Custom Container Registry for App Images

By default, the images that are created as a result of Dash apps being deployed to Dash Enterprise are stored in a Distribution container registry within the Dash Enterprise namespace.

Dash Enterprise can integrate with custom container registries to allow you to instead store Dash app images in a registry that is external to Dash Enterprise.
The custom container registry that you integrate can be internal or external to the Kubernetes cluster where Dash Enterprise is installed.

When you integrate a custom container registry, you are responsible for its maintenance operations.

Prerequisites

• The container registry must conform to the Docker Registry HTTP API v2 standard and support “create on push”. The following are supported:
• Artifactory
• Azure Container Registry (ACR)
• Docker Hub
• Google Artifact Registry
• Quay
• Sonatype Nexus
• We recommend that the container registry use a certificate from a globally trusted CA, but it can also be an internal CA as long as it is configured on the cluster nodes.
• The container registry must be reachable from the Kubernetes cluster where Dash Enterprise is installed. Dash Enterprise does not perform any validation on the network access.
• Read/write credentials to the container registry.
• kubectl access to the Kubernetes cluster where Dash Enterprise is installed.
• Permission to manage the Kubernetes cluster where Dash Enterprise is installed in an administrator capacity.

Integrating a Container Registry for App Images

Integrating a container registry for Dash app images can be done at installation time or post-installation.

To integrate a container registry:

1. If you haven’t already, create namespace-scoped Kubernetes pull and push secrets for your container registry credentials. The push secret requires read/write access whereas the pull secret can have read-only access. (Alternatively, if you don’t want to manage two secrets, you can use a single secret for both push and pull as long as it has read/write access). See the Kubernetes documentation for help creating these secrets.

2. Add the following lines to your custom values file and replace the placeholder values with your container registry information:
   yaml registry: mode: external external: # -- External registry host (e.g., my-registry.company.com, docker.io) host: "<registry-host>" # -- External registry port (optional, defaults to standard ports: 443 for HTTPS, 80 for HTTP) port: "" # -- Use HTTPS for external registry secure: true # -- Optional subpath for external registry (e.g., pathA/pathB for docker.io/pathA/pathB/image:tag) subpath: "" # -- External registry secrets secrets: # -- Name of existing secret for registry pull operations pullSecret: "<pull-secret-name>" # -- Name of existing secret for registry push operations pushSecret: "<push-secret-name>" # -- Verify external registry credentials (1=enabled, 0=disabled) verify: 1

Tip: With verify: 1, incorrect credentials to the container registry will prevent Dash Enterprise from starting normally. To check whether an issue is due to incorrect credentials, inspect the de-worker logs with kubectl logs -n {NAMESPACE} -l app=de-worker -c validate-external-registry.

3. If performing this integration as part of your Dash Enterprise installation, continue with your installation. If Dash Enterprise is already installed, apply the change:
   sh helm upgrade $RELEASE_NAME -f custom-values.yaml \ --namespace $NAMESPACE \ --reset-then-reuse-values
   changing custom-values.yaml if you have named your custom values file differently, and providing its path if not running the installation from the directory where the custom values file is located.