How-to Guides on Open Component Model

Transfer Components across an Air Gap

Mon, 01 Jan 0001 00:00:00 +0000

Goal

Transfer a signed component version from a source registry into an air-gapped target registry using a CTF archive as the transport medium. An air-gapped environment is a network that is physically isolated from untrusted networks such as the public internet.

Configure Credentials for OCM Controllers

Mon, 01 Jan 0001 00:00:00 +0000

Goal

Configure credentials to allow OCM Controllers to access OCM components stored in private OCI registries.

You will end up with

A Kubernetes secret containing registry credentials
OCM Controller resources configured to use these credentials
Verified access to private OCM repositories

Estimated time: ~5 minutes

Configure Credentials for Multiple Registries

Mon, 01 Jan 0001 00:00:00 +0000

Goal

Configure OCM to authenticate against multiple OCI registries — pinning explicit credentials for specific registries while using Docker config as a catch-all fallback.

Download Resources from Component Versions

Mon, 01 Jan 0001 00:00:00 +0000

Goal

Download resources from a component version using the OCM CLI. Learn how to fetch specific resources, optionally transform them to their native format, and save them to your local filesystem.

Resolving Components across Multiple Registries

Mon, 01 Jan 0001 00:00:00 +0000

Goal

Configure an .ocmconfig file with resolver entries so the OCM CLI can recursively resolve component references stored in different OCI registries.

Transfer Helm Charts with OCM

Mon, 01 Jan 0001 00:00:00 +0000

Goal

Transfer a component version that contains a Helm chart resource sourced from a Helm repository (type helmChart with Helm/v1 access) to an OCI registry. This guide does not cover charts that are already stored as OCI artifacts.

How to use the OCM CLI container image

Mon, 01 Jan 0001 00:00:00 +0000

Goal

This How-To will show you how to use the OCM CLI container image to create and get a component version.

Add and Verify Ownership Information

Mon, 01 Jan 0001 00:00:00 +0000

Goal

Attach ownership information to a resource so that, given the resource image in a registry, anyone can trace it back to the OCM component version that owns it — then verify that link with standard registry tools.

Add Resources from HTTP URLs

Mon, 01 Jan 0001 00:00:00 +0000

Goal

Add a file served over plain HTTP or HTTPS (a release archive, a checksum, a signed binary) to a component version using the Wget/v1 type.

Add Resources from GitHub

Mon, 01 Jan 0001 00:00:00 +0000

The GitHub/v1 access type is deprecated and will be removed in a future release. For new component versions, use the Git/v1 access type instead: it works with GitHub and every other Git server. Follow the Working with Git Repositories tutorial. Keep this guide for resources that are already published with GitHub/v1.

Deploy Manifests with Deployer

Mon, 01 Jan 0001 00:00:00 +0000

This guide shows how to deploy raw Kubernetes manifests from an OCM component version using the OCM Controllers’ built-in NamespacedDeployer. This approach requires only the OCM Controllers—no kro or Flux needed.

Verify Component Versions in the Controller

Mon, 01 Jan 0001 00:00:00 +0000

Goal

Configure the OCM Kubernetes controller to automatically verify component version signatures before reconciling resources.

You’ll end up with

A Secret holding an OCM configuration that requests signature verification
A Component resource that reconciles only if the signature verifies

Estimated time: ~5 minutes

Replicate Component Versions with the Controller

Mon, 01 Jan 0001 00:00:00 +0000

Goal

Use the OCM Kubernetes controller to transfer a component version, together with the full graph of components it references (if recursion is enabled), from one OCM repository to another. The transfer re-runs automatically whenever the source Component resolves to a new version.

Discover Component Graphs

Mon, 01 Jan 0001 00:00:00 +0000

Goal

Use a Discovery resource to resolve the transitive component graph of a Component, filter it with selectors, and publish either the filtered raw descriptors or projected free-form records into the Discovery status.

Migrate a Deployer to a NamespacedDeployer

Mon, 01 Jan 0001 00:00:00 +0000

Goal

Replace a cluster-scoped Deployer with a NamespacedDeployer while the deployed objects keep running.

You’ll end up with

A NamespacedDeployer that owns and reconciles the objects the Deployer deployed
The same objects, with unchanged UIDs, no longer owned by the old Deployer

Estimated time: ~10 minutes

Model Software Products

Mon, 01 Jan 0001 00:00:00 +0000

Goal

Most products consist of multiple independently versioned services. This guide uses OCM component references to pin those services into a single Software Bill of Delivery — a versioned, auditable record of what a release contains.

Configure Custom RBAC for Deployers

Mon, 01 Jan 0001 00:00:00 +0000

The OCM Kubernetes Controller Toolkit ships with the minimum RBAC permissions needed to manage its own custom resources (Repository, Component, Resource, Deployer, NamespacedDeployer). It does not include permissions for the objects your deployers create, such as kro ResourceGraphDefinitions. You grant those yourself, and who needs which verbs depends on the deployer kind: