[{"data":1,"prerenderedAt":1011},["ShallowReactive",2],{"navigation_docs":3,"-configure-registry-and-airgap":136,"-configure-registry-and-airgap-surround":1006},[4,26,47,68,89,110,123],{"title":5,"path":6,"stem":7,"children":8,"page":25},"Getting Started","\u002Fgetting-started","1.getting-started",[9,13,17,21],{"title":10,"path":11,"stem":12},"What you are running","\u002Fgetting-started\u002Fwhat-you-are-running","1.getting-started\u002F1.what-you-are-running",{"title":14,"path":15,"stem":16},"Architecture","\u002Fgetting-started\u002Farchitecture","1.getting-started\u002F2.architecture",{"title":18,"path":19,"stem":20},"Prerequisites","\u002Fgetting-started\u002Fprerequisites","1.getting-started\u002F3.prerequisites",{"title":22,"path":23,"stem":24},"Quickstart","\u002Fgetting-started\u002Fquickstart","1.getting-started\u002F4.quickstart",false,{"title":27,"path":28,"stem":29,"children":30,"page":25},"Install","\u002Finstall","2.install",[31,35,39,43],{"title":32,"path":33,"stem":34},"Install the chart","\u002Finstall\u002Finstall-the-chart","2.install\u002F1.install-the-chart",{"title":36,"path":37,"stem":38},"Activation","\u002Finstall\u002Factivation","2.install\u002F2.activation",{"title":40,"path":41,"stem":42},"DNS and TLS","\u002Finstall\u002Fdns-and-tls","2.install\u002F3.dns-and-tls",{"title":44,"path":45,"stem":46},"Verify your install","\u002Finstall\u002Fverify-your-install","2.install\u002F4.verify-your-install",{"title":48,"path":49,"stem":50,"children":51,"page":25},"Configure","\u002Fconfigure","3.configure",[52,56,60,64],{"title":53,"path":54,"stem":55},"Data services","\u002Fconfigure\u002Fdata-services","3.configure\u002F1.data-services",{"title":57,"path":58,"stem":59},"Secrets","\u002Fconfigure\u002Fsecrets","3.configure\u002F2.secrets",{"title":61,"path":62,"stem":63},"Registry and air-gapped installs","\u002Fconfigure\u002Fregistry-and-airgap","3.configure\u002F3.registry-and-airgap",{"title":65,"path":66,"stem":67},"Integrations","\u002Fconfigure\u002Fintegrations","3.configure\u002F4.integrations",{"title":69,"path":70,"stem":71,"children":72,"page":25},"Licensing","\u002Flicensing","4.licensing",[73,77,81,85],{"title":74,"path":75,"stem":76},"How licensing works","\u002Flicensing\u002Fhow-licensing-works","4.licensing\u002F1.how-licensing-works",{"title":78,"path":79,"stem":80},"Your key never leaves","\u002Flicensing\u002Fyour-key-never-leaves","4.licensing\u002F2.your-key-never-leaves",{"title":82,"path":83,"stem":84},"What phones home","\u002Flicensing\u002Fwhat-phones-home","4.licensing\u002F3.what-phones-home",{"title":86,"path":87,"stem":88},"Revoke and recover","\u002Flicensing\u002Frevoke-and-recover","4.licensing\u002F4.revoke-and-recover",{"title":90,"path":91,"stem":92,"children":93,"page":25},"Operate","\u002Foperate","5.operate",[94,98,102,106],{"title":95,"path":96,"stem":97},"Upgrade","\u002Foperate\u002Fupgrade","5.operate\u002F1.upgrade",{"title":99,"path":100,"stem":101},"Backup and restore","\u002Foperate\u002Fbackup-and-restore","5.operate\u002F2.backup-and-restore",{"title":103,"path":104,"stem":105},"Observability","\u002Foperate\u002Fobservability","5.operate\u002F3.observability",{"title":107,"path":108,"stem":109},"High availability","\u002Foperate\u002Fhigh-availability","5.operate\u002F4.high-availability",{"title":111,"path":112,"stem":113,"children":114,"page":25},"Troubleshooting","\u002Ftroubleshooting","6.troubleshooting",[115,119],{"title":116,"path":117,"stem":118},"Install failures","\u002Ftroubleshooting\u002Finstall-failures","6.troubleshooting\u002F1.install-failures",{"title":120,"path":121,"stem":122},"Licensing failures","\u002Ftroubleshooting\u002Flicensing-failures","6.troubleshooting\u002F2.licensing-failures",{"title":124,"path":125,"stem":126,"children":127,"page":25},"Reference","\u002Freference","9.reference",[128,132],{"title":129,"path":130,"stem":131},"Helm values","\u002Freference\u002Fhelm-values","9.reference\u002F1.helm-values",{"title":133,"path":134,"stem":135},"Environment variables","\u002Freference\u002Fenvironment","9.reference\u002F2.environment",{"id":137,"title":61,"body":138,"description":1000,"extension":1001,"links":1002,"meta":1003,"navigation":256,"path":62,"seo":1004,"stem":63,"__hash__":1005},"docs\u002F3.configure\u002F3.registry-and-airgap.md",{"type":139,"value":140,"toc":990},"minimark",[141,145,154,159,166,282,288,295,299,302,326,355,362,453,474,494,498,505,534,540,565,571,637,646,651,657,785,789,796,910,917,921,926,929,946,959,963,977,986],[142,143,61],"h1",{"id":144},"registry-and-air-gapped-installs",[146,147,148,149,153],"p",{},"By