for the module. "+
 			"The repository's URL is automatically added to the repository's contexts in the module.",
@@ -71,10 +68,9 @@ func (c *command) Run(_ []string) error {
 	}
 
 	signCfg := &module.ComponentSignConfig{
-		Name:          c.opts.Name,
-		Version:       c.opts.Version,
-		KeyPath:       c.opts.PublicKeyPath,
-		SignatureName: c.opts.SignatureName,
+		Name:    c.opts.Name,
+		Version: c.opts.Version,
+		KeyPath: c.opts.PublicKeyPath,
 	}
 
 	c.NewStep("Fetching and verifying component descriptor...")
diff --git a/cmd/kyma/alpha/verify/module/opts.go b/cmd/kyma/alpha/verify/module/opts.go
index 0d80377c..3e2b7eb2 100644
--- a/cmd/kyma/alpha/verify/module/opts.go
+++ b/cmd/kyma/alpha/verify/module/opts.go
@@ -12,7 +12,6 @@ type Options struct {
 	RegistryURL     string
 	NameMappingMode string
 	PublicKeyPath   string
-	SignatureName   string
 	Credentials     string
 	Token           string
 	Insecure        bool
diff --git a/cmd/kyma/provision/k3d/cmd.go b/cmd/kyma/provision/k3d/cmd.go
index 2edefcf2..42426dc5 100644
--- a/cmd/kyma/provision/k3d/cmd.go
+++ b/cmd/kyma/provision/k3d/cmd.go
@@ -49,6 +49,10 @@ func NewCmd(o *Options) *cobra.Command {
 		&o.K3dArgs, "k3d-arg", "", []string{},
 		"One or more arguments passed to the k3d provisioning command (e.g. --k3d-arg='--no-rollback')",
 	)
+	cmd.Flags().StringSliceVarP(
+		&o.K3dRegistryArgs, "k3d-registry-arg", "", []string{},
+		"One or more arguments passed to the k3d registry create command (e.g. --k3d-registry-arg='--default-network podman')",
+	)
 	cmd.Flags().StringVarP(
 		&o.KubernetesVersion, "kube-version", "k", provision.DefaultK8sFullVersion, "Kubernetes version of the cluster",
 	)
@@ -205,7 +209,7 @@ func (c *command) PromptUserToDeleteExistingCluster() bool {
 func (c *command) createK3dRegistry(k3dClient k3d.Client) (string, error) {
 	s := c.NewStep("Create k3d registry")
 
-	registryURL, err := k3dClient.CreateRegistry(c.opts.RegistryPort)
+	registryURL, err := k3dClient.CreateRegistry(c.opts.RegistryPort, parseNestedArgs(c.opts.K3dRegistryArgs))
 	if err != nil {
 		s.Failuref("Could not create k3d registry")
 		return "", err
@@ -219,7 +223,7 @@ func (c *command) createK3dCluster(k3dClient k3d.Client) error {
 	s := c.NewStep(fmt.Sprintf("Create K3d cluster '%s'", c.opts.Name))
 
 	settings := k3d.CreateClusterSettings{
-		Args:              parseK3dArgs(c.opts.K3dArgs),
+		Args:              parseNestedArgs(c.opts.K3dArgs),
 		KubernetesVersion: c.opts.KubernetesVersion,
 		PortMapping:       c.opts.PortMapping,
 		Workers:           c.opts.Workers,
@@ -264,7 +268,7 @@ func allocatePorts(ports ...int) error {
 	return nil
 }
 
