How-to Guides on Open Component Model

Transfer Components across an Air Gap

Mon, 01 Jan 0001 00:00:00 +0000

Goal

Transfer a signed component version from a source registry into an air-gapped target registry using a CTF archive as the transport medium. An air-gapped environment is a network that is physically isolated from untrusted networks such as the public internet.

Configure Credentials for OCM Controllers

Mon, 01 Jan 0001 00:00:00 +0000

Goal

Configure credentials to allow OCM Controllers to access OCM components stored in private OCI registries.

You will end up with

A Kubernetes secret containing registry credentials
OCM Controller resources configured to use these credentials
Verified access to private OCM repositories

Estimated time: ~5 minutes

Configure Credentials for Multiple Registries

Mon, 01 Jan 0001 00:00:00 +0000

Goal

Configure OCM to authenticate against multiple OCI registries — pinning explicit credentials for specific registries while using Docker config as a catch-all fallback.

Generate Signing Keys

Mon, 01 Jan 0001 00:00:00 +0000

Goal

Generate an RSA key pair that can be used to sign and verify OCM component versions.

You’ll end up with

A private key file for signing component versions
A public key file for sharing with consumers who need to verify signatures

Estimated time: ~2 minutes

Configure Credentials for Signing

Mon, 01 Jan 0001 00:00:00 +0000

Set up credential configuration so OCM can find your signing keys when signing or verifying component versions.

You’ll end up with

A configured .ocmconfig file that OCM uses to locate your signing keys
Ability to sign and verify component versions without specifying key paths manually

Estimated time: ~3 minutes

Sign Component Versions

Mon, 01 Jan 0001 00:00:00 +0000

Goal

Sign a component version to certify its authenticity and enable downstream verification.

You’ll end up with

A component version with a cryptographic signature attached

Estimated time: ~3 minutes

Verify Component Versions

Mon, 01 Jan 0001 00:00:00 +0000

You’ll end up with

Confidence that a component version is authentic and hasn’t been tampered with

Estimated time: ~3 minutes

Download Resources from Component Versions

Mon, 01 Jan 0001 00:00:00 +0000

Goal

Download resources from a component version using the OCM CLI. Learn how to fetch specific resources, optionally transform them to their native format, and save them to your local filesystem.

Migrate Legacy Credentials

Mon, 01 Jan 0001 00:00:00 +0000

Goal

Migrate an existing legacy OCM .ocmconfig file so it works with the new OCM.

HashiCorpVault/v1, GardenerConfig/v1, and NPMConfig/v1 are not yet available in the new OCM. If you rely on these, stay on legacy OCM for now.

Migrate from Fallback to Deterministic Repository Resolvers

Mon, 01 Jan 0001 00:00:00 +0000

Goal

Replace the deprecated ocm.config.ocm.software fallback resolver configuration with the new resolvers.config.ocm.software/v1alpha1 glob-based resolvers.

The fallback resolver (ocm.config.ocm.software) is deprecated. It uses priority-based ordering with prefix matching and probes multiple repositories until one succeeds. The glob-based resolver (resolvers.config.ocm.software/v1alpha1) replaces it with first-match glob-based matching against component names, which is simpler and more efficient.

Resolving Components across Multiple Registries

Mon, 01 Jan 0001 00:00:00 +0000

Goal

Configure an .ocmconfig file with resolver entries so the OCM CLI can recursively resolve component references stored in different OCI registries.

Transfer Helm Charts with OCM

Mon, 01 Jan 0001 00:00:00 +0000

Goal

Transfer a component version that contains a Helm chart resource sourced from a Helm repository (type helmChart with Helm/v1 access) to an OCI registry. This guide does not cover charts that are already stored as OCI artifacts.

How to use the OCM CLI container image

Mon, 01 Jan 0001 00:00:00 +0000

Goal

This How-To will show you how to use the OCM CLI container image to create and get a component version.

Deploy Manifests with Deployer

Mon, 01 Jan 0001 00:00:00 +0000

This guide shows how to deploy raw Kubernetes manifests from an OCM component version using the OCM Controllers’ built-in Deployer. This approach requires only the OCM Controllers—no kro or Flux needed.

Model Software Products

Mon, 01 Jan 0001 00:00:00 +0000

Goal

Most products consist of multiple independently versioned services. This guide uses OCM component references to pin those services into a single Software Bill of Delivery — a versioned, auditable record of what a release contains.

Configure Custom RBAC for Deployers

Mon, 01 Jan 0001 00:00:00 +0000

The OCM K8s Toolkit controller, ships with the minimum RBAC permissions needed to manage its own custom resources (Repository, Component, Resource, Deployer). It does not include permissions for third-party resources that your deployers may create or manage.