Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion docs/enterprise/installing-general-requirements.mdx
Original file line number Diff line number Diff line change
Expand Up @@ -333,6 +333,6 @@ For third-party services hosted at domains not owned by Replicated, the table be
| `k8s.kurl.sh`<br/>`s3.kurl.sh` | Not Required | Not Required | Required | <p>kURL installation scripts and artifacts are served from [kurl.sh](https://kurl.sh). An application identifier is sent in a URL path, and bash scripts and binary executables are served from kurl.sh. This domain is owned by Replicated, Inc., which is headquartered in Los Angeles, CA.</p><p> For the range of IP addresses for `k8s.kurl.sh`, see [replicatedhq/ips](https://github.com/replicatedhq/ips/blob/main/ip_addresses.json#L34-L39) in GitHub.</p><p> The range of IP addresses for `s3.kurl.sh` are the same as IP addresses for the `kurl.sh` domain. For the range of IP address for `kurl.sh`, see [replicatedhq/ips](https://github.com/replicatedhq/ips/blob/main/ip_addresses.json#L28-L31) in GitHub.</p> |
| `amazonaws.com` | Not Required | Not Required | Required | `tar.gz` packages are downloaded from Amazon S3 during installations with kURL. For information about dynamically scraping the IP ranges to allowlist for accessing these packages, see [AWS IP address ranges](https://docs.aws.amazon.com/general/latest/gr/aws-ip-ranges.html#aws-ip-download) in the AWS documentation.|

&#42; Required only if the application uses the Replicated proxy service. Contact your software vendor for more information.
&#42; Required only if the application uses the Replicated proxy registry. Contact your software vendor for more information.

&#42;&#42; Required only if the application uses the Replicated registry. Contact your software vendor for more information.
2 changes: 1 addition & 1 deletion docs/intro-replicated.md
Original file line number Diff line number Diff line change
Expand Up @@ -49,7 +49,7 @@ Release channels in the Replicated Vendor Portal allow ISVs to make different ap

For more information about working with channels, see [About Channels and Releases](/vendor/releases-about).

Additionally, the Replicated proxy service grants proxy access to private application images using the customers' license. This ensures that customers have the right access to images based on the channel they are assigned. For more information about using the proxy registry, see [About the Replicated Proxy Service](/vendor/private-images-about).
Additionally, the Replicated proxy registry grants proxy access to private application images using the customers' license. This ensures that customers have the right access to images based on the channel they are assigned. For more information about using the proxy registry, see [About the Replicated Proxy Registry](/vendor/private-images-about).

### License

Expand Down
2 changes: 1 addition & 1 deletion docs/partials/proxy-service/_step-creds.mdx
Original file line number Diff line number Diff line change
@@ -1 +1 @@
Provide read-only credentials for the external private registry in your Replicated account. This allows Replicated to access the images through the proxy service. See [Add Credentials for an External Registry](packaging-private-images#add-credentials-for-an-external-registry) in _Connecting to an External Registry_.
Provide read-only credentials for the external private registry in your Replicated account. This allows Replicated to access the images through the proxy registry. See [Add Credentials for an External Registry](packaging-private-images#add-credentials-for-an-external-registry) in _Connecting to an External Registry_.
2 changes: 1 addition & 1 deletion docs/partials/proxy-service/_step-custom-domain.mdx
Original file line number Diff line number Diff line change
@@ -1 +1 @@
(Optional) Add a custom domain for the proxy service instead of `proxy.replicated.com`. See [Using Custom Domains](custom-domains-using).
(Optional) Add a custom domain for the proxy registry instead of `proxy.replicated.com`. See [Using Custom Domains](custom-domains-using).
2 changes: 1 addition & 1 deletion docs/reference/custom-resource-application.mdx
Original file line number Diff line number Diff line change
Expand Up @@ -333,7 +333,7 @@ spec:
## proxyRegistryDomain

:::important
`proxyRegistryDomain` is deprecated. For information about how to use a custom domain for the Replicated proxy service, see [Using Custom Domains](/vendor/custom-domains-using).
`proxyRegistryDomain` is deprecated. For information about how to use a custom domain for the Replicated proxy registry, see [Using Custom Domains](/vendor/custom-domains-using).
:::

<table>
Expand Down
4 changes: 2 additions & 2 deletions docs/reference/template-functions-config-context.md
Original file line number Diff line number Diff line change
Expand Up @@ -189,11 +189,11 @@ A common use case for the `LocalImageName` function is to ensure that a Kubernet

* If there is a private registry configured in the customer's environment, such as in air gapped environments, rewrite `remoteImageName` to reference the private registry locally. For example, rewrite `elasticsearch:7.6.0` as `registry.somebigbank.com/my-app/elasticsearch:7.6.0`.

* If there is no private registry configured in the customer's environment, but the image must be proxied, rewrite `remoteImageName` so that the image can be pulled through the proxy service. For example, rewrite `"quay.io/orgname/private-image:v1.2.3"` as `proxy.replicated.com/proxy/app-name/quay.io/orgname/private-image:v1.2.3`.
* If there is no private registry configured in the customer's environment, but the image must be proxied, rewrite `remoteImageName` so that the image can be pulled through the proxy registry. For example, rewrite `"quay.io/orgname/private-image:v1.2.3"` as `proxy.replicated.com/proxy/app-name/quay.io/orgname/private-image:v1.2.3`.