-func parseK3dArgs(args []string) []string {
+func parseNestedArgs(args []string) []string {
 	var res []string
 	for _, arg := range args {
 		res = append(res, strings.Split(arg, " ")...)
diff --git a/cmd/kyma/provision/k3d/opts.go b/cmd/kyma/provision/k3d/opts.go
index c4900b80..ddfadf53 100644
--- a/cmd/kyma/provision/k3d/opts.go
+++ b/cmd/kyma/provision/k3d/opts.go
@@ -17,6 +17,7 @@ type Options struct {
 	UseRegistry       []string
 	RegistryPort      string
 	K3dArgs           []string
+	K3dRegistryArgs   []string
 	KubernetesVersion string
 	PortMapping       []string
 }
diff --git a/docs/gen-docs/kyma_alpha_create_module.md b/docs/gen-docs/kyma_alpha_create_module.md
index 94e344f5..581faeee 100644
--- a/docs/gen-docs/kyma_alpha_create_module.md
+++ b/docs/gen-docs/kyma_alpha_create_module.md
@@ -50,6 +50,7 @@ Build module my-domain/modB in version 3.2.1 and push it to a local registry "un
       --default-cr string                  File containing the default custom resource of the module. If the module is a kubebuilder project, the default CR is automatically detected.
       --descriptor-version string          Schema version to use for the generated OCM descriptor. One of ocm.software/v3alpha1,v2 (default "v2")
       --insecure                           Uses an insecure connection to access the registry.
+      --key string                         Specifies the path where a private key is used for signing.
       --module-archive-path string         Specifies the path where the module artifacts are locally cached to generate the image. If the path already has a module, use the "--module-archive-version-overwrite" flag to overwrite it. (default "./mod")
       --module-archive-persistence         Uses the host filesystem instead of in-memory archiving to build the module.
       --module-archive-version-overwrite   Overwrites existing component's versions of the module. If set to false, the push is a No-Op.
diff --git a/docs/gen-docs/kyma_alpha_deploy.md b/docs/gen-docs/kyma_alpha_deploy.md
index 21704e83..ec8ec290 100644
--- a/docs/gen-docs/kyma_alpha_deploy.md
+++ b/docs/gen-docs/kyma_alpha_deploy.md
@@ -36,7 +36,7 @@ kyma alpha deploy [flags]
       --lifecycle-manager string      Installs Lifecycle Manager with the specified image:
                                       - Use "my-registry.org/lifecycle-manager:my-tag"" to use a custom version of Lifecycle Manager.
                                       - Use "europe-docker.pkg.dev/kyma-project/prod/lifecycle-manager@sha256:cb74b29cfe80c639c9ee9..." to use a custom version of Lifecycle Manager with a digest.
-                                      - Specify a tag to override the default one. For example, when specifying "v20230220-7b8e9515",  the "eu.gcr.io/kyma-project/lifecycle-manager:v20230220-7b8e9515" tag is used. (default "eu.gcr.io/kyma-project/lifecycle-manager:latest")
+                                      - Specify a tag to override the default one. For example, when specifying "v20230220-7b8e9515", the "eu.gcr.io/kyma-project/lifecycle-manager:v20230220-7b8e9515" tag is used.
   -m, --module stringArray            Provide one or more modules to activate after the deployment is finished. Example: "--module name@namespace" (namespace is optional).
   -n, --namespace string              The Namespace to deploy the Kyma custom resource in. (default "kyma-system")
       --open-dashboard                Opens the Busola Dashboard at startup. Only works when a graphical interface is available and when running in interactive mode
diff --git a/docs/gen-docs/kyma_alpha_sign_module.md b/docs/gen-docs/kyma_alpha_sign_module.md
index 1bb04f39..94fc57f1 100644
--- a/docs/gen-docs/kyma_alpha_sign_module.md
+++ b/docs/gen-docs/kyma_alpha_sign_module.md
@@ -20,15 +20,14 @@ kyma alpha sign module --name MODULE_NAME --version MODULE_VERSION --registry MO
 ## Flags
 
 ```bash
-  -c, --credentials string      Basic authentication credentials for the given registry in the user:password format
-      --insecure                Uses an insecure connection to access the registry.
-      --key string              Specifies the path where a private key is used for signing.
-      --name string             Name of the module.
-      --name-mapping string     Overrides the OCM Component Name Mapping, Use: "urlPath" or "sha256-digest". (default "urlPath")
-      --registry string         Context URL of the repository for the module. The repository's URL is automatically added to the repository's contexts in the module.
-      --signature-name string   name of the signature to use. (default "kyma-project.io/module-signature")
-  -t, --token string            Authentication token for the given registry (alternative to basic authentication).
-      --version string          Version of the module.
+  -c, --credentials string    Basic authentication credentials for the given registry in the user:password format
+      --insecure              Uses an insecure connection to access the registry.
+      --key string            Specifies the path where a private key is used for signing.
+      --name string           Name of the module.
+      --name-mapping string   Overrides the OCM Component Name Mapping, Use: "urlPath" or "sha256-digest". (default "urlPath")
+      --registry string       Context URL of the repository for the module. The repository's URL is automatically added to the repository's contexts in the module.
+  -t, --token string          Authentication token for the given registry (alternative to basic authentication).
+      --version string        Version of the module.
 ```
 
