The module lifecycle stage: Preview
The module has requirements for installation

The module lets you retrieve information about the container registry contents using the Kubernetes API. You can do this via Deckhouse CLI (d8) or kubectl.

The following capabilities are supported:

  • Getting a list of tags in the registry repositories bound to a namespace.
  • Getting detailed information for each tag.
  • Deleting tags (including automatically when a namespace is deleted)

All tags bound to a namespace are removed from the registry when that namespace is deleted.

All operations are performed using the virtual Kubernetes object type payloadrepositorytags.payload-registry.deckhouse.io (PayloadRepositoryTag). These objects cannot be created or modified via the Kubernetes API. They reflect the contents of the registry.

RBAC for PayloadRepositoryTag objects is not configured — they are available to all authenticated users. Access control for these objects is managed via PayloadRepositoryAccess objects (see RBAC and PayloadRepositoryAccess).

In the following command examples, it is assumed that you are running them on behalf of a user with the required permissions.

Getting tag information

To get information about tags, use the following command:

d8 k get payloadrepositorytags.payload-registry.deckhouse.io

Example output:

NAME                                   REPOSITORY        TAG
nb2hi4bnmvrwq3z2nrqxizltoq             http-echo         latest
orsxg5bpnb2hi4bnmvrwq3z2nrqxizltoq     test/http-echo    latest
orsxg5bpnb2hi4bnmvrwq3zshjwgc5dfon2a   test/http-echo2   latest

Here:

  • NAME: Special value used to operate on PayloadRepositoryTag objects in the Kubernetes API.
  • REPOSITORY: Path to the repository within the namespace.
  • TAG: Tag name.

To get the full address of a tag that you can use for operations such as pull, use the following command:

d8 k get payloadrepositorytags.payload-registry.deckhouse.io -o wide

Example output:

NAME                                   REPOSITORY        TAG      ADDRESS
nb2hi4bnmvrwq3z2nrqxizltoq             http-echo         latest   payload-registry.PUBLIC.DOMAIN/d8-system/http-echo:latest
orsxg5bpnb2hi4bnmvrwq3z2nrqxizltoq     test/http-echo    latest   payload-registry.PUBLIC.DOMAIN/d8-system/test/http-echo:latest
orsxg5bpnb2hi4bnmvrwq3zshjwgc5dfon2a   test/http-echo2   latest   payload-registry.PUBLIC.DOMAIN/d8-system/test/http-echo2:latest

To get information in YAML format, use the following command:

d8 k get payloadrepositorytags.payload-registry.deckhouse.io -o yaml

Example output:

apiVersion: v1
items:
- apiVersion: payload-registry.deckhouse.io/v1alpha1
  kind: PayloadRepositoryTag
  metadata:
    name: nb2hi4bnmvrwq3z2nrqxizltoq
    namespace: d8-system
  spec:
    address: payload-registry.PUBLIC.DOMAIN/d8-system/http-echo:latest
    repositoryPath: http-echo
    tag: latest
- apiVersion: payload-registry.deckhouse.io/v1alpha1
  kind: PayloadRepositoryTag
  metadata:
    name: orsxg5bpnb2hi4bnmvrwq3z2nrqxizltoq
    namespace: d8-system
  spec:
    address: payload-registry.PUBLIC.DOMAIN/d8-system/test/http-echo:latest
    repositoryPath: test/http-echo
    tag: latest
- apiVersion: payload-registry.deckhouse.io/v1alpha1
  kind: PayloadRepositoryTag
  metadata:
    name: orsxg5bpnb2hi4bnmvrwq3zshjwgc5dfon2a
    namespace: d8-system
  spec:
    address: payload-registry.PUBLIC.DOMAIN/d8-system/test/http-echo2:latest
    repositoryPath: test/http-echo2
    tag: latest
kind: List
metadata:
  resourceVersion: ""

Getting detailed information about a single tag

To get detailed information about a single tag, including the image manifest and build configuration output, use the following command:

d8 k get payloadrepositorytags.payload-registry.deckhouse.io nb2hi4bnmvrwq3z2nrqxizltoq -o yaml

Where nb2hi4bnmvrwq3z2nrqxizltoq is the tag name obtained from the tag list output.