* If there is no private registry configured in the customer's environment and the image does not need to be proxied, return `remoteImageName` without changes.

For more information about the Replicated proxy service, see [About the Proxy Service](/vendor/private-images-about).
For more information about the Replicated proxy registry, see [About the Proxy Registry](/vendor/private-images-about).

## LocalRegistryImagePullSecret

Expand Down
2 changes: 1 addition & 1 deletion docs/release-notes/rn-app-manager.md
Original file line number Diff line number Diff line change
Expand Up @@ -909,7 +909,7 @@ Released on June 2, 2023
Support for Kubernetes: 1.24, 1.25, 1.26 and 1.27

### Improvements {#improvements-1-100-1}
* Updates the way custom domains for the Replicated registry and proxy service are used. If a default or channel-specific custom domain is configured, that custom domain is associated with a release when it is promoted to a channel. KOTS will rewrite images using that custom domain. The `replicatedRegistryDomain` and `proxyRegistryDomain` fields in the Application custom resource are deprecated but continue to work to give time to migrate to the new mechanism.
* Updates the way custom domains for the Replicated registry and proxy registry are used. If a default or channel-specific custom domain is configured, that custom domain is associated with a release when it is promoted to a channel. KOTS will rewrite images using that custom domain. The `replicatedRegistryDomain` and `proxyRegistryDomain` fields in the Application custom resource are deprecated but continue to work to give time to migrate to the new mechanism.
* Updates the rqlite/rqlite image to 7.19.0 to resolve CVE-2023-1255 with medium severity.

## 1.100.0
Expand Down
2 changes: 1 addition & 1 deletion docs/release-notes/rn-vendor-platform.md
Original file line number Diff line number Diff line change
Expand Up @@ -269,7 +269,7 @@ Released on June 25, 2024
Released on June 24, 2024

### Bug Fixes {#bug-fixes-v2024-06-24-1}
* Proxy Service no longer requires access to proxy-auth.replicated.com.
* Replicated proxy registry no longer requires access to proxy-auth.replicated.com.

## v2024.06.24-0

Expand Down
4 changes: 2 additions & 2 deletions docs/vendor/custom-domains-using.md
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
# Using Custom Domains

This topic describes how to use the Replicated Vendor Portal to add and manage custom domains to alias the Replicated registry, the Replicated proxy service, the Replicated app service, and the download portal.
This topic describes how to use the Replicated Vendor Portal to add and manage custom domains to alias the Replicated registry, the Replicated proxy registry, the Replicated app service, and the download portal.

For information about adding and managing custom domains with the Vendor API v3, see the [customHostnames](https://replicated-vendor-api.readme.io/reference/createcustomhostname) section in the Vendor API v3 documentation.

Expand Down Expand Up @@ -113,7 +113,7 @@ To reuse a custom domain for another application:

You can remove a custom domain at any time, but you should plan the transition so that you do not break any existing installations or documentation.

Removing a custom domain for the Replicated registry, proxy service, or Replicated app service will break existing installations that use the custom domain. Existing installations need to be upgraded to a version that does not use the custom domain before it can be removed safely.
Removing a custom domain for the Replicated registry, proxy registry, or Replicated app service will break existing installations that use the custom domain. Existing installations need to be upgraded to a version that does not use the custom domain before it can be removed safely.

If you remove a custom domain for the download portal, it is no longer accessible using the custom URL. You will need to point customers to an updated URL.

Expand Down
4 changes: 2 additions & 2 deletions docs/vendor/custom-domains.md
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
# About Custom Domains

This topic provides an overview and the limitations of using custom domains to alias the Replicated private registry, Replicated proxy service, Replicated app service, and the Download Portal.
This topic provides an overview and the limitations of using custom domains to alias the Replicated private registry, Replicated proxy registry, Replicated app service, and the Download Portal.

For information about configuring and managing custom domains, see [Using Custom Domains](custom-domains-using).

Expand All @@ -21,7 +21,7 @@ You can configure custom domains for the following services, so that customer-fa

- **Replicated registry:** Images and Helm charts can be pulled from the Replicated registry. By default, this registry uses the domain `registry.replicated.com`.

- **Proxy service:** Images can be proxied from external private registries using the Replicated proxy service. By default, the proxy service uses the domain `proxy.replicated.com`.
- **Proxy registry:** Images can be proxied from external private registries using the Replicated proxy registry. By default, the proxy registry uses the domain `proxy.replicated.com`.

- **Replicated app service:** Upstream application YAML and metadata, including a license ID, are pulled from replicated.app. By default, this service uses the domain `replicated.app`.

