Set Up Registry to Load Container Images

Learn how to prepare a container registry for loading BYOK images and supporting registry authentication.

This page provides instructions for loading container images into the registry and explains how to configure authentication if your environment requires it.

Load the Container Images

Load BYOK container images into your registry and configure the deployment to pull images from that registry.

Ensure that you have the following libraries, files, and network access:
  • skopeo 1.22.0
  • Image tar archives in the source directory. Example path: appd-images
  • Network access to the target registry.

Supported Registry Types

Any container registry that implements the OCI Distribution Specification is supported, provided it uses either anonymous access or username/password-based authentication.

Before deploying Virtual Appliance, load the container images into the registry.
Note:

Go to the directory where you have extracted the deployment files.

  1. Run the following command to load OCI images from archives to your container registry:
    Note: Ensure that ./scripts/load-images.sh has executable permissions.
    CODE 
    ./scripts/load-images.sh \
  --source-dir ./images \
  --registry <registry-url>
    Option Description Required
    --source-dir DIR Directory contains *-images-*.tar and *-image-list files. Yes
    --registry URL Target registry URL. Yes
    --username USER Enter the registry username if authentication is needed. No
    --password PASS Enter the registry password if authentication is needed. No
    --insecure Allow HTTP or self-signed certificates. No
    --force Overwrite existing images. No
    --dry-run Show what happens for the given command. No
    CODE 
    # Basic usage (anonymous registry)
./scripts/load-images.sh \
  --source-dir ./appd-images \
  --registry myregistry.example.com:5000

# With authentication
./scripts/load-images.sh \
  --source-dir ./appd-images \
  --registry myregistry.example.com:5000 \
  --username admin \
  --password secretpass

# Self-signed certificate or HTTP registry
./scripts/load-images.sh \
  --source-dir ./appd-images \
  --registry myregistry.example.com:5000 \
  --insecure

# Dry run to preview
./scripts/load-images.sh \
  --source-dir ./appd-images \
  --registry myregistry.example.com:5000 \
  --dry-run
  2. Update the globals.yaml.gotmpl file with the image registry URL.
    CODE 
    global:
  imageRegistry: "custom-registry-appd-registry.apps.rosa.mycluster.openshiftapps.com"
    The Virtual Appliance pods pull images from this registry URL, which is automatically accessible to chart templates

Create Pull Secrets in Namespaces

Create image pull secrets in the namespaces that require authenticated access to your container registry.

To streamline namespaces access, set up passwordless authentication on your Kubernetes cluster.

If your registry requires authentication and passwordless authentication is not configured on your cluster, you must create pull secrets in all namespaces.
Note:

Go to the directory where you have extracted the deployment files.

  1. Go to the ./config folder to view all the namespaces used in your deployment.
    CODE 
    vi namespace.yaml

    Example Output:

    JSON 
    # Keep namespaces.yaml across BYOK bundle upgrades (same as secrets.yaml).
# On each upgrade, compare this template for new keys and add them to your file.

# Applied to every base name below unless the key is listed under namespaceFullOverrides.
namespacePrefix: ""
namespaceSuffix: ""

# Namespace for the byok-namespace-config Secret.
# Default appd-cluster stores the Secret in the resolved appd-cluster namespace
# (honors namespacePrefix / namespaceSuffix). Set another literal name (e.g. kube-system)
# only when you need the Secret in a fixed namespace; that namespace is created on sync
# if missing and does not receive prefix/suffix.
namespaceConfigSecretNamespace: appd-cluster

# Optional per-key full namespace names (skip prefix/suffix for these keys only).
namespaceFullOverrides: {}
# Example:
#   cisco-controller: legacy-controller

# Base K8s names (prefix/suffix applied unless overridden above).
namespaceOverrides:

  # ── Operators ──────────────────────────────────────────────────────────
  cert-manager:         cert-manager
  elastic-system:       elastic-system
  kafka-operator:       kafka-operator
  mysql-operator:       mysql-operator
  pg-operator:          pg-operator

  # ── Infrastructure ─────────────────────────────────────────────────────
  appd-cluster:         appd-cluster
  cisco-coredns:        cisco-coredns
  replicator:           replicator
  nfs-provisioner:      nfs-provisioner
  ingress:              ingress
  ingress-master:       ingress-master
  cisco-edge-proxy:     cisco-edge-proxy
  minio:                minio

  # ── Data Layer ─────────────────────────────────────────────────────────
  mysql:                mysql
  postgres:             postgres
  kafka:                kafka
  kafka-external:       kafka-external
  es:                   es
  es-external:          es-external
  schema-registry:      schema-registry
  redis:                redis

  # ── Authentication ─────────────────────────────────────────────────────
  authn:                authn
  authz:                authz

  # ── AppDynamics Core ───────────────────────────────────────────────────
  cisco-controller:     cisco-controller
  cisco-events:         cisco-events
  cisco-eum:            cisco-eum
  cisco-synthetic:      cisco-synthetic
  cisco-metric:         cisco-metric
  cisco-dis:            cisco-dis

  # ── Feature Modules ────────────────────────────────────────────────────
  cisco-aiops:          cisco-aiops
  cisco-secureapp:      cisco-secureapp
  cisco-atd:            cisco-atd
  cisco-uil:            cisco-uil
  cisco-mcp:            cisco-mcp
  2. Pull secrets using a script.
    1. Update the ./config/pull-secret.conf file with the registry credentials.
      CODE 
      # Secret name (will be created in each namespace)
SECRET_NAME=appd-registry-secret

# Docker registry URL
REGISTRY_SERVER=myregistry.example.com:5000

# Registry credentials
REGISTRY_USERNAME=myuser
REGISTRY_PASSWORD=mypassword

# Optional email
REGISTRY_EMAIL=admin@example.com
    2. Run the ./scripts/create-pull-secrets.sh script.
      The following are the available options to run this script:
      Option Description
      --dry-run Shows you a preview without creating secrets.
      --server URL Overrides the registry server.
      --username USER Overrides the username.
      --password PASS Overrides the password.
      --secret-name NAME Overrides the secret name.
      Example:
      CODE 
      # Using config file
./scripts/create-pull-secrets.sh

# Override via command line
./scripts/create-pull-secrets.sh \
  --server myregistry.example.com:5000 \
  --username admin \
  --password secret123

# Dry run
./scripts/create-pull-secrets.sh --dry-run
    3. Specify the SECRET_NAME you entered in the pull-secret.conf file to link the registry from the globals.yaml.gotmpl file.
      CODE 
      global:
  imagePullSecrets:
    - name: appd-registry-secret