Create and Manage Repositories

Repositories are Helm or OCI repositories that PaletteAI uses to pull Helm charts or arbitrary OCI content for use in Workload Profiles. PaletteAI supports two repository types:

• Helm Repositories — HTTP or HTTPS Helm chart repositories. Use this type for standard Helm chart registries such as Artifact Hub or a self-hosted ChartMuseum instance.
• OCI Repositories — Container registries that host Helm charts or other OCI artifacts using the oci:// protocol. Use this type for registries such as Amazon ECR, Google Artifact Registry, or Azure Container Registry. OCI Repositories can also serve as sources for Kustomizations, where the OCI artifact contains Kubernetes YAML files rather than a Helm chart.

Repositories are Project-scoped resources. Each Project manages its own set of repositories independently.

info

Repositories can also be provisioned automatically by declaring them in a Profile Bundle manifest under the workloadProfileDependencies field (helmRepositories or ociRepositories). When the Profile Bundle is imported into PaletteAI, the Profile Bundle controller creates any declared repositories that do not already exist. In this case, you do not need to create the repositories manually. Refer to the ProfileBundle CRD reference for the full field schema.

Create Repository

Add a repository to a Project so that Workload Profiles can reference charts from that source.

Prerequisites

• A user with Project editor or admin permissions.

• An existing Project.

Enablement

Helm Repository

1. Log in to PaletteAI and navigate to your Project.

2. From the left main menu, select Repositories.

3. In the top-right, select Add Repository.

4. In the Create Helm Repository dialog, use the following table to fill in the required and optional fields. Select Create when finished.

   Basic Configuration

   Parameter	Description	Required
   Name	A unique identifier for the repository within the Project. Must consist of lowercase alphanumeric characters or -, and must start and end with an alphanumeric character. Cannot exceed 63 characters. The name cannot be changed after the repository is created.	✅
   Url	The URL of the Helm repository. Must be a valid URL beginning with http:// or https:// and include at least a protocol and host (for example, https://charts.example.com).	✅
   Interval	How often PaletteAI checks the repository for updates. Enter a numeric value and select a unit: Milliseconds, Seconds, Minutes, or Hours (for example, 5 Minutes). The actual interval may vary slightly to reduce resource contention.	✅

   info

   Chart sync configuration — specifying which individual charts to sync from the repository — is only available after the repository is created. Once the repository is ready, edit it to configure chart sync settings.

   Secret Ref

   Toggle Secret Ref to configure authentication credentials for the repository.

   Parameter	Description	Required
   Authentication Type	Choose Provide username and password to create a new Kubernetes Secret, or Use existing Secret to reference a Secret that already exists in the Project namespace.	✅
   Username	The username for basic authentication. Only shown when Provide username and password is selected.	✅
   Password	The password for basic authentication. Only shown when Provide username and password is selected.	✅
   Secret Name	The name of the Kubernetes Secret to create. Only shown when Provide username and password is selected. Must be a valid DNS label.	✅
   Secret Ref Name	Select an existing Kubernetes Secret from the Project namespace. Only shown when Use existing Secret is selected.	✅

   Cert Secret Ref

   Toggle Cert Secret Ref to configure TLS certificate credentials for the repository.

   Parameter	Description	Required
   Cert Secret Type	Choose Provide CA or TLS certificates to supply certificate content directly, or Use Existing Secret to reference a Secret that already exists in the Project namespace.	✅
   Certificate content type	The type of certificate to provide. Choose TLS Certificates (tls.crt + tls.key) for client certificate authentication, CA Certificate (ca.crt) for a custom CA, or All three (tls.crt + tls.key + ca.crt). Only shown when Provide CA or TLS certificates is selected.	✅
   TLS Certificate	PEM-encoded TLS certificate (tls.crt). Shown when the content type includes TLS certificates.	✅
   TLS Key	PEM-encoded TLS private key (tls.key). Shown when the content type includes TLS certificates.	✅
   CA Certificate	PEM-encoded CA certificate (ca.crt). Shown when the content type includes a CA certificate.	✅
   Name	The name of the Kubernetes Secret to create. Only shown when Provide CA or TLS certificates is selected.	✅
   Secret Ref Name	Select an existing TLS Secret from the Project namespace. Only shown when Use Existing Secret is selected.	✅

   Annotations and Labels

   Parameter	Description	Required
   Annotations	Key-value pairs applied as Kubernetes annotations to the repository resource.	❌
   Labels	Key-value pairs applied as Kubernetes labels to the repository resource.	❌

OCI Repository

1. Log in to PaletteAI and navigate to your Project.

2. From the left main menu, select Repositories.

3. Select the OCI Repositories tab.

4. In the top-right, select Add Repository.

5. In the Create OCI Repository dialog, use the following table to fill in the required and optional fields. Select Create when finished.