Example output:

apiVersion: payload-registry.deckhouse.io/v1alpha1
kind: PayloadRepositoryTag
metadata:
  name: nb2hi4bnmvrwq3z2nrqxizltoq
  namespace: d8-system
spec:
  address: payload-registry.PUBLIC.DOMAIN/d8-system/http-echo:latest
  repositoryPath: http-echo
  tag: latest
status:

  # Image build configuration.
  config: 
    architecture: amd64
    config:
      Entrypoint:
      - /http-echo
      Env:
      - PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
      - SSL_CERT_FILE=/etc/ssl/certs/ca-certificates.crt
      ExposedPorts:
        3000/tcp: {}
      Labels:
        io.buildah.version: 1.42.2
        org.opencontainers.image.ref.name: unknown
        org.opencontainers.image.revision: unknown
        org.opencontainers.image.source: unknown
      User: nobody
      WorkingDir: /
    created: "2026-01-23T16:41:11.519360879Z"
    history:
    - created: "0001-01-01T00:00:00Z"
    - created: "0001-01-01T00:00:00Z"
    - created: "0001-01-01T00:00:00Z"
    - created: "0001-01-01T00:00:00Z"
    - created: "0001-01-01T00:00:00Z"
    - created: "0001-01-01T00:00:00Z"
    - created: "0001-01-01T00:00:00Z"
    - created: "0001-01-01T00:00:00Z"
    - created: "0001-01-01T00:00:00Z"
    - created: "0001-01-01T00:00:00Z"
    - created: "0001-01-01T00:00:00Z"
    - created: "0001-01-01T00:00:00Z"
    - comment: FROM gcr.io/distroless/static:latest
      created: "2026-01-23T16:41:11.140915464Z"
      created_by: '/bin/sh -c #(nop) ARG REF_NAME REVISION SOURCE_URL'
      empty_layer: true
    - created: "2026-01-23T16:41:11.161892823Z"
      created_by: '/bin/sh -c #(nop) LABEL     org.opencontainers.image.source="${SOURCE_URL}"     org.opencontainers.image.revision="${REVISION}"     org.opencontainers.image.ref.name="${REF_NAME}"'
      empty_layer: true
    - created: "2026-01-23T16:41:11.184166852Z"
      created_by: '/bin/sh -c #(nop) WORKDIR /'
      empty_layer: true
    - created: "2026-01-23T16:41:11.243252582Z"
      created_by: '/bin/sh -c #(nop) USER nobody'
      empty_layer: true
    - created: "2026-01-23T16:41:11.369436443Z"
      created_by: '/bin/sh -c #(nop) COPY file:d612754d6a13a156b826b837784bc72eebf6dfa7c4c5f31f09b427aca0d62b59
        in /      '
    - created: "2026-01-23T16:41:11.459012812Z"
      created_by: '/bin/sh -c #(nop) ENTRYPOINT ["/http-echo"]'
      empty_layer: true
    - created: "2026-01-23T16:41:11.519537463Z"
      created_by: '/bin/sh -c #(nop) EXPOSE 3000'
      empty_layer: true
    os: linux
    rootfs:
      diff_ids:
      - sha256:a33ba213ad26a605d904a741f67154f3904c74a43182c872c35f36b10fa005e0
      - sha256:8fa10c0194df9b7c054c90dbe482585f768a54428fc90a5b78a0066a123b1bba
      - sha256:4840c7c54023c867f19564429c89ddae4e9589c83dce82492183a7e9f7dab1fa
      - sha256:114dde0fefebbca13165d0da9c500a66190e497a82a53dcaabc3172d630be1e9
      - sha256:4d049f83d9cf21d1f5cc0e11deaf36df02790d0e60c1a3829538fb4b61685368
      - sha256:af5aa97ebe6ce1604747ec1e21af7136ded391bcabe4acef882e718a87c86bcc
      - sha256:6f1cdceb6a3146f0ccb986521156bef8a422cdbb0863396f7f751f575ba308f4
      - sha256:bd3cdfae1d3fdd83a2231d608969b38b82349777c2fff9a7c12d54f8ac5c9b38
      - sha256:4cde6b0bb6f50a5f255eef7b2a42162c661cf776b803225dcac9a659e396bb6b
      - sha256:1a73b54f556b477f0a8b939d13c504a3b4f4db71f7a09c63afbc10acb3de5849
      - sha256:6e7fbcf090d09b73a4aa85f9dce690d0ace73877c150b7c56955487b6e7a822a
      - sha256:33b37ab0b0901175c2699d81c10b0c887f0dff944de74763cca00c155904d6fb
      - sha256:50ee90d9e014458a23d1abf92a4090b4f1a188880983fe1680c0d5295a828a2e
      type: layers
    digest: sha256:3b385aa372769d0e0cbb5525cb7725432bc67aad65008b9a740278c637b820c4

