Skip to main content

​
ankra registry

Manage the organisation’s Ankra registry. Every organisation publishes to a private project on the Ankra registry. Ankra mints the logins its own lanes use - the organisation’s ci and pull robots, and one push robot per application - and these commands cover the robot accounts you need on top of that: a login for CI you run outside Ankra, a laptop pushing an image by hand, or a cluster Ankra does not manage pulling from the project.

​
ankra registry robots

Create, list, rotate and revoke robot accounts on the organisation’s registry project. A robot is a named login with push (push and pull) or pull rights on the organisation’s project and nothing else. Its secret is shown once, when it is created or rotated; the login is also stored as the managed registry credential ankra-harbor-robot-<name>, so it can be referenced from clusters and applications like any other registry credential. Revoking a robot deletes it from the registry and drops that credential in one step.

​
ankra registry robots create

Create a robot account on the organisation’s registry project and show its secret once. The name is 2 to 32 lower-case letters, digits and hyphens. The registry login becomes robot$<project>+user-<name>. —scope push (the default) grants push and pull; —scope pull grants pull only. The secret is printed exactly once, with the docker login command that uses it - copy it now, it is not stored anywhere you can read it back from. Rotate it with ‘ankra registry robots rotate’ if it is lost or leaked.
Examples
Flags

​
ankra registry robots delete

Revoke a robot account: delete it from the registry and drop the managed credential holding its login. Everything still logging in with the robot stops working, which is the point of a revoke. Prefer ‘rotate’ when the robot should keep working under a new secret.
Examples
Flags

​
ankra registry robots get

Show one robot account: its registry login, scope, description, the managed credential holding its login, and when it was created and last rotated. The secret is never shown here; rotate the robot to get a new one.
Examples
Flags

​
ankra registry robots list

List the robot accounts created on the organisation’s registry project. Shows each robot’s name, registry login, scope, description and when it was created and last rotated. Secrets are never listed. The robots Ankra mints for its own lanes (ci, pull, one per application) are not robots you created and are not listed here; they show up as managed credentials in ‘ankra credentials list’.
Examples
Flags

​
ankra registry robots rotate

Mint a new secret for a robot account and show it once. The previous secret stops working the moment the registry answers, which makes this the response to a leaked or lost secret. Update every place that logs in with the robot afterwards. A robot the registry no longer has is minted again under the same name and scope. Asks first, because a mistyped name would take another robot’s consumers down; —yes skips the prompt for scripts.
Examples
Flags