 ## Flags inherited from parent commands
diff --git a/docs/gen-docs/kyma_alpha_verify_module.md b/docs/gen-docs/kyma_alpha_verify_module.md
index f0353b24..c8ee2778 100644
--- a/docs/gen-docs/kyma_alpha_verify_module.md
+++ b/docs/gen-docs/kyma_alpha_verify_module.md
@@ -20,15 +20,14 @@ kyma alpha verify module --name MODULE_NAME --version MODULE_VERSION --registry
 ## Flags
 
 ```bash
-  -c, --credentials string      Basic authentication credentials for the given registry in the user:password format
-      --insecure                Uses an insecure connection to access the registry.
-      --key string              Specifies the path where a public key is used for signing.
-      --name string             Name of the module.
-      --name-mapping string     Overrides the OCM Component Name Mapping, Use: "urlPath" or "sha256-digest". (default "urlPath")
-      --registry string         Context URL of the repository for the module. The repository's URL is automatically added to the repository's contexts in the module.
-      --signature-name string   name of the signature to use. (default "kyma-project.io/module-signature")
-  -t, --token string            Authentication token for the given registry (alternative to basic authentication).
-      --version string          Version of the module.
+  -c, --credentials string    Basic authentication credentials for the given registry in the user:password format
+      --insecure              Uses an insecure connection to access the registry.
+      --key string            Specifies the path where a public key is used for signing.
+      --name string           Name of the module.
+      --name-mapping string   Overrides the OCM Component Name Mapping, Use: "urlPath" or "sha256-digest". (default "urlPath")
+      --registry string       Context URL of the repository for the module. The repository's URL is automatically added to the repository's contexts in the module.
+  -t, --token string          Authentication token for the given registry (alternative to basic authentication).
+      --version string        Version of the module.
 ```
 
