Skip to main content
Ankra Applications generates a GitHub Actions pipeline that builds your source repository, scans the image, and publishes it to your organisation’s private registry. The generated Kubernetes manifests already reference that image and the matching pull secret.
The Ankra registry is private. Ankra provisions its project, GitHub Actions credentials, and Kubernetes pull credentials automatically.

​
How it works

1

Connect the repository

Create an Application from a GitHub repository. Ankra analyses the source and prepares the missing Dockerfile, Kubernetes manifests, and workflow.
2

Review the setup pull request

The pull request adds .github/workflows/build-and-publish.yml and manifests under .ankra/manifests/. Monorepos get one scoped workflow per application.
3

Merge and build

Merging the pull request runs the workflow. It tests the source, builds the image, pushes it to your organisation’s project on registry.ankra.cloud, and scans it with Trivy.
4

Deploy

Deploy the Application to a cluster. Ankra checks that an image was published before starting the deployment.

​
Registry authentication

Ankra installs these encrypted GitHub Actions secrets on the application repository: The generated workflow uses the secrets with docker/login-action. It does not use GITHUB_TOKEN package permissions and does not publish a public package. For Kubernetes pulls, Ankra creates an ankra-registry-pull Docker registry secret in each managed namespace. Generated Deployments include:
The same pull credential is injected into short-lived Application preview environments.

​
Existing applications

Reconcile an Application after the registry cutover. Ankra updates its image URL, replaces a legacy build workflow or manifest with the private registry version, and restores missing repository secrets. You can inspect readiness in the Application’s CI/CD tab or from the CLI:
Readiness checks the organisation registry project, both repository secrets, the workflow login target, and whether an image has been published.

​
Troubleshooting

Open the Application’s CI/CD tab. If Ankra cannot restore the repository secrets, approve the updated Ankra GitHub App Secrets permission and retry the fix.
Registry projects are provisioned automatically. The background reconciler retries missed provisioning. If readiness remains blocked after a few minutes, contact support.
Confirm that the workflow logs in to the host shown in the Application image URL and uses ANKRA_REGISTRY_USERNAME and ANKRA_REGISTRY_PASSWORD. Reconcile the Application to replace a legacy workflow.
Reconcile the Application and check the target namespace for ankra-registry-pull. Ankra rotates and reapplies pull credentials automatically.
Ankra blocks deployment until it can verify a published image in the organisation registry. Check the latest GitHub Actions run, then retry after the image push succeeds.

​
Next steps

Applications

Connect a repository and follow the Application lifecycle.

GitHub integration

Review the GitHub App permissions used by Ankra.

Pipeline Agents

Add read-only deployment and health reporting to your CI workflows.

SOPS Encryption

Encrypt other secrets stored in GitOps.