RegistryRepository

Available

Deployed and supported. The fields and commands described here are stable within version v1alpha1.

apiVersion	registry.stackngo.io/v1alpha1
kind	RegistryRepository
Applied by	sng apply
Related commands	sng registry create NAME (generates and applies this manifest), sng registry delete NAME, sng kind list RegistryRepository, sng template gen RegistryRepository

What it is for

A RegistryRepository declares the repository <cluster>.registry.dev.stackngo.fr/<tenant>/<nom> (for example ovh-gra-0.registry.dev.stackngo.fr/<tenant>/<nom>) on its cluster's registry; it is not replicated. As long as it does not exist, the registry refuses all access to that path, whatever your rights: a repository is a deliberate act, versioned with the rest of the tenant. The manifest also sets the visibility (anonymous pull or not), tag retention, and what happens to the images when you delete the declaration. Access rights, on the other hand, come from the tenant's policies (registry:pull, registry:push, registry:delete on repository/<nom>).

Minimal example

web.yml

apiVersion: registry.stackngo.io/v1alpha1
kind: RegistryRepository
metadata:
  name: web
spec: {}

sng apply web.yml

Equivalent without a manifest: sng registry create web. Without retention, all tags are kept.

Complete annotated example

web.yml

apiVersion: registry.stackngo.io/v1alpha1
kind: RegistryRepository
metadata:
  name: web                          # OCI component: ovh-gra-0.registry.dev.stackngo.fr/<tenant>/web
spec:
  description: Images de l'application web   # free-form, at most 512 characters
  public: false                      # true: anonymous pull; push and delete always require a session
  retention:
    keepLastCount: 20                # keeps the last 20 pushed tags (excluding keepTagsRegex)
    keepDays: 90                     # keeps tags pushed less than 90 days ago
    keepTagsRegex:                   # keeps these tags forever (Go regex, at most 16)
      - '^v\d+\.\d+\.\d+$'
    deleteUntagged: true             # erases untagged images (default)
  deletionPolicy: Block              # Block (default): refuses deletion while tags remain; Delete: purge

Equivalent: sng registry create web --description "Images de l'application web" --keep-last 20 --keep-days 90 --keep-tag '^v\d+\.\d+\.\d+$'.

Fields

Cross-field validation rules

The schema rejects, as early as sng apply:

• a metadata.name that is not an OCI component: lowercase letters and digits, with ., _, or - separators between two alphanumeric characters (^[a-z0-9]+([._-][a-z0-9]+)*$);
• a description longer than 512 characters;
• keepLastCount outside 0 to 100,000, keepDays outside 0 to 3650, more than 16 keepTagsRegex;
• a deletionPolicy other than Block or Delete.

After saving, the platform also checks that each keepTagsRegex is a valid Go regular expression; otherwise the repository goes to Ready=False with the reason InvalidSpec, and its retention is not applied (everything is kept). sng registry create performs this check before sending.

A retention that only gives keepTagsRegex (without keepLastCount or keepDays) keeps all tags.

RegistryRepository

RegistryRepository déclare le dépôt d'images <tenant>/<nom> dans le registre de la plateforme. Les chemins imbriqués (<tenant>/<nom>/<suite>) ne sont pas pris en charge. Le registre refuse tout accès à un dépôt qui n'est pas déclaré.

Champ	Description	Défaut	Validation
apiVersion string	registry.stackngo.io/v1alpha1
kind string	RegistryRepository
metadata ObjectMeta	Seul metadata.name est à renseigner (nom de la ressource dans votre tenant).
spec RegistryRepositorySpec
status RegistryRepositoryStatus

RegistryRepositorySpec

RegistryRepositorySpec décrit le dépôt d'images souhaité.

Champ	Description	Défaut	Validation
description string	Description libre du dépôt (512 caractères au plus).		MaxLength: 512 Optional: {}
public boolean	Public autorise le téléchargement (pull) sans authentification. Pousser et supprimer exigent toujours une session.		Optional: {}
retention RetentionSpec	Retention définit les tags conservés. Absent : tous les tags sont conservés.		Optional: {}
deletionPolicy DeletionPolicy	DeletionPolicy : Block (défaut) refuse de supprimer un dépôt qui contient encore des tags ; Delete supprime le dépôt et toutes ses images.	Block	Enum: [Block Delete] Optional: {}

RegistryRepositoryStatus

RegistryRepositoryStatus est l'état du dépôt constaté par la plateforme.

Champ	Description	Défaut	Validation
observedGeneration integer	ObservedGeneration est la dernière version du manifeste prise en compte.
conditions Condition array	Conditions : Ready (ressource prête), Synced (registre à jour), Deleting (suppression en cours).
repository string	Repository est le chemin complet du dépôt dans le registre : <tenant>/<nom>.