 ## Flags inherited from parent commands
diff --git a/docs/gen-docs/kyma_provision_k3d.md b/docs/gen-docs/kyma_provision_k3d.md
index e1c2e550..4abcc9b4 100644
--- a/docs/gen-docs/kyma_provision_k3d.md
+++ b/docs/gen-docs/kyma_provision_k3d.md
@@ -15,15 +15,16 @@ kyma provision k3d [flags]
 ## Flags
 
 ```bash
-      --k3d-arg strings        One or more arguments passed to the k3d provisioning command (e.g. --k3d-arg='--no-rollback')
-  -s, --k3s-arg strings        One or more arguments passed from k3d to the k3s command (format: ARG@NODEFILTER[;@NODEFILTER])
-  -k, --kube-version string    Kubernetes version of the cluster (default "1.25.6")
-      --name string            Name of the Kyma cluster (default "kyma")
-  -p, --port strings           Map ports 80 and 443 of K3D loadbalancer (e.g. -p 80:80@loadbalancer -p 443:443@loadbalancer) (default [80:80@loadbalancer,443:443@loadbalancer])
-      --registry-port string   Specify the port on which the k3d registry will be exposed (default "5001")
-      --registry-use strings   Connect to one or more k3d-managed registries. Kyma automatically creates a registry for Serverless images.
-      --timeout duration       Maximum time for the provisioning. If you want no timeout, enter "0". (default 5m0s)
-      --workers int            Number of worker nodes (k3d agents) (default 1)
+      --k3d-arg strings            One or more arguments passed to the k3d provisioning command (e.g. --k3d-arg='--no-rollback')
+      --k3d-registry-arg strings   One or more arguments passed to the k3d registry create command (e.g. --k3d-registry-arg='--default-network podman')
+  -s, --k3s-arg strings            One or more arguments passed from k3d to the k3s command (format: ARG@NODEFILTER[;@NODEFILTER])
+  -k, --kube-version string        Kubernetes version of the cluster (default "1.25.6")
+      --name string                Name of the Kyma cluster (default "kyma")
+  -p, --port strings               Map ports 80 and 443 of K3D loadbalancer (e.g. -p 80:80@loadbalancer -p 443:443@loadbalancer) (default [80:80@loadbalancer,443:443@loadbalancer])
+      --registry-port string       Specify the port on which the k3d registry will be exposed (default "5001")
+      --registry-use strings       Connect to one or more k3d-managed registries. Kyma automatically creates a registry for Serverless images.
+      --timeout duration           Maximum time for the provisioning. If you want no timeout, enter "0". (default 5m0s)
+      --workers int                Number of worker nodes (k3d agents) (default 1)
 ```
 
