Registry robot account

Moyai on-prem · 3 November 2026

One pull-only login per customer and environment. It reaches Moyai's registry project only, expires, and can be revoked at any time.

Moyai: issue, rotate, revoke

ankra registry robots create acme-prod --scope pull --expires-in-days 365 \
  --description "Acme Corp, production"
ankra registry robots list                 # every robot and its expiry
ankra registry robots rotate acme-prod     # new secret, same login
ankra registry robots delete acme-prod     # contract ended

The login and secret are printed once. Send them separately through a one-time secret link, never in email or chat.

Customer: log in

export ROBOT_LOGIN='robot$<project>+user-acme-prod'   # exactly as sent
read -rs ROBOT_SECRET

printf '%s' "$ROBOT_SECRET" | helm registry login registry.ankra.cloud \
  --username "$ROBOT_LOGIN" --password-stdin

for namespace in easterisland-system moyai-harbor-system; do
  kubectl create namespace "$namespace" --dry-run=client -o yaml | kubectl apply -f -
  kubectl -n "$namespace" create secret docker-registry ankra-registry-pull \
    --docker-server=registry.ankra.cloud \
    --docker-username="$ROBOT_LOGIN" --docker-password="$ROBOT_SECRET"
done

Air-gapped sites run the login on the machine that does the mirroring, not in the cluster: Helm guide.