RetentionSpec

RetentionSpec décrit les tags conservés. Un tag est conservé s'il correspond à KeepTagsRegex, s'il fait partie des KeepLastCount derniers poussés, ou s'il a été poussé depuis moins de KeepDays jours. Les autres tags sont supprimés automatiquement.

Champ	Description	Défaut	Validation
keepLastCount integer	KeepLastCount conserve les N tags poussés le plus récemment (0 à 100000).		Maximum: 100000 Minimum: 0 Optional: {}
keepDays integer	KeepDays conserve les tags poussés depuis moins de N jours (0 à 3650).		Maximum: 3650 Minimum: 0 Optional: {}
keepTagsRegex string array	KeepTagsRegex : expressions régulières ; les tags qui y correspondent ne sont jamais supprimés.		MaxItems: 16 Optional: {}
deleteUntagged boolean	DeleteUntagged supprime les images sans tag (défaut : true).		Optional: {}

DeletionPolicy

Type sous-jacent : string

DeletionPolicy indique ce que deviennent les images quand vous supprimez le dépôt.

Règles de validation :

• Enum: [Block Delete]

Valeur	Description
Block	DeletionPolicyBlock : la suppression reste en attente tant que le dépôt contient des tags.
Delete	DeletionPolicyDelete : toutes les images du dépôt sont supprimées avec lui.

Status and conditions

status.repository gives the full path <tenant>/<nom>.

Condition	True when	False when
Ready	the repository is declared and its spec is valid (reason Reconciled)	the spec is invalid (reason InvalidSpec)
Synced	set to True along with Ready	—
Deleting	deletion is in progress but cannot complete (DeletionBlocked, RegistryUnavailable)	— (absent outside deletion)

reason	Condition	Explanation	Action
Reconciled	Ready, Synced	Repository declared, retention applied	—
InvalidSpec	Ready	A keepTagsRegex does not compile, or the tenant name is not a valid OCI component	Fix the expression and apply again; for the tenant name, contact support
DeletionBlocked	Deleting	deletionPolicy: Block and tags remain (the message gives the count); or, with Delete, a tag was pushed during the purge	Delete the remaining tags, or switch to deletionPolicy: Delete before deleting; retried every minute
RegistryUnavailable	Deleting	The registry did not respond during deletion	Nothing: retried every minute

sng kind get RegistryRepository web shows the saved manifest, then these conditions as comments (# status:); --json gives the full status.

What happens when you apply

Creation. As soon as the manifest is applied, the repository is accessible according to your policies. It stays empty until an image is pushed.

Update. A new sng apply (or sng registry create with other flags) replaces the retention, visibility, and deletion policy. The new retention applies at the registry's next cleanup (every 24 hours); it does not restore tags that were already erased.

What happens when you delete

sng registry delete web or sng kind delete RegistryRepository web. As soon as deletion starts, the repository no longer accepts push and its retention stops applying; pull remains possible as long as the repository exists.

deletionPolicy	Tags present	Effect
Block (default)	yes	the repository stays, Deleting=True / DeletionBlocked, retried every minute
Block	no	the repository disappears
Delete	—	all tagged images are erased, then the repository disappears

Declaring a repository with the same name afterwards makes it accessible again; it is empty, since its images were purged (Delete) or erased by hand (Block).

Common errors

Symptom	Cause	Fix
sng apply rejects: metadata.name must be a valid OCI repository component	Uppercase letter, /, separator at the start or end of the name	Choose a name like shop-api or tools.v2
docker push refused (unauthorized) right after the declaration	The manifest has not been applied by the platform yet	Try again after a few moments
docker push refused even though the repository exists	No registry:push on repository/<nom>, or repository being deleted	Check the policies; a repository being deleted no longer accepts push
Old tags remain despite the retention	The cleanup has not run yet, invalid regex (InvalidSpec), or only keepTagsRegex is given	Wait for the next run; fix the regex; add keepLastCount or keepDays
The repository does not disappear after sng registry delete	deletionPolicy: Block and tags remain	Delete the tags (sng registry delete web:TAG) or redeclare with --deletion-policy Delete, then delete
Anonymous pull refused	public absent or false	public: true (sng registry create NAME --public)
invalid repository "web/cache"	Sub-paths are not supported	One repository per name: web-cache

See also

• Guides: Overview, Repositories and retention, Push and pull images
• CLI: sng registry, sng kind
• Other kinds: RegistryAccessKey, App (imagePullSecrets)
• Security: Your images are private