feat: admin-provisioned OCI registries via config.yaml - #477
Open
tylerpotts wants to merge 21 commits into
Open
Conversation
✅ Deploy Preview for nebi-docs ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
4 tasks
tylerpotts
marked this pull request as draft
August 3, 2026 14:10
Collaborator
Author
Local mode rejects any request whose Origin header is not a loopback origin. Behind a reverse proxy on a public hostname (JupyterHub's jupyter-server-proxy in the data-science-pack), browsers send the proxy's origin on CORS-mode subresource requests - Vite emits the SPA bundle as <script type=module crossorigin> - so every JS/CSS asset request got a 403 and the UI rendered a blank page (#489). Add server.allowed_origins (NEBI_SERVER_ALLOWED_ORIGINS), a comma- separated allowlist honored by both netguard's request check and the CORS response headers, which crossorigin fetches also require.
tylerpotts
marked this pull request as ready for review
August 5, 2026 14:00
…dential support
Requirements changed: admin-provisioned OCI registries support public
registries only. Remove username/password/api_token from the config
schema, the ${VAR} env expansion (which existed only for credentials),
and the encryption step in the reconciler. A takeover of a same-named
user-created registry now clears any credentials it had stored.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #475
Summary
Admins can now provision OCI registries for all users declaratively, and remove the built-in default registry.
registries:section inconfig.yaml: aseed_defaultflag plus a list of entries (name, url, namespace, default). Entries are public registries and carry no credentials.oci_registriestable in one transaction, keyed by the unique name: created/updated, markedconfig_managed, and removed when dropped from config. Name collisions with user-created registries are taken over by config with a logged warning (any credentials the user-created row had are cleared). The upsert is concurrent-boot safe (savepoint + duplicate-key fallback) for shared-Postgres deployments.registries.seed_default: falsedisables seeding of the built-inquay.io/nebari_environmentsregistry. Independently, the seed is now one-time (tracked by a marker in a newsystem_settingstable), so deleting the default registry via the admin UI finally sticks across restarts. Existing databases get the marker backfilled without being touched.Companion chart PR for the data-science-pack (mounts this config into JupyterHub user pods): nebari-dev/data-science-pack#202
Test plan
nebi servein local mode with a config-defined registry serves it via/api/v1/registrieswithconfig_managed: true, default seed suppressed; default seed still works with no configgo test ./internal/..., frontend vitest (185 tests)