Custom add-ons
Validate and promote organization-specific Helm, OCI, Kustomize, manifest, or uploaded bundles before installation.
RC
Exact release scope. This page documents the reviewed v0.0.1 source at fcc5871. Check release status before enabling a gated capability.
Supported source types
| Source | Required immutability |
|---|---|
| Helm chart URL | Verified chart bytes, checksum/signature policy, digest-pinned rendered images. |
| OCI Helm chart | Immutable OCI digest and registry trust/auth profile. |
| Git Kustomize | Immutable 40- or 64-character commit revision; no moving branch/tag. |
| Manifest | Validated immutable manifest bundle and complete image map. |
| Upload bundle | Helm chart, Kustomize bundle, or manifest bundle with checksum and bounded size. |
Default limits
| Limit | Default |
|---|---|
| Custom add-ons per cluster | 25 |
| Images per add-on | 200 |
| Uploaded bundle | 64 MiB |
| Promotion timeout | 900 seconds |
Lifecycle
01Draft02Validating03Ready to promote04Promoted05Installing06Installed
Validation and a Harbor promotion lock are required before installation. The installed plan must reference immutable chart/bundle and image digests, approved tool versions, and secret references.
Validation contract
- ✓Archive paths cannot escape the extraction root, contain unsafe links, or exceed bounded file/size limits.
- ✓Every workload image is discovered and mapped to an approved digest-pinned registry target.
- ✓Helm/Kustomize rendering is deterministic and does not fetch unapproved runtime dependencies.
- ✓Namespace, CRD, cluster-scope, RBAC, admission webhook, storage, and host access are visible for review.
- ✓Secret values are represented only by typed references.
- ✓The plan defines resource readiness and, where appropriate, a semantic health gate.
Harbor promotion and pull posture
ClusterPilot promotes or verifies required artifacts in the managed registry before target-cluster mutation. Private registries require a generated pull Secret in each add-on namespace and a chart- or manifest-native imagePullSecrets reference.