Internal Container Registry Configuration - CrewAI Platform Helm Chart

The internal registry is not recommended as a primary registry. It’s recommended to use an external container registry (AWS ECR, Azure ACR, Google Artifact Registry, Harbor, etc.) for production deployments.

boolean

default:"false"

Enable or disable the internal container registry deployment.Use Cases:

Air-gapped deployments without external registry access
Development/testing environments
Pull-through cache for external registries
Storing custom crew container images

integer

default:"1"

Number of registry replicas to deploy.High Availability: For production-like environments, deploy 2+ replicas with shared storage (S3 backend).

`internalRegistry.image.*`

Registry container image configuration.

string

default:""

Container registry hosting the registry image.Default: "" (empty) - Automatically uses global.imageRegistry valueFallback Behavior:When internalRegistry.image.host is empty or not set, the chart uses global.imageRegistry via the crewai-platform.internalRegistryImageRegistry template helper.When imageNamePrefixOverride is Set:The image name is automatically simplified:

Original: proxy/crewai/dockerhub/library/registry
With imageNamePrefixOverride: "crewai/" becomes: crewai/registry

See global.imageNamePrefixOverride for details.Example:

global:
  imageRegistry: "registry.company.com"

internalRegistry:
  enabled: true
  image:
    host: "" # Automatically uses registry.company.com
    name: "proxy/crewai/dockerhub/library/registry"
    tag: "2"

string

default:"proxy/crewai/dockerhub/library/registry"

Registry container image name.Default: "proxy/crewai/dockerhub/library/registry" - Matches Replicated proxy path structurePath Transformation:When global.imageNamePrefixOverride is set, only the final component (registry) is used with the override prefix.

string

default:"2"

Registry image version tag.

string

default:"IfNotPresent"

Image pull policy for registry container.

string

default:""

Image pull secret for registry image. If empty, uses the global image.pullSecret.

string

default:"s3"

Backend storage type for registry images.Valid Values:

"s3" - Use S3-compatible object storage (recommended)
"filesystem" - Use persistent volume storage

Recommendation: Use "s3" for production-like deployments to enable multiple registry replicas and better reliability.

`internalRegistry.storage.s3.*`

S3 backend configuration (when storage.type: "s3").

string

default:""

S3 bucket name for storing registry images.Example: "crewai-registry-images"Required: When using S3 storage

string

default:""

S3 endpoint URL. Leave empty for AWS S3, or specify for S3-compatible services.Examples:

MinIO: "http://crewai-minio:9000"
Wasabi: "https://s3.wasabisys.com"
DigitalOcean Spaces: "https://nyc3.digitaloceanspaces.com"

boolean

default:"true"

Enable path-style S3 URLs (endpoint/bucket/key vs bucket.endpoint/key).Values:

true - Required for MinIO and most S3-compatible services
false - AWS S3 virtual-hosted style

boolean

default:"false"

Enable server-side encryption for stored objects.Production Recommendation: Enable for compliance and security.

boolean

default:"true"

Use HTTPS for S3 endpoint connections.Values:

true - HTTPS (recommended)
false - HTTP (only for internal/development MinIO)

string

default:"/docker/registry/v2"

Root directory prefix for all registry blobs in the S3 bucket.

`internalRegistry.persistence.*`

Filesystem storage configuration (when storage.type: "filesystem").

boolean

default:"true"

Enable persistent volume for filesystem storage.

string

default:"10Gi"

Size of persistent volume.Sizing Guidelines:

Consider container image sizes (typically 500MB - 2GB per image)
Account for multiple image versions
Add buffer for growth

Example Calculation:

50 different images × 1GB each = 50Gi
5 versions per image = 250Gi
Add 50% buffer = 375Gi

string

default:""

StorageClass for registry volume.

string

default:"keep"

Volume reclaim policy.

`internalRegistry.service.*`

Service configuration for the registry.

string

default:"ClusterIP"

Kubernetes service type.Valid Values:

"ClusterIP" - Internal cluster access only (default)
"NodePort" - Expose on node ports
"LoadBalancer" - Expose via cloud load balancer

integer

default:"5000"

Service port for registry API.

string

default:""

Specific NodePort to use (when type: NodePort).