 ## Flags inherited from parent commands
diff --git a/go.mod b/go.mod
index 05ae2b9b..fe74526b 100644
--- a/go.mod
+++ b/go.mod
@@ -25,7 +25,7 @@ require (
 	github.com/kyma-project/hydroform/provision v0.0.0-20230127124234-b67611c40868
 	github.com/kyma-project/lifecycle-manager v0.0.0-20230228084539-adc0e4a5f93a
 	github.com/mandelsoft/vfs v0.0.0-20220805210647-bf14a11bfe31
-	github.com/open-component-model/ocm v0.1.0
+	github.com/open-component-model/ocm v0.2.0
 	github.com/opencontainers/go-digest v1.0.0
 	github.com/opencontainers/image-spec v1.1.0-rc2
 	github.com/pkg/browser v0.0.0-20210911075715-681adbf594b8
@@ -44,7 +44,7 @@ require (
 	k8s.io/cli-runtime v0.26.1
 	k8s.io/client-go v11.0.1-0.20190409021438-1a26190bd76a+incompatible
 	k8s.io/klog/v2 v2.90.1
-	sigs.k8s.io/controller-runtime v0.14.4
+	sigs.k8s.io/controller-runtime v0.14.6
 	sigs.k8s.io/kustomize/api v0.12.1
 	sigs.k8s.io/kustomize/kyaml v0.13.9
 	sigs.k8s.io/yaml v1.3.0
@@ -204,7 +204,7 @@ require (
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
 	github.com/nwaples/rardecode v1.1.3 // indirect
 	github.com/onsi/gomega v1.27.1 // indirect
-	github.com/opencontainers/runc v1.1.4 // indirect
+	github.com/opencontainers/runc v1.1.5 // indirect
 	github.com/otiai10/copy v1.9.0 // indirect
 	github.com/panjf2000/ants/v2 v2.7.1 // indirect
 	github.com/pelletier/go-toml v1.9.5 // indirect
diff --git a/go.sum b/go.sum
index 16af463e..04561a06 100644
--- a/go.sum
+++ b/go.sum
@@ -1412,8 +1412,8 @@ github.com/onsi/gomega v1.22.1/go.mod h1:x6n7VNe4hw0vkyYUM4mjIXx3JbLiPaBPNgB7PRQ
 github.com/onsi/gomega v1.23.0/go.mod h1:Z/NWtiqwBrwUt4/2loMmHL63EDLnYHmVbuBpDr2vQAg=
 github.com/onsi/gomega v1.27.1 h1:rfztXRbg6nv/5f+Raen9RcGoSecHIFgBBLQK3Wdj754=
 github.com/onsi/gomega v1.27.1/go.mod h1:aHX5xOykVYzWOV4WqQy0sy8BQptgukenXpCXfadcIAw=
-github.com/open-component-model/ocm v0.1.0 h1:K1RrHOWO3erTqPZkLKvQ0JRA/uGXGpHaS+uKkIrVZMk=
-github.com/open-component-model/ocm v0.1.0/go.mod h1:aPlBtHOXiAVG9wy7vL1fIwwEjJwB0HMk5n16JlI5k2o=
+github.com/open-component-model/ocm v0.2.0 h1:3/T54MO/E3dzMRV8X1eQ1RWI3UPc4QM1cw1B2mufbE4=
+github.com/open-component-model/ocm v0.2.0/go.mod h1:SzDUp1q7p/8hUf7sdHCx3qNzJzU6cyAAfJZMtBrJqAI=
 github.com/opencontainers/go-digest v0.0.0-20170106003457-a6d0ee40d420/go.mod h1:cMLVZDEM3+U2I4VmLI6N8jQYUd2OVphdqWwCJHrFt2s=
 github.com/opencontainers/go-digest v0.0.0-20180430190053-c9281466c8b2/go.mod h1:cMLVZDEM3+U2I4VmLI6N8jQYUd2OVphdqWwCJHrFt2s=
 github.com/opencontainers/go-digest v1.0.0-rc1/go.mod h1:cMLVZDEM3+U2I4VmLI6N8jQYUd2OVphdqWwCJHrFt2s=
@@ -1433,8 +1433,8 @@ github.com/opencontainers/runc v1.0.0-rc9/go.mod h1:qT5XzbpPznkRYVz/mWwUaVBUv2rm
 github.com/opencontainers/runc v1.0.0-rc93/go.mod h1:3NOsor4w32B2tC0Zbl8Knk4Wg84SM2ImC1fxBuqJ/H0=
 github.com/opencontainers/runc v1.0.2/go.mod h1:aTaHFFwQXuA71CiyxOdFFIorAoemI04suvGRQFzWTD0=
 github.com/opencontainers/runc v1.1.0/go.mod h1:Tj1hFw6eFWp/o33uxGf5yF2BX5yz2Z6iptFpuvbbKqc=
-github.com/opencontainers/runc v1.1.4 h1:nRCz/8sKg6K6jgYAFLDlXzPeITBZJyX28DBVhWD+5dg=
-github.com/opencontainers/runc v1.1.4/go.mod h1:1J5XiS+vdZ3wCyZybsuxXZWGrgSr8fFJHLXuG2PsnNg=
+github.com/opencontainers/runc v1.1.5 h1:L44KXEpKmfWDcS02aeGm8QNTFXTo2D+8MYGDIJ/GDEs=
+github.com/opencontainers/runc v1.1.5/go.mod h1:1J5XiS+vdZ3wCyZybsuxXZWGrgSr8fFJHLXuG2PsnNg=
 github.com/opencontainers/runtime-spec v0.1.2-0.20190507144316-5b71a03e2700/go.mod h1:jwyrGlmzljRJv/Fgzds9SsS/C5hL+LL3ko9hs6T5lQ0=
 github.com/opencontainers/runtime-spec v1.0.1/go.mod h1:jwyrGlmzljRJv/Fgzds9SsS/C5hL+LL3ko9hs6T5lQ0=
 github.com/opencontainers/runtime-spec v1.0.2-0.20190207185410-29686dbc5559/go.mod h1:jwyrGlmzljRJv/Fgzds9SsS/C5hL+LL3ko9hs6T5lQ0=
@@ -2684,8 +2684,8 @@ sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.0.7/go.mod h1:PHgbrJT
 sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.0.14/go.mod h1:LEScyzhFmoF5pso/YSeBstl57mOzx9xlU9n85RGrDQg=
 sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.0.15/go.mod h1:LEScyzhFmoF5pso/YSeBstl57mOzx9xlU9n85RGrDQg=
 sigs.k8s.io/controller-runtime v0.6.1/go.mod h1:XRYBPdbf5XJu9kpS84VJiZ7h/u1hF3gEORz0efEja7A=
-sigs.k8s.io/controller-runtime v0.14.4 h1:Kd/Qgx5pd2XUL08eOV2vwIq3L9GhIbJ5Nxengbd4/0M=
-sigs.k8s.io/controller-runtime v0.14.4/go.mod h1:WqIdsAY6JBsjfc/CqO0CORmNtoCtE4S6qbPc9s68h+0=
+sigs.k8s.io/controller-runtime v0.14.6 h1:oxstGVvXGNnMvY7TAESYk+lzr6S3V5VFxQ6d92KcwQA=
+sigs.k8s.io/controller-runtime v0.14.6/go.mod h1:WqIdsAY6JBsjfc/CqO0CORmNtoCtE4S6qbPc9s68h+0=
 sigs.k8s.io/controller-tools v0.3.0/go.mod h1:enhtKGfxZD1GFEoMgP8Fdbu+uKQ/cq1/WGJhdVChfvI=
 sigs.k8s.io/gateway-api v0.6.0 h1:v2FqrN2ROWZLrSnI2o91taHR8Sj3s+Eh3QU7gLNWIqA=
 sigs.k8s.io/gateway-api v0.6.0/go.mod h1:EYJT+jlPWTeNskjV0JTki/03WX1cyAnBhwBJfYHpV/0=
diff --git a/internal/k3d/k3d.go b/internal/k3d/k3d.go
index 7fa93574..f5de2052 100644
--- a/internal/k3d/k3d.go
+++ b/internal/k3d/k3d.go
@@ -28,7 +28,7 @@ type Client interface {
 	ClusterExists() (bool, error)
 	RegistryExists() (bool, error)
 	CreateCluster(settings CreateClusterSettings) error
-	CreateRegistry(registryPort string) (string, error)
+	CreateRegistry(registryPort string, args []string) (string, error)
 	DeleteCluster() error
 	DeleteRegistry() error
 }
@@ -227,10 +227,11 @@ func (c *client) CreateCluster(settings CreateClusterSettings) error {
 }
 
