Security model

This page sets out what the registry lets you do, who can reach your images, and how its credentials behave. It states only what the platform enforces today.

What you can and cannot do

You can:

push and pull with any OCI client: Docker, Podman, Helm, crane, cosign and others;
store container images, multi-platform images, Helm charts and signatures;
manage the registry, its cluster connections, access tokens, repositories, images and tags through the console, the kupe CLI, the Kupe API and Terraform;
set a storage limit below your plan’s and change it at any time;
connect each of your clusters, so every pod in it can pull, and give up to 10 namespaces of a connection, and 20 across the registry, a Secret to push with;
create up to 50 access tokens, pull only or push and pull, each lasting 1 to 365 days.

You cannot:

have more than one registry per tenant;
reach a registry web interface or a registry REST API, or hold a registry account of your own: the only registry endpoints are the push and pull API at registry.kupe.cloud;
limit pulls to some namespaces of a connected cluster: a connection covers the whole cluster;
push past your storage limit: pushes are refused until you delete images or raise the limit, while pulls carry on;
set tag retention rules or make tags immutable: any credential with push access can move a tag, and an admin can delete one;
delete images with an access token or a push Secret: deleting is done through the console, the CLI, the API or Terraform, by a tenant admin.

Untagged images stay until you delete them, and count towards your storage limit. The registry does not scan images; vulnerability reports cover the workloads running in your clusters (see Vulnerability scanning).

Registry access

The push and pull API is available at registry.kupe.cloud. Manage the registry through the Kupe console, CLI, API or Terraform. Access uses your Kupe account and the credentials described below, with no separate registry account to manage.

Who can reach your images

Your tenant members, access tokens, and connected clusters can access your registry according to their permissions. Other tenants cannot access your images.

Credentials

Login sessions (kupe registry login) are only for a person signed in with kupe auth login. A request made with an API key is refused with session_requires_user. A session lasts 12 hours, pushes and pulls for an admin and pulls for a readonly member, and each member holds at most 5.
Access tokens are pull only or push and pull. The secret is shown once, when the token is created, and Kupe keeps no copy. It starts with kupecr_, so secret scanners can recognise one that leaks.
Cluster connections pull with a credential that never enters your cluster. Push namespaces hold a Secret that can pull from and push to every repository in your registry, including replacing existing tags.

When a member leaves the tenant, every access token and login session they created is revoked. When an admin becomes a readonly member, the tokens and sessions they created that can push are revoked; their pull-only ones keep working.

A previously issued registry session may remain usable for up to 30 minutes after revoking access. New sign-ins stop immediately.

Push Secrets grant access to every repository in your registry. Anyone able to read Secrets or run pods in a push namespace can use them; restrict those namespaces.

Deletion and retention

A deleted tag, image, repository or registry cannot be restored.
Deleting the registry deletes every image in it. Deletion protection is on by default, and a tenant cannot be deleted while it has a registry.
The record of pushes and pulls behind Last used and the dashboard’s activity panels is kept for 30 days.

Reporting a problem

Report a security issue to security@kupe.cloud. Support lists the other contacts.