`internalRegistry.ingress.*`

Ingress configuration for external registry access.

boolean

default:"false"

Enable ingress for the registry.Recommendation: Enable for external access, especially in air-gapped scenarios where clients need to push images.

string

default:""

Ingress class name (nginx, alb, etc.).

object

default:"{}"

Ingress annotations.Important for Registry:

internalRegistry:
  ingress:
    annotations:
      nginx.ingress.kubernetes.io/proxy-body-size: "0" # Disable body size limit
      nginx.ingress.kubernetes.io/proxy-read-timeout: "600"
      nginx.ingress.kubernetes.io/proxy-send-timeout: "600"

string

default:""

Hostname for registry ingress.Example: "registry.company.com"

string

default:"/"

Ingress path prefix.

string

default:"Prefix"

Path matching type (Prefix, Exact, ImplementationSpecific).

array

default:"[]"

TLS configuration for ingress.Example:

internalRegistry:
  ingress:
    tls:
      - secretName: registry-tls
        hosts:
          - registry.company.com

`internalRegistry.auth.*`

Authentication configuration for the registry.

boolean

default:"false"

Enable HTTP Basic Auth for registry access.Production Recommendation: Always enable authentication for registries with external access.

string

default:""

Htpasswd-formatted credential string.Generate htpasswd:

htpasswd -Bbn username password

Example Output:

admin:$2y$05$T4qhOlL.l4eJkELzvnqbNuPxjGqkj6lA9Y12345

`internalRegistry.tls.*`

TLS configuration for registry connections.

boolean

default:"false"

Enable TLS for registry connections.

string

default:""

Name of Kubernetes secret containing TLS certificate and key.Secret Format:

apiVersion: v1
kind: Secret
type: kubernetes.io/tls
data:
  tls.crt: <base64-cert>
  tls.key: <base64-key>

`internalRegistry.proxy.*`

Pull-through cache configuration.

boolean

default:"false"

Enable pull-through proxy/cache functionality.Use Case: Cache images from remote registries to reduce external bandwidth and improve pull performance.

string

default:""

Remote registry URL to proxy.Examples:

"https://registry-1.docker.io"
"https://ghcr.io"
"https://quay.io"

string

default:""

Username for remote registry authentication.

string

default:""

Password for remote registry authentication.

`internalRegistry.healthcheck.*`

Health check configuration for registry pods.

boolean

default:"true"

Enable liveness and readiness probes.

integer

default:"30"

Seconds to wait before first probe.

integer

default:"10"

Seconds between health checks.

integer

default:"5"

Probe timeout.

integer

default:"1"

Consecutive successes required.

integer

default:"3"

Consecutive failures before restart.

`internalRegistry.resources.*`

Resource limits and requests for registry container.

string

default:"1"

CPU limit for registry pod.Sizing Guidelines: Increase for high-throughput environments.

string

default:"1Gi"

Memory limit for registry pod.

string

default:"100m"

Guaranteed CPU allocation for registry pod.Tuning: Conservative for registry with S3 backend.

string

default:"128Mi"

Guaranteed memory allocation for registry pod.

object

default:"{}"

Node selector for registry pod placement.Example:

internalRegistry:
  nodeSelector:
    node-role.kubernetes.io/worker: "true"

Use Cases:

Ensure registry runs on nodes with specific capabilities
Separate registry workload from application workload

​internalRegistry.image.*

​internalRegistry.storage.s3.*

​internalRegistry.persistence.*

​internalRegistry.service.*

​internalRegistry.ingress.*

​internalRegistry.auth.*

​internalRegistry.tls.*

​internalRegistry.proxy.*

​internalRegistry.healthcheck.*

​internalRegistry.resources.*

`internalRegistry.image.*`

`internalRegistry.storage.s3.*`

`internalRegistry.persistence.*`

`internalRegistry.service.*`

`internalRegistry.ingress.*`

`internalRegistry.auth.*`

`internalRegistry.tls.*`

`internalRegistry.proxy.*`

`internalRegistry.healthcheck.*`

`internalRegistry.resources.*`