   Basic Configuration

   Parameter	Description	Required
   Repository Name	A unique identifier for the repository within the Project. Must consist of lowercase alphanumeric characters or -, and must start and end with an alphanumeric character. Cannot exceed 63 characters. The name cannot be changed after the repository is created.	✅
   Url	The URL of the OCI registry. Must begin with oci:// and include at least a protocol and host (for example, oci://registry.example.com/my-charts).	✅
   Interval	How often PaletteAI checks the repository for updates. Enter a numeric value and select a unit: Milliseconds, Seconds, Minutes, or Hours (for example, 5 Minutes). The actual interval may vary slightly to reduce resource contention.	✅
   Service Account Name	The name of a Kubernetes ServiceAccount in the Project namespace whose attached image pull secrets are used for authentication. For more information, refer to the Kubernetes documentation.	❌
   Provider	The cloud provider used for authentication. Choose Generic (default), AWS, GCP, or Azure when using provider-managed authentication such as IAM roles or workload identity.	❌
   Ignore	When enabled, applies a default .sourceignore-style exclusion pattern to filter out files when pulling OCI artifacts.	❌
   Insecure	When enabled, allows connecting to an HTTP (non-TLS) container registry. Use only in non-production environments.	❌
   Timeout	The timeout for remote OCI registry operations such as pulling. Enter a numeric value and select a unit: Milliseconds, Seconds, or Minutes. Defaults to 60 Seconds.	❌

   Ref

   Toggle Ref to pin the repository to a specific OCI reference instead of always pulling the latest tag.

   Parameter	Description	Required
   Reference Type	The type of OCI reference to use. Choose Tag to pin to a specific tag, Digest to pin to an immutable digest, or SemVer to track a semver range.	✅
   Tag Value	The image tag to pull (for example, v1.2.3). Shown when Tag is selected.	✅
   Digest Value	The image digest to pull. Must be in sha256:<HASH> format. Takes precedence over SemVer when both are set. Shown when Digest is selected.	✅
   SemVer Value	A semver constraint that selects the highest matching tag (for example, ^1.0.0). Shown when SemVer is selected.	✅
   SemVer Filter	A regex pattern used to filter tags within the semver range before selecting the highest match. Shown when SemVer is selected.	✅
   Sync Chart	When enabled, PaletteAI treats this OCI repository as a Helm chart source and syncs its chart metadata for use in Workload Profiles. Enable this when the OCI repository contains a Helm chart.	❌

   Cert Secret Ref

   Toggle Cert Secret Ref to configure TLS certificate credentials for the registry connection.

   Parameter	Description	Required
   Cert Secret Type	Choose Provide CA or TLS certificates to supply certificate content directly, or Use Existing Secret to reference a Secret that already exists in the Project namespace.	✅
   Certificate content type	The type of certificate to provide. Choose TLS Certificates (tls.crt + tls.key), CA Certificate (ca.crt), or All three (tls.crt + tls.key + ca.crt). Only shown when Provide CA or TLS certificates is selected.	✅
   TLS Certificate	PEM-encoded TLS certificate (tls.crt). Shown when the content type includes TLS certificates.	✅
   TLS Key	PEM-encoded TLS private key (tls.key). Shown when the content type includes TLS certificates.	✅
   CA Certificate	PEM-encoded CA certificate (ca.crt). Shown when the content type includes a CA certificate.	✅
   Name	The name of the Kubernetes Secret to create. Only shown when Provide CA or TLS certificates is selected.	✅
   Secret Ref Name	Select an existing TLS Secret from the Project namespace. Only shown when Use Existing Secret is selected.	✅

   Secret Ref

   Toggle Secret Ref to configure authentication credentials for the OCI registry.

   Parameter	Description	Required
   Authentication Type	Choose Provide endpoint, username and password to create a new Kubernetes Secret, or Use existing Secret to reference a Secret that already exists in the Project namespace.	✅
   Endpoint	The registry endpoint URL. Only shown when Provide endpoint, username and password is selected.	✅
   Username	The username for registry authentication. Only shown when Provide endpoint, username and password is selected.	✅
   Password	The password for registry authentication. Only shown when Provide endpoint, username and password is selected.	✅
   Secret Name	The name of the Kubernetes Secret to create. Only shown when Provide endpoint, username and password is selected. Must be a valid DNS label.	✅
   Secret Ref Name	Select an existing Kubernetes Secret from the Project namespace. Only shown when Use existing Secret is selected.	✅

   Proxy Secret Ref

   Toggle Proxy Secret Ref to route OCI registry communication through an HTTP proxy.