 // CreateRegistry creates a k3d registry with the default name
-func (c *client) CreateRegistry(registryPort string) (string, error) {
+func (c *client) CreateRegistry(registryPort string, args []string) (string, error) {
 	registryName := fmt.Sprintf(defaultRegistryNamePattern, c.clusterName)
 
-	out, err := c.runCmd("registry", "create", registryName, "--port", registryPort)
+	cmd := append([]string{"registry", "create", registryName, "--port", registryPort}, args...)
+	out, err := c.runCmd(cmd...)
 	if err != nil {
 		return "", err
 	}
diff --git a/internal/kustomize/kustomize.go b/internal/kustomize/kustomize.go
index 8c5dab53..c37c87a1 100644
--- a/internal/kustomize/kustomize.go
+++ b/internal/kustomize/kustomize.go
@@ -116,9 +116,13 @@ func Build(def Definition, filters ...kio.Filter) ([]byte, error) {
 }
 
 func LifecycleManagerImageModifier(overrideString string, onOverride func(image string)) (imagetag.Filter, error) {
-	override, err := parseOverride(overrideString)
-	if err != nil {
-		return imagetag.Filter{}, err
+	override := override{}
+	if overrideString != "" {
+		var err error
+		override, err = parseOverride(overrideString)
+		if err != nil {
+			return imagetag.Filter{}, err
+		}
 	}
 	return ImageModifier(
 		"*lifecycle-manager*", override.name, override.tag, override.digest,
diff --git a/pkg/module/sign.go b/pkg/module/sign.go
index 580d18c1..cb7564cb 100644
--- a/pkg/module/sign.go
+++ b/pkg/module/sign.go
@@ -16,12 +16,16 @@ import (
 )
 
