Documentation/Operate
Operate · v0.0.1

Custom add-ons

Validate and promote organization-specific Helm, OCI, Kustomize, manifest, or uploaded bundles before installation.

AudiencePlatform engineers, supply-chain ownersReading time15 minCommands in contextNo terminal requiredReviewed sourcefcc5871 · 30 July 2026
RC

Exact release scope. This page documents the reviewed v0.0.1 source at fcc5871. Check release status before enabling a gated capability.

Supported source types

SourceRequired immutability
Helm chart URLVerified chart bytes, checksum/signature policy, digest-pinned rendered images.
OCI Helm chartImmutable OCI digest and registry trust/auth profile.
Git KustomizeImmutable 40- or 64-character commit revision; no moving branch/tag.
ManifestValidated immutable manifest bundle and complete image map.
Upload bundleHelm chart, Kustomize bundle, or manifest bundle with checksum and bounded size.

Default limits

LimitDefault
Custom add-ons per cluster25
Images per add-on200
Uploaded bundle64 MiB
Promotion timeout900 seconds

Lifecycle

01Draft02Validating03Ready to promote04Promoted05Installing06Installed

Validation and a Harbor promotion lock are required before installation. The installed plan must reference immutable chart/bundle and image digests, approved tool versions, and secret references.

Validation contract

  • Archive paths cannot escape the extraction root, contain unsafe links, or exceed bounded file/size limits.
  • Every workload image is discovered and mapped to an approved digest-pinned registry target.
  • Helm/Kustomize rendering is deterministic and does not fetch unapproved runtime dependencies.
  • Namespace, CRD, cluster-scope, RBAC, admission webhook, storage, and host access are visible for review.
  • Secret values are represented only by typed references.
  • The plan defines resource readiness and, where appropriate, a semantic health gate.

Harbor promotion and pull posture

ClusterPilot promotes or verifies required artifacts in the managed registry before target-cluster mutation. Private registries require a generated pull Secret in each add-on namespace and a chart- or manifest-native imagePullSecrets reference.

Configure registry and disconnected distribution