   Parameter	Description	Required
   Authentication Type	Choose Provide endpoint, username and password to create a new proxy Secret, or Use existing Secret to reference a Secret that already exists.	✅
   Endpoint	The proxy endpoint URL. Only shown when Provide endpoint, username and password is selected.	✅
   Username	The proxy username. Only shown when Provide endpoint, username and password is selected.	✅
   Password	The proxy password. Only shown when Provide endpoint, username and password is selected.	✅
   Secret Name	The name of the Kubernetes Secret to create for the proxy. Only shown when Provide endpoint, username and password is selected. Must be a valid DNS label.	✅
   Secret Ref Name	Select an existing proxy Secret from the Project namespace. Only shown when Use existing Secret is selected.	✅

   Verify

   Toggle Verify to enable signature verification for OCI artifacts pulled from the registry using Cosign or Notation.

   Parameter	Description	Required
   Provider	The signature verification provider. Choose cosign or notation.	✅
   Match OIDC Identity	Key-value pairs that define OIDC identity matching criteria for keyless Cosign verification. An artifact's identity is verified if any matcher matches. Applicable to Cosign keyless signing only.	❌
   Secret Ref	Toggle to provide authentication credentials for the verification service. Accepts the same fields as the Secret Ref section above (Authentication Type, Endpoint, Username, Password, Secret Name, Secret Ref Name).	❌

   Annotations and Labels

   Parameter	Description	Required
   Annotations	Key-value pairs applied as Kubernetes annotations to the repository resource.	❌
   Labels	Key-value pairs applied as Kubernetes labels to the repository resource.	❌

Validate

1. Log in to PaletteAI and navigate to your Project.

2. From the left main menu, select Repositories.

3. If you created an OCI repository, select the OCI Repositories tab.

4. Verify the new repository is listed in the table with the correct Name, Endpoint, and Provider values.

Edit Repository

Update a repository's interval, authentication credentials, TLS configuration, or chart sync settings after it is created.

info

The repository name cannot be changed after creation. To use a different name, delete the existing repository and create a new one.

Prerequisites

• A user with Project editor or admin permissions.

Enablement

1. Log in to PaletteAI and navigate to your Project.

2. From the left main menu, select Repositories.

3. Select the Helm Repositories or OCI Repositories tab depending on the repository you want to edit.

4. In the repository table, select the action menu beside the repository and choose Edit.

5. In the Edit Helm Repository or Edit OCI Repository dialog, update the applicable fields. For Helm repositories, the Chart Sync Configuration section is also available when editing:

   Chart Sync Configuration (Helm Repositories Only)

   Parameter	Description	Required
   Sync All Charts	When enabled, PaletteAI syncs metadata for all charts in the repository. When disabled, you can specify individual charts to sync.	❌
   Charts to Sync	The list of individual charts to sync when Sync All Charts is disabled. Select Add Chart to add an entry. For each chart, specify the chart name and a version constraint (for example, *, ^2.0.0, >=1.0.0 <2.0.0). Select the trash icon to remove a chart entry.	❌

6. Select Save when finished.

Validate

1. Log in to PaletteAI and navigate to your Project.

2. From the left main menu, select Repositories.

3. Select the appropriate tab and verify the repository reflects the updated configuration.

Delete Repository

Remove a repository from a Project when it is no longer needed.

warning

Deleting a repository does not automatically remove Workload Profile components that reference it. Verify that no active Workload Profiles depend on the repository before deleting it.

Prerequisites

• A user with Project editor or admin permissions.

Enablement

1. Log in to PaletteAI and navigate to your Project.

2. From the left main menu, select Repositories.

3. Select the Helm Repositories or OCI Repositories tab depending on the repository you want to remove.

4. In the repository table, select the action menu beside the repository and choose Delete.

5. Confirm the deletion in the dialog that appears.

Validate

1. Log in to PaletteAI and navigate to your Project.

2. From the left main menu, select Repositories.

3. Select the appropriate tab and verify the repository is no longer listed in the table.

Next Steps

Once you have a repository, you can reference its charts when building Workload Profiles. Helm and OCI repositories can be added as sources within a Workload Profile's component stack.