ankra-helm-registries

name	ankra-helm-registries
description	Connect HTTP and OCI Helm chart registries to Ankra and store least-privilege registry credentials (Harbor, Nexus, JFrog Artifactory, ChartMuseum, GHCR, Amazon ECR, Google Artifact Registry, Azure Container Registry, Docker Hub). Use when the user needs private charts, mentions Helm registries, OCI registries, or registry credentials in Ankra.

Ankra Helm Registries

Addons pull charts from a repository_url. Public charts work as-is; private charts need a registry connected to Ankra with credentials.

Registry types

• HTTP Helm repositories — classic chart servers: ChartMuseum, Harbor, Nexus, JFrog Artifactory, an S3-backed index. repository_url: https://charts.example.com.
• OCI registries — charts stored as OCI artifacts: GHCR, Amazon ECR, Google Artifact Registry, Azure Container Registry, Docker Hub. repository_url: oci://registry.example.com/charts.

Connect and use

1. Store a registry credential in Ankra (scoped, read-only where possible).
2. Reference the registry from the addon. Example with an OCI private chart:

addons:
  - name: my-app
    chart_name: my-app
    chart_version: 2.3.1
    repository_url: oci://ghcr.io/my-org/charts
    namespace: app
    # link the stored registry credential by name
    registry_credential_name: my-ghcr-credential

Manage registries and their credentials with the CLI:

ankra helm                      # manage Helm registries and registry credentials
ankra charts search <term>      # browse the chart catalog
ankra charts info <chart>       # inspect a chart and its versions

Rules

• Least privilege. Registry credentials should be read-only pull tokens, scoped to the needed repositories.
• Pin chart_version. Always pin; never resolve latest from a registry in production.
• Prefer OCI for new private registries where the backend supports it.
• Credentials live in Ankra, referenced by name from addons — never inline secrets in stack YAML.
• Verify reachability from the cluster's network before relying on a private registry in a deploy.

Related skills

• ankra-stacks-addons for the addon fields that consume a registry.
• ankra-sops-secrets if a credential must be expressed as an encrypted manifest.