Expand Down
2 changes: 1 addition & 1 deletion docs/vendor/distributing-overview.mdx
Original file line number Diff line number Diff line change
Expand Up @@ -38,7 +38,7 @@ As shown in the diagram above:
* Replicated Compatibility Matrix can be used to quickly generate Kubernetes clusters for running application tests as part of continuous integration and continuous delivery (CI/CD) workflows.
* After testing, application releases can be promoted to a channel in the Replicated Vendor Portal to be shared with customers or internal teams.
* Customers can be assigned to channels in order to control which application releases they are able to access and install.
* Customers' unique licenses grant proxy access to private application images through the Replicated proxy service.
* Customers' unique licenses grant proxy access to private application images through the Replicated proxy registry.
* Before installation, customers can run preflight checks to verify that their environment meets installation requirements.
* Customers can install using any method, including the Helm CLI, Replicated KOTS, or any proprietary installation method already used by the ISV.
* Instance data is automatically sent to the Vendor Portal by the Replicated SDK. If the application was installed using KOTS, then KOTS also sends instance data.
Expand Down
16 changes: 8 additions & 8 deletions docs/vendor/helm-image-registry.mdx
Original file line number Diff line number Diff line change
@@ -1,23 +1,23 @@
import StepCreds from "../partials/proxy-service/_step-creds.mdx"
import StepCustomDomain from "../partials/proxy-service/_step-custom-domain.mdx"

# Using the Proxy Service with Helm Installations
# Using the Proxy Registry with Helm Installations

This topic describes how to use the Replicated proxy service to proxy images for installations with the Helm CLI. For more information about the proxy service, see [About the Replicated Proxy Service](private-images-about).
This topic describes how to use the Replicated proxy registry to proxy images for installations with the Helm CLI. For more information about the proxy registry, see [About the Replicated Proxy Registry](private-images-about).

## Overview

With the Replicated proxy service, each customer's unique license can grant proxy access to images in an external private registry. To enable the proxy service for Helm installations, you must create a Secret with `type: kubernetes.io/dockerconfigjson` to authenticate with the proxy service.
With the Replicated proxy registry, each customer's unique license can grant proxy access to images in an external private registry. To enable the proxy registry for Helm installations, you must create a Secret with `type: kubernetes.io/dockerconfigjson` to authenticate with the proxy registry.

During Helm installations, after customers provide their license ID, a `global.replicated.dockerconfigjson` field that contains a base64 encoded Docker configuration file is automatically injected in the Helm chart values. You can use this `global.replicated.dockerconfigjson` field to create the required pull secret.

For information about how Kubernetes uses the `kubernetes.io/dockerconfigjson` Secret type to authenticate to a private image registry, see [Pull an Image from a Private Registry](https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/) in the Kubernetes documentation.

## Enable the Proxy Service
## Enable the Proxy Registry

This section describes how to enable the proxy service for applications deployed with Helm, including how to use the `global.replicated.dockerconfigjson` field that is injected during application deployment to create the required pull secret.
This section describes how to enable the proxy registry for applications deployed with Helm, including how to use the `global.replicated.dockerconfigjson` field that is injected during application deployment to create the required pull secret.

To enable the proxy service:
To enable the proxy registry:

1. <StepCreds/>

Expand Down Expand Up @@ -105,7 +105,7 @@ To enable the proxy service:

1. Create a local `values.yaml` file to override the default external registry image URL with the URL for the image on `proxy.replicated.com`.

The proxy service URL has the following format: `proxy.replicated.com/proxy/APP_SLUG/EXTERNAL_REGISTRY_IMAGE_URL`
The proxy registry URL has the following format: `proxy.replicated.com/proxy/APP_SLUG/EXTERNAL_REGISTRY_IMAGE_URL`

Where:
* `APP_SLUG` is the slug of your Replicated application.
Expand All @@ -123,7 +123,7 @@ To enable the proxy service:
```

:::note
If you configured a custom domain for the proxy service, use the custom domain instead of `proxy.replicated.com`. For more information, see [Using Custom Domains](custom-domains-using).
If you configured a custom domain for the proxy registry, use the custom domain instead of `proxy.replicated.com`. For more information, see [Using Custom Domains](custom-domains-using).
:::

1. Log in to the Replicated registry and install the chart, passing the local `values.yaml` file you created with the `--values` flag. See [Installing with Helm](install-with-helm).
Expand Down
2 changes: 1 addition & 1 deletion docs/vendor/helm-native-about.mdx
Original file line number Diff line number Diff line change
Expand Up @@ -165,7 +165,7 @@ To deploy Helm charts with version `kots.io/v1beta1` of the HelmChart custom res

![Midstream directory in the Admin Console UI](/images/native-helm-midstream.png)

As shown in the screenshot above, the midstream directory also contains a Kustomization file with instructions from KOTS for all deployed resources, such as image pull secrets, image rewrites, and backup labels. For example, in the midstream Kustomization file, KOTS rewrites any private images to pull from the Replicated proxy service.
As shown in the screenshot above, the midstream directory also contains a Kustomization file with instructions from KOTS for all deployed resources, such as image pull secrets, image rewrites, and backup labels. For example, in the midstream Kustomization file, KOTS rewrites any private images to pull from the Replicated proxy registry.

The following shows an example of a midstream Kustomization file for the postgresql Helm chart:

Expand Down
Loading