Deploy on Open Component Model

Configure Controller Credentials

Mon, 01 Jan 0001 00:00:00 +0000

Goal

Configure credentials to allow OCM Controllers to access OCM components stored in private OCI registries.

You will end up with

A Kubernetes secret containing registry credentials
OCM Controller resources configured to use these credentials
Verified access to private OCM repositories

Estimated time: ~5 minutes

Configure Custom RBAC

Mon, 01 Jan 0001 00:00:00 +0000

The OCM Kubernetes Controller Toolkit ships with the minimum RBAC permissions needed to manage its own custom resources (Repository, Component, Resource, Deployer, NamespacedDeployer). It does not include permissions for the objects your deployers create, such as kro ResourceGraphDefinitions. You grant those yourself, and who needs which verbs depends on the deployer kind:

Discover Component Graphs

Mon, 01 Jan 0001 00:00:00 +0000

Goal

Use a Discovery resource to resolve the transitive component graph of a Component, filter it with selectors, and publish either the filtered raw descriptors or projected free-form records into the Discovery status.

Deploy with Chained kro RGDs

Mon, 01 Jan 0001 00:00:00 +0000

You have an application to run on Kubernetes. You want to ship it the same way every time: one versioned package that carries the container image and the instructions to run it. When you move that package from a development registry to production, or into an air-gapped cluster, the image references must follow automatically. You should never hand-edit a manifest to fix a registry path.

Deploy a Helm Chart with kro and GitOps

Mon, 01 Jan 0001 00:00:00 +0000

What You’ll Learn

Your application already ships as a Helm chart, and you want its delivery to be just as repeatable: one versioned OCM component that carries the chart, its container image, and the instructions to deploy it. Promote that component from a staging registry to production, or hand it to an air-gapped cluster, and the image references should update themselves. Patching a values file to correct a registry path is exactly what this avoids.

Deploy a Helm Chart with Crossplane and GitOps

Mon, 01 Jan 0001 00:00:00 +0000

What You’ll Learn

Your application ships as a Helm chart, and you want its delivery to be repeatable: one versioned OCM component that carries the chart, its container image, and the instructions to deploy it, with image references that localize themselves as the component moves between registries. This tutorial builds that deployment on Crossplane, using a CompositeResourceDefinition (XRD) plus a Composition to reconcile the deployment graph. The XRD registers the Bootstrap schema, and the Composition creates the OCM and GitOps deployer objects (Flux or Argo CD) directly. We will use Podinfo as the example application.

Deploy Kubernetes Manifests with the OCM Deployer

Mon, 01 Jan 0001 00:00:00 +0000

This guide shows how to deploy raw Kubernetes manifests from an OCM component version using the OCM Controllers’ built-in NamespacedDeployer. This approach requires only the OCM Controllers—no kro or Flux needed.

Deploy Crossplane Packages (xpkg) with OCM

Mon, 01 Jan 0001 00:00:00 +0000

In this tutorial, you package a Crossplane Configuration and the Function it depends on in an OCM component version, transfer them to the registry your cluster pulls from, and let the OCM Controllers and kro install them into Crossplane, pinned by digest.

Verify Component Signatures on Deployment

Mon, 01 Jan 0001 00:00:00 +0000

Goal

Configure the OCM Kubernetes controller to automatically verify component version signatures before reconciling resources.

You’ll end up with

A Secret holding an OCM configuration that requests signature verification
A Component resource that reconciles only if the signature verifies

Estimated time: ~5 minutes