 type ComponentSignConfig struct {
-	Name          string // Name of the module (mandatory)
-	Version       string // Version of the module (mandatory)
-	KeyPath       string // The private key used for signing (mandatory)
-	SignatureName string // Name of the signature for signing
+	Name    string // Name of the module (mandatory)
+	Version string // Version of the module (mandatory)
+	KeyPath string // The private key used for signing (mandatory)
 }
 
+const (
+	SignatureName = "kyma-project.io/module-signature"
+	Issuer        = "kyma-project.io/cli"
+)
+
 func Sign(cfg *ComponentSignConfig, remote *Remote) error {
 	if err := cfg.validate(); err != nil {
 		return err
@@ -38,17 +42,16 @@ func Sign(cfg *ComponentSignConfig, remote *Remote) error {
 	}
 
 	signReg := signing.DefaultRegistry()
-	issuer := "kyma-project.io/cli"
 
 	key, err := privateKey(cfg.KeyPath)
 	if err != nil {
 		return err
 	}
 
-	signReg.RegisterPrivateKey(cfg.SignatureName, key)
+	signReg.RegisterPrivateKey(SignatureName, key)
 
-	if idx := cva.GetDescriptor().GetSignatureIndex(cfg.SignatureName); idx < 0 {
-		return fmt.Errorf("descriptor was already signed under %s at signature index %v", cfg.SignatureName, idx)
+	if idx := cva.GetDescriptor().GetSignatureIndex(SignatureName); idx > 0 {
+		return fmt.Errorf("descriptor was already signed under %s at signature index %v", SignatureName, idx)
 	}
 
 	if err := compdesc.Sign(
@@ -57,7 +60,7 @@ func Sign(cfg *ComponentSignConfig, remote *Remote) error {
 		key,
 		signReg.GetSigner(rsa.Algorithm),
 		signReg.GetHasher(sha512.Algorithm),
-		cfg.SignatureName, issuer,
+		SignatureName, Issuer,
 	); err != nil {
 		return err
 	}
@@ -87,9 +90,9 @@ func Verify(cfg *ComponentSignConfig, remote *Remote) error {
 		return err
 	}
 
-	signReg.RegisterPublicKey(cfg.SignatureName, key)
+	signReg.RegisterPublicKey(SignatureName, key)
 
-	return compdesc.Verify(cva.GetDescriptor(), signReg, cfg.SignatureName)
+	return compdesc.Verify(cva.GetDescriptor(), signReg, SignatureName)
 }
 
 func (cfg *ComponentSignConfig) validate() error {
@@ -102,10 +105,6 @@ func (cfg *ComponentSignConfig) validate() error {
 	if cfg.KeyPath == "" {
 		return errors.New("The key path cannot be empty")
 	}
-	if cfg.SignatureName == "" {
-		return errors.New("The signature name cannot be empty")
-	}
-
 	return nil
 }
 


Test patch:
diff --git a/internal/k3d/k3d_test.go b/internal/k3d/k3d_test.go
index bf611c17..25ba53ce 100644
--- a/internal/k3d/k3d_test.go
+++ b/internal/k3d/k3d_test.go
@@ -159,7 +159,7 @@ func (suite *K3dTestSuite) TestCreateRegistry() {
 	suite.mockCmdRunner.On("Run", mock.Anything, "k3d", "registry", "create", "kyma-registry",
 		"--port", "5001").Return("", nil)
 
-	registryName, err := suite.client.CreateRegistry("5001")
+	registryName, err := suite.client.CreateRegistry("5001", []string{})
 	suite.Nil(err)
 	suite.Equal("kyma-registry:5001", registryName)
 }