Artifact Manifest
The generated tables list the stack packages, charts and images selected by this docs edition. Stack, chart and image versions are independent. Use Consume an NVCF release to obtain the packages.
Publication pending means the catalog has no verified customer download
location for that exact artifact. Bundled charts are included in their stack
packages.
Stack archives, inventories and images are published separately. Download every selected stack archive and verify the required images before scheduling an upgrade. An available inventory or image does not establish package availability; do not substitute another stack version to bypass a pending download.
Artifacts overview
The tables group the selected artifacts by deployment plane and type. Optional components require the corresponding deployment profile.
Prepare Helm charts for Helmfile
Use the chart and image access settings to pull the selected charts directly. For a private registry, follow chart mirroring. Bundled charts remain inside their stack directories and need no separate chart publication.
Supporting images that ship from Docker Hub
These Self-Managed helpers use Docker Hub independently of global.image.
Check their egress or mirror configuration before rendering an upgrade:
The generated image tables below record the selected tags. The k8s image
provides a CLI toolbox used by two independently configured hooks. It is not a
Kubernetes server image. Retain the selected helper versions when mirroring.
Other enabled stacks and optional components use upstream registries; inspect every image in the render and generated inventory, not just this helper table.
Verify access from cluster nodes. If Docker Hub requires authentication, add
its pull secret to global.imagePullSecrets. The receipt stage forwards this
list to its bundled chart. Check that each enabled workload renders the
intended pull secret.
If you have mirrored these images into your own registry, redirect them from
your environment file
(deploy/stacks/self-managed/environments/<environment>.yaml). Set registry
and repository together, because each key falls back to its own Docker Hub
default rather than to global.image. You do not need to edit
deploy/stacks/self-managed/global.yaml.gotmpl.
Run the upstream NATS images as non-root
The stack pulls the upstream NATS server, reloader and box images from Docker
Hub by default. To run them as non-root and pin the box image by digest, merge
these values into
deploy/stacks/self-managed/environments/<environment>.yaml. Helmfile passes
these settings to the selected NATS chart; no chart or release-definition
changes are needed. This example uses NATS server 2.14.9, reloader 0.25.0, and
NATS box 0.20.1. The box pin identifies the upstream multi-platform index for
Linux AMD64 and ARM64.
The box image declares user/group 1000:1000. runAsNonRoot adds Kubernetes
enforcement; runAsUser and runAsGroup make the identity explicit. The server
pod settings also cover its reloader; neither image declares a nonroot user.
Server fsGroup assigns group 1000 to the JetStream and shared PID volumes.
The box image provides writable directories for CLI state and nsc keys.
Its default context links to read-only mounted Secrets;
use a separate XDG_CONFIG_HOME to save additional contexts. The box needs no
additional volume or fsGroup for this example.
For a private mirror, set each image’s registry and repository together and
use the mirrored tag or tag@sha256:.... Preserve the multi-platform index
when copying the box image and verify the destination digest. Unset or empty
keys retain the stack’s existing defaults; this example does not change them.
Configure global.imagePullSecrets if the destination requires authentication.
Render before installing, using your normal chart source and secrets file:
Check the StatefulSet’s server and reloader images and the box Deployment’s
full tag@digest reference and security context. Install with the normal
stack workflow, then verify in the intended Kubernetes context:
The identities should report UID/GID 1000. The CLI check uses the mounted NKey
and requires the stack’s authentication service to be ready. Expect latency
output; failed or an authorization error is a failure even if rtt exits
successfully. Check the reloader logs after a configuration update to confirm
it reloads successfully.
Use upstream cert-manager images
Merge these overrides into the Helmfile environment file
deploy/stacks/self-managed/environments/<environment>.yaml to select the upstream
cert-manager images already used by this candidate. Keep all components and
CRDs on the selected version.
For a private mirror, replace each full repository, which takes precedence
over global.image.
For authenticated mirrors, set global.imagePullSecrets for chart pods and
separate pull credentials in the ACME Issuer’s HTTP-01 solver
pod template.
Override the Cassandra images
The Cassandra server and its dynamic seed discovery container take the same
override keys, but they default to global.image. Set them when your registry
uses a different path or tag than the cassandra default under
global.image.repository:
Every registry, repository, and tag key is optional. Any key you leave
unset keeps its default: for Cassandra, registry and repository fall back
to global.image.registry and global.image.repository; for the NATS server,
reloader, NATS box, account-bootstrap and upgrade receipt images they fall back
to the Docker Hub coordinates above.
tag falls back to the version the stack pins, or to the chart’s own default
when the stack pins none.
Use the version listed in the artifact table. Verify that your cluster can
reach the registry you point each image at. If it requires authentication, add
its pull secret to global.imagePullSecrets.
The current Cassandra initialization hook uses the
nvcf-cassandra-migrations image, and the current NATS chart renders NKeys as
Secrets without an nkey job. Their legacy cassandra.initialization.image and
nats.nkeyJob.image values do not control rendered workloads. Using
alpine-k8s for those operations requires chart support rather than a
configuration-only override.
Use the upstream Vault injector image
To use the upstream injector at the same version as the NVCF mirror, merge
this opt-in example into
deploy/stacks/self-managed/environments/<environment>.yaml:
This changes only the injector distribution source.
The webhook image is separate from openbao.injector.agentImage and
openbao.server.image; keep those matched NVCF OpenBao images unchanged.
Keep the selected NVCF OpenBao server and migrations images. An upstream OpenBao image does not contain the NVCF JWT lifecycle binaries and cannot replace the bridge image during an upgrade or rollback. For NVCF 1.0.4, both JWT plugin binaries remain installed: existing mounts keep their selection, and new mounts use the target plugin. Binary availability does not mean that existing mounts have migrated. Follow the upgrade procedure before changing mount selections or removing legacy binaries.
The following tables list the complete artifact inventory.