Description

Provisions a cloud-managed container registry (ECR on AWS, Artifact Registry on GCP, Azure Container Registry on Azure) that mirrors the Ryvn-built container images and OCI Helm charts your environment deploys. Artifacts are copied into the mirror before a deployment rolls out, so workloads pull from a registry inside your cloud account instead of reaching Ryvn's registry at runtime.

The blueprint is standalone: install it into any environment without changing the platform blueprint. It provisions only the registry and least-privilege identities. Nothing is a static credential: the artifact copier authenticates with the cluster's workload identity (EKS Pod Identity, GKE Workload Identity, Azure Workload Identity) and nodes pull with their node identity. Secrets never appear in outputs.

Ryvn-provisioned clusters are wired automatically. For attached clusters, list the node identities (IAM role names, node service account emails, or kubelet identity object ids) under Access so nodes can pull; on AWS also provide the EKS cluster name and on Azure the cluster OIDC issuer URL so the copier's service account can be bound to its push identity.

Copied artifacts are kept by default; nothing is expired or garbage-collected.

Configuration Inputs

This blueprint accepts 9 configurable inputs to customize the installation for your environment.

registryNamestring

Base name for the registry. A random suffix is appended to keep it unique. Leave empty to derive it from the installation name.

sourceRegistryarray

Upstream registry hosts to mirror, such as registry.ryvn.app, registry.k8s.io, or docker.io. No upstream hosts are mirrored by default. Each configured host gets an explicit mirror rule. Authentication comes from the deploying service's bound Registry when the source matches its host and repository scope; other sources use anonymous access.

nodeIdentitiesarray

Node identities that must be able to pull from the registry: IAM role names on AWS, node service account emails on GCP, kubelet identity object ids on Azure. Merged with what Ryvn discovers from the cluster; required for attached clusters.

agentIdentitiesarray

Identities of the Ryvn agent that must be able to pull charts from the registry: IAM role ARNs on AWS, service account emails on GCP, managed identity object ids on Azure. Merged with what Ryvn discovers for Ryvn-provisioned clusters; required for attached clusters.

requireNodePullAccessboolean

Fail provisioning when no node identity could be resolved for pull access. Disable only when nodes already have registry access by other means.

clusterNamestring

Name of the EKS cluster running the artifact copier. Discovered automatically for Ryvn-provisioned clusters; required for attached EKS clusters so the copier's service account can be bound to its push role with EKS Pod Identity.

hubPrincipalArnstring

ARN of the Ryvn hub principal allowed to assume a read-only role for this registry. When set the registry is registered as ECR with assume-role credentials; otherwise nodes pull with their instance role.

oidcIssuerUrlstring

OIDC issuer URL of the cluster, used to federate the copier's service account. Discovered automatically for Ryvn-provisioned AKS clusters; required for attached clusters.

skustring

Azure Container Registry SKU: Basic, Standard, or Premium.

Outputs

This blueprint exposes 9 outputs that other services can reference.

registryHoststring

Registry endpoint host (e.g. 123456789012.dkr.ecr.us-east-1.amazonaws.com, us-central1-docker.pkg.dev, myregistry.azurecr.io).

destinationBasestring

Base image reference under which mirrored artifacts are pushed. The copier appends the source repository path to it.

regionstring

Cloud region or location of the registry.

registryDefinitionstring

JSON registry definition in the shape of the Ryvn registry API (`elasticContainerRegistry`, `googleArtifactRegistry`, or `genericContainerRegistry`). Contains no secrets; credentials are identity references only.

sourceMirrorsstring

JSON list of `{ host, pathPrefix }` mirror entries matching the registry API's `mirrors` field. Image references from these hosts are rewritten to this registry, with `pathPrefix` (the ECR repository prefix or the Artifact Registry `<project>/<repository>`) prepended to the source path; ACR keeps paths as-is.

environmentstring

Environment this registry belongs to. The registry is only available in this environment.

pushIdentitystring

JSON description of the workload identity the artifact copier uses to push (method, namespace, service accounts, role or identity reference). No secrets.

pullIdentitystring

JSON description of the node identities granted pull access and how they were resolved. No secrets.

copyExecutionstring

JSON configuration for running the artifact copier in this environment (namespace, service accounts, destination base, retention). Consumed by the artifact sync scheduler.