Connecting the Deckhouse Platform (DP) to a container registry containing application packages is done using the PackageRepository. Once connected, DP automatically scans the registry and creates ApplicationPackageVersion objects for each discovered package version.

Example of a PackageRepository manifest:

apiVersion: deckhouse.io/v1alpha1
kind: PackageRepository
metadata:
  name: my-registry
spec:
  registry:
    repo: registry.example.com/packages
    scheme: HTTPS
    dockerCfg: <base64-encoded-docker-config>

Authentication and Scanning Interval Management

Authentication

One of the following methods can be used for authentication in the registry:

  • dockerCfg: base64-encoded Docker config JSON (~/.docker/config.json format). Preferred when the registry uses token-based authentication.

  • login + password: explicit credentials.

    spec:
  registry:
    repo: registry.example.com/packages
    scheme: HTTPS
    login: my-user
    password: my-password

If the registry uses a self-signed TLS certificate, provide it via ca:

spec:
  registry:
    repo: registry.example.com/packages
    scheme: HTTPS
    dockerCfg: <base64-encoded-docker-config>
    ca: |
      -----BEGIN CERTIFICATE-----
      ...
      -----END CERTIFICATE-----

Scan interval

By default, DP rescans the registry every 6 hours. The interval can be overridden using the scanInterval parameter:

spec:
  registry:
    repo: registry.example.com/packages
  scanInterval: 1h30m

Checking repository status

The repository’s status is displayed in the PackageRepository object’s status.

To display brief information about the status, use the following command:

d8 k get packagerepository <REPOSITORY_NAME>

Output columns:

Column Description
Phase Current state of the repository
Scan Timestamp of the last scan
MSG Message from the last scan condition
Packages Total number of packages discovered (hidden by default, use -o wide)

For detailed information about the status, use the following command:

d8 k get packagerepository <REPOSITORY_NAME> -o yaml

Key status fields:

Field Description
status.phase Current repository phase
status.lastScanTime Time of the most recent scan of any outcome
status.lastChangeTime Time of the last scan that found at least one new version
status.lastNewVersions Number of new versions found in the most recent scan
status.packagesCount Total packages in the repository
status.packages[] List of packages with name and type fields
status.conditions Detailed conditions, including LastScanSucceeded

The LastScanSucceeded condition:

d8 k get packagerepository my-registry \
  -o jsonpath='{.status.conditions[?(@.type=="LastScanSucceeded")].message}'

Viewing discovered package versions

After a successful scan, ApplicationPackageVersion objects appear in the cluster (you can use the abbreviated name apv):

d8 k get apv

Example output:

NAME                           PACKAGE     REPOSITORY   TRANSITIONTIME   METADATALOADED   MESSAGE   USEDBY
my-registry-redis-v7.2.0       redis       my-registry  5m               True
my-registry-postgres-v15.0.0   postgres    my-registry  5m               True

Filtering by package name can be done using the following command (in this example, versions of the redis package are being filtered):

d8 k get apv -l package=redis

MetadataLoaded=True means the package’s OpenAPI schema, description, and requirements were successfully loaded from the registry. A package with MetadataLoaded=False cannot be installed until the metadata is retrieved.

Additional resources