Image Registry Allowlist
See which registries Kupe allows and how audit-mode enforcement works.
Current enforcement mode
Section titled “Current enforcement mode”Audit mode. Your deploys work regardless of which registry you pull from, but the platform records every image’s registry for visibility. This mode may change to Enforce in the future. If it does, you’ll get at least 30 days’ advance notice, and the default allowlist will be large enough to cover the major public registries developers reach for. See Cluster Policies: audit vs enforce for the general policy.
Approved registries
Section titled “Approved registries”These are the registries currently on the default allowlist. If enforcement is ever flipped to blocking mode, these are the ones that continue to work without any action on your part:
| Registry | URL Pattern | Description |
|---|---|---|
| Kupe registry | registry.kupe.cloud/* |
Your tenant’s own registry |
| Docker Hub | docker.io/* |
Docker Hub (official images + community) |
| GitHub Container Registry | ghcr.io/* |
GitHub Packages: most upstream projects plus your own ghcr.io/<org>/* |
| Red Hat Quay | quay.io/* |
Red Hat, Prometheus/Grafana ecosystem, container images |
| Kubernetes | registry.k8s.io/* |
Official Kubernetes images |
| Google public | gcr.io/* |
Google-maintained public images: distroless, kaniko, and similar |
| Microsoft | mcr.microsoft.com/* |
Microsoft: .NET, SQL Server, and Azure SDKs |
| NVIDIA | nvcr.io/* |
NVIDIA NGC: GPU and ML workloads |
| AWS public | public.ecr.aws/* |
Amazon’s public ECR |
Images in your Kupe registry are allowed on every cluster. Only your tenant’s connected clusters can pull them; see Connect a cluster.
Requesting additional registries
Section titled “Requesting additional registries”The registry policy is in audit mode, so you don’t need to request anything to get a deploy through right now. If you want the platform team to add a registry to the allowlist anyway (for a future enforce-mode cutover, or for compliance reporting on your team’s behalf):
- Open a support request via the console or email support@kupe.cloud
- Include:
- The registry URL (e.g.,
your-company.jfrog.io/*) - Why the registry is needed
- Whether it applies to one cluster or all your clusters
- The registry URL (e.g.,
- The platform team reviews and adds it to the policy
Private team registries like your GitHub Container Registry at
ghcr.io/<your-org>/* are already covered by the top-level ghcr.io/*
wildcard, so no action is needed.
What remains blocked
Section titled “What remains blocked”Audit mode on registries does not loosen any other policy. Privileged
containers, hostNetwork, missing resource limits, and running as root
inside a tenant namespace are all still rejected. See
Cluster policies for the full set.
Recommendations
Section titled “Recommendations”- Pin image tags to specific versions or digests for production workloads
- Use your Kupe registry or another private registry for proprietary images
- Scan images before deploying. Kupe Cloud runs continuous vulnerability scanning automatically, and results are visible in your cluster
- Avoid untrusted community images: prefer official images from known publishers