  # Image manifest.
  manifest: 
    annotations:
      org.opencontainers.image.base.digest: sha256:b55f6779fb7990fb7db5e272c69a4cd6ea7070f3195da71b5ae163bfdbef4f76
      org.opencontainers.image.base.name: gcr.io/distroless/static:latest
      org.opencontainers.image.created: "2026-01-23T16:41:11.519360879Z"
    config:
      digest: sha256:c7c28a99a3d4690071ebaa399e158c36085c0e3835a4a5af2071a98be6285d79
      mediaType: application/vnd.oci.image.config.v1+json
      size: 2979
    layers:
    - digest: sha256:3c39c084bc4fe5ed7fa48f4333b55e7c44203dd7d4bafdecbefca072de56ae05
      mediaType: application/vnd.oci.image.layer.v1.tar+gzip
      size: 88242
    - digest: sha256:12b98db1f9a3daa07eca266140274100405e2ba33684a9cfed19227d8214a491
      mediaType: application/vnd.oci.image.layer.v1.tar+gzip
      size: 12760
    - digest: sha256:a8b224da3401c2a924df81f6bca78dcc59411d696f7e0f416a4a43b63703218a
      mediaType: application/vnd.oci.image.layer.v1.tar+gzip
      size: 470057
    - digest: sha256:864c4fb7c1f3a443ce0386a9cb14c81e4a029660e0e844e278b707839c73a5f2
      mediaType: application/vnd.oci.image.layer.v1.tar+gzip
      size: 29309
    - digest: sha256:02c91f6b395a6b06d17b8985a2db90aef7b09feedff77eff1f7c269161263a9b
      mediaType: application/vnd.oci.image.layer.v1.tar+gzip
      size: 75
    - digest: sha256:ffdf8cfdbafeabe2762d2dde33e36f1b87dfa967ae34811ff5342ebe8233eb4b
      mediaType: application/vnd.oci.image.layer.v1.tar+gzip
      size: 197
    - digest: sha256:818beb2a6ac52d3cfb90a96d84cff5123ade753aac5adc2dd8f43347f6fa74eb
      mediaType: application/vnd.oci.image.layer.v1.tar+gzip
      size: 132
    - digest: sha256:a0ce62815afcb344f5e245b1fe8026bef515df1fa3446ecc272057ba74be8bed
      mediaType: application/vnd.oci.image.layer.v1.tar+gzip
      size: 168
    - digest: sha256:83717d7c33ed99f82afbd90b8a13fe29f05c433b7c55c2d7e1f2c2df18dfd5d5
      mediaType: application/vnd.oci.image.layer.v1.tar+gzip
      size: 91
    - digest: sha256:b4aa04aa577f2b2f4b4a930e905d091b68b0719ec302b9abca710ffae50ebcaa
      mediaType: application/vnd.oci.image.layer.v1.tar+gzip
      size: 384
    - digest: sha256:4eb6e32233edf636593de3be3c09079eb36e5bc5d405f77f6a943dc65834d8c5
      mediaType: application/vnd.oci.image.layer.v1.tar+gzip
      size: 320
    - digest: sha256:fc7f59ef6392390b606462ab73167728f23fd15febc91249ca52be1d2219adbd
      mediaType: application/vnd.oci.image.layer.v1.tar+gzip
      size: 133016
    - digest: sha256:fd2ff9d4a5fc8079f53da95a9aec698ac79e45cc43863f40e870ce2beeea20ff
      mediaType: application/vnd.oci.image.layer.v1.tar+gzip
      size: 3042360
    mediaType: application/vnd.oci.image.manifest.v1+json
    schemaVersion: 2

Deleting a tag

When you delete a tag via the Kubernetes API, it will be deleted from the registry as well.

To delete a tag, use the following command:

d8 k delete payloadrepositorytags.payload-registry.deckhouse.io nb2hi4bnmvrwq3z2nrqxizltoq

Where nb2hi4bnmvrwq3z2nrqxizltoq is the tag name obtained from the tag list output.