External Registry

ExternalRegistry

Defines a connection to a third-party artifact registry.

Provisions the credentials and, for supported types, an Artifact Registry remote (pull-through) repository so the engine and its workloads can pull images or packages from external sources like Docker Hub or Quay.io. It does not host artifacts itself; it wires up the URL and authentication needed to reach them.

Property	Type	Description
apiVersion	string	API schema version. Pins the manifest to a specific schema contract for backward-compatibility. Must be the constant lowops.manifests.v1.
kind	string	Resource kind discriminator. Identifies this document as an ExternalRegistry so the engine routes it to the correct defaulter, validator, computer, and executor. Must be the constant ExternalRegistry.
metadata	map	Classification labels and graph linkage. Free-form key/value pairs used to classify the manifest. Certain reserved keys (e.g. name, organization) are read by the engine to resolve this manifest's identity and its place in the dependency graph.
spec	Spec	Desired external registry configuration. The authoritative, user-authored specification for this external registry. See Spec.

Spec

External registry connection details.

Connection parameters for the third-party registry: artifact format, base URL, and authentication method. Drives which secrets are created and, for AR-backed types, how the Artifact Registry remote repository is configured.

Property	Type	Description
enabled	bool	Whether this registry configuration is active. NOT YET IMPLEMENTED. Declared in the schema but currently ignored by the engine (no consumer reads it); the registry is always provisioned regardless of this value. Intended future behavior: when false, omit this configuration from the execution graph.
description	string	Human-readable description of this external registry. Optional free text describing the registry's role. For AR-backed types it is propagated onto the provisioned Artifact Registry remote repository's description; it is also used as context by AI assistants when reasoning about the manifest.
type	string	Artifact format hosted by the registry. Selects the connection protocol and credential-injection pattern the engine uses. Types BUF and DART are handled via direct token auth, while other types provision an Artifact Registry remote (pull-through) repository. Must be one of DOCKER, HELM, MAVEN, NPM, PYTHON, GO, DART, or BUF.
url	string	Base endpoint of the external registry. Required. The upstream URL used for artifact pulls and dependency resolution. Recorded as the computed publish URL and passed to the Artifact Registry remote repository for AR-backed types.
authentication	string	Authentication method for the registry. Selects how the engine provisions and injects credentials: basic creates username and password secrets, while token, bearer, and ssh create a single credential secret. When unset, no auth secrets are created (anonymous access). Must be one of bearer, token, ssh, or basic when present.