registry
Deploys a container registry and a ChartMuseum (a Helm chart repository) in a Kubernetes cluster. Skip this command if you already have a registry. In that case use push --external-registry.
Usage
kubectl must be installed and configured for the cluster.
What It Deploys
In the namespace you choose (created if missing):
| Resource | Details |
|---|---|
registry |
Deployment and ClusterIP service on port 5000, from registry:2 |
chartmuseum |
Deployment and ClusterIP service on port 8080, from ghcr.io/helm/chartmuseum:v0.15.0 |
| Storage | Two 10Gi PersistentVolumeClaims using the cluster's default storage class, or emptyDir with --persistent=false. Size and storage class cannot be set; edit the claims with kubectl if needed |
Warning
The registry and ChartMuseum have no TLS and no authentication. They are ClusterIP services, so only workloads in the cluster can reach them, but every workload can read and overwrite images. Use this for getting started or for clusters with nothing else. For production, use a hardened registry (Harbor, Artifactory) and push --external-registry.
Both services are plain HTTP and are reachable inside the cluster only. capsailer push reaches them through a temporary kubectl port-forward.
Options
| Option | Description |
|---|---|
--namespace |
Namespace to deploy into (default capsailer-registry) |
--image |
Registry image (default registry:2) |
--chartmuseum-image |
ChartMuseum image (default ghcr.io/helm/chartmuseum:v0.15.0) |
--persistent |
Use persistent volumes (default true). Use --persistent=false for throw-away data |
--kubeconfig |
Path to the kubeconfig file |
Without Internet Access
If the cluster cannot pull registry:2 and ghcr.io/helm/chartmuseum, make the images available on the nodes first, for example by listing them in a manifest, building a bundle and loading them on the nodes, or by using --image and --chartmuseum-image with images from a registry the cluster can reach. When a images/registry_2.tar file is found in the current directory (after unpack), registry tries to load it with docker load, which only helps single-node clusters that share the Docker daemon, such as kind or minikube.
Pulling From the Registry
The registry has no TLS, so your container runtime must be allowed to pull from it over HTTP (an "insecure registry" setting in containerd or CRI-O). The --registry-url you build with must be an address the nodes can resolve and reach. The in-cluster service name works for pods, but node runtimes do not use cluster DNS, so most setups use the service's ClusterIP or a NodePort.
Examples
capsailer registry --namespace my-registry
capsailer registry --namespace my-registry --persistent=false
capsailer registry --kubeconfig /path/to/kubeconfig