Skip to main content

Add OCI Packs Registry

You can add an OCI Pack registry to Palette and use the packs in your cluster profiles. OCI Pack registries are different from the legacy Pack registries. To interact with an OCI Pack registry, you use a tool, such as Oras CLI, to push and pull packs to and from the registry.

tip

For guidance on how to add a custom pack to an OCI pack registry, check out the Deploy a Custom Pack tutorial.

Prerequisites​

  • Tenant admin access to Palette.

  • Credentials to access the OCI registry. If you are using an Amazon Elastic Container Registry (ECR), you must have the AWS credentials to an IAM user or add a trust relationship to an IAM role so that Palette can access the registry.

  • If you are using Azure Container Registry (ACR), Azure recommends using a service principal for automated pull access. The service principal must have at least the AcrPull role or the Container Registry Repository Reader role, depending on the registry's role assignment permissions mode. Refer to the Azure Container Registry Entra permissions and role assignments overview for further details. Use the service principal's Application (client) ID as the registry Username and its client secret Value as the registry Password when configuring the registry in Palette.

  • If the OCI registry is using a self-signed certificate, or a certificate that is not signed by a trusted certificate authority (CA), you will need the certificate to add the registry to Palette.

  • If you are using an Amazon ECR and your Palette or Palette VerteX instance is installed in an airgapped environment or an environment with limited internet access, you must whitelist the S3 endpoint that corresponds to the region of your Amazon ECR. This is because image layers are stored in S3, not the registry. The S3 endpoint uses the following format. Replace <region> with the region your ECR is hosted in.

    prod-<region>-starport-layer-bucket.s3.<region>.amazonaws.com
    Example S3 endpoint
    prod-us-east-1-starport-layer-bucket.s3.us-east-1.amazonaws.com

  • If you are using an Amazon ECR, ensure you have the following Identity Access Management (IAM) permissions attached to the IAM user or IAM role that Palette will use to access the registry. You can reduce the Resource scope from * to the specific Amazon Resource Name (ARN) of the ECR you are using.

    {
      "Version": "2012-10-17",
      "Statement": [
        {
          "Sid": "VisualEditor0",
          "Effect": "Allow",
          "Action": [
            "ecr-public:DescribeRegistries",
            "ecr:DescribeImageReplicationStatus",
            "ecr:ListTagsForResource",
            "ecr:ListImages",
            "ecr:DescribeRepositories",
            "ecr:BatchCheckLayerAvailability",
            "ecr:GetLifecyclePolicy",
            "ecr-public:DescribeImageTags",
            "ecr-public:DescribeImages",
            "ecr:GetRegistryPolicy",
            "ecr-public:GetAuthorizationToken",
            "ecr:DescribeImageScanFindings",
            "ecr:GetLifecyclePolicyPreview",
            "ecr:GetDownloadUrlForLayer",
            "ecr-public:GetRepositoryCatalogData",
            "ecr:DescribeRegistry",
            "ecr:GetAuthorizationToken",
            "ecr-public:GetRepositoryPolicy",
            "ecr-public:DescribeRepositories",
            "ecr:BatchGetImage",
            "ecr:DescribeImages",
            "ecr-public:GetRegistryCatalogData",
            "ecr-public:ListTagsForResource",
            "ecr-public:BatchCheckLayerAvailability",
            "ecr:GetRepositoryPolicy"
          ],
          "Resource": "*"
        }
      ]
    }

Add OCI Packs Registry​

Use the following steps to add an OCI Packs registry to Palette. Select the tab that corresponds to the type of OCI registry you are adding.

  1. Log in to the Palette as a Tenant administrator.

  2. From the left Main Menu select Tenant Settings.

  3. From the Tenant Settings Menu, Select Registries.

  4. Click on the OCI Registries tab.

  5. Click Add New OCI Registry.

  6. Fill out the Name field and select Pack as the provider type.

  7. Select the OCI Authentication Type as Basic.

  8. Provide the registry URL in the Endpoint field.

  9. If your registry requires a suffix to be appended to the endpoint, specify it in the Endpoint Suffix field. This field is optional and applies to registries that do not use a standard Docker V2 API path. For example, JFrog Artifactory requires the API path and the repository key, such as artifactory/api/docker/spectro-packs-repo. Refer to OCI Packs Registry Configuration by Provider for provider-specific examples.

  10. Specify the Base Content Path. This is the path to the OCI registry where the OCI packs are stored. For example, if the OCI registry URL is https://registry.example.com and the OCI packs are stored in the internal repository, the base content path is internal. Palette syncs only the packs stored directly in this directory. Packs stored at the repository root or in child directories nested below it are not synced.

  11. Fill out the Username and Password fields with the credentials to access the registry.

    tip

    If you are using ACR, use the service principal App ID as the Username and its client secret as the Password.

  12. If your OCI registry server is using a self-signed certificate or if the server certificate is not signed by a trusted CA, check the Insecure Skip TLS Verify box to skip verifying the x509 certificate, and click Upload file to upload the certificate.

  13. Click Confirm to complete adding the registry.

Validate​

Use the following steps to validate that the OCI registry is added to Palette correctly.

  1. Log in to the Palette.

  2. From the left Main Menu, click on Profiles.

  3. Click Add Cluster Profile.

  4. Provide a name and select the type Add-on.

  5. In the following screen, click Add New Pack.

  6. Verify the OCI Pack registry you added is displayed in the filter Registry drop-down Menu.

All the Packs in the OCI registry are displayed below, sorted by category. You can filter the Packs by Type or search for a specific Pack by name.