default the chart pulls its images from ",[150,151,152],"code",{},"ghcr.io"," on every install. If your cluster cannot reach GHCR, or you want to know exactly which bytes are running, this page covers pinning and mirroring.",[155,156,158],"h2",{"id":157},"pulling-from-a-private-registry","Pulling from a private registry",[146,160,161,162,165],{},"Our images are on GHCR. If the packages you were given are private, create a ",[150,163,164],{},"dockerconfigjson"," Secret in the release namespace and name it:",[167,168,173],"pre",{"className":169,"code":170,"language":171,"meta":172,"style":172},"language-bash shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","kubectl create secret docker-registry ghcr-pull \\\n  --docker-server=ghcr.io \\\n  --docker-username=\u003Cuser> \\\n  --docker-password=\u003Ctoken> \\\n  -n my-mvno\n\nhelm upgrade --install my-mvno ... --set imagePullSecret=ghcr-pull\n","bash","",[150,174,175,201,209,227,242,251,258],{"__ignoreMap":172},[176,177,180,184,188,191,194,197],"span",{"class":178,"line":179},"line",1,[176,181,183],{"class":182},"sBMFI","kubectl",[176,185,187],{"class":186},"sfazB"," create",[176,189,190],{"class":186}," secret",[176,192,193],{"class":186}," docker-registry",[176,195,196],{"class":186}," ghcr-pull",[176,198,200],{"class":199},"sTEyZ"," \\\n",[176,202,204,207],{"class":178,"line":203},2,[176,205,206],{"class":186},"  --docker-server=ghcr.io",[176,208,200],{"class":199},[176,210,212,215,219,222,225],{"class":178,"line":211},3,[176,213,214],{"class":186},"  --docker-username=",[176,216,218],{"class":217},"sMK4o","\u003C",[176,220,221],{"class":186},"user",[176,223,224],{"class":217},">",[176,226,200],{"class":199},[176,228,230,233,235,238,240],{"class":178,"line":229},4,[176,231,232],{"class":186},"  --docker-password=",[176,234,218],{"class":217},[176,236,237],{"class":186},"token",[176,239,224],{"class":217},[176,241,200],{"class":199},[176,243,245,248],{"class":178,"line":244},5,[176,246,247],{"class":186},"  -n",[176,249,250],{"class":186}," my-mvno\n",[176,252,254],{"class":178,"line":253},6,[176,255,257],{"emptyLinePlaceholder":256},true,"\n",[176,259,261,264,267,270,273,276,279],{"class":178,"line":260},7,[176,262,263],{"class":182},"helm",[176,265,266],{"class":186}," upgrade",[176,268,269],{"class":186}," --install",[176,271,272],{"class":186}," my-mvno",[176,274,275],{"class":186}," ...",[176,277,278],{"class":186}," --set",[176,280,281],{"class":186}," imagePullSecret=ghcr-pull\n",[146,283,284,287],{},[150,285,286],{},"imagePullSecret"," is a single name, and the chart attaches it to the six pods that pull an application image: the API, the web tier, the auth service, the email worker, realtime and the license agent. The bundled Postgres, Redis and Kafka StatefulSets do not carry it, so if you mirror those images into a private registry as well, that registry has to be readable without a pull secret, or the images have to be present on the nodes already.",[146,289,290,291,294],{},"Leave it empty if the registry is public, or if you have already imported the images into the node container runtime with something like ",[150,292,293],{},"k3s ctr images import",".",[155,296,298],{"id":297},"pinning-by-digest","Pinning by digest",[146,300,301],{},"A tag can be re-pushed under you. A digest cannot. For production, and for any install you want to be able to reproduce, pin by digest.",[167,303,305],{"className":169,"code":304,"language":171,"meta":172,"style":172},"--set image.digest=sha256:\u003Capi-image-digest>\n",[150,306,307],{"__ignoreMap":172},[176,308,309,312,315,317,320,323],{"class":178,"line":179},[176,310,311],{"class":182},"--set",[176,313,314],{"class":186}," image.digest=sha256:",[176,316,218],{"class":217},[176,318,319],{"class":186},"api-image-diges",[176,321,322],{"class":199},"t",[176,324,325],{"class":217},">\n",[146,327,328,335,336,339,340,343,344,347,348,350,351,354],{},[329,330,331,334],"strong",{},[150,332,333],{},"image.digest"," pins the API image and nothing else."," This is the trap on this page. The web tier is a separate image, and it keeps resolving through ",[150,337,338],{},"image.registry",", ",[150,341,342],{},"platform.kind"," and ",[150,345,346],{},"image.tag",", so an install with only ",[150,349,333],{}," set is not a pinned install: the API is frozen and the console or storefront still floats on a tag. To pin the web tier, give ",[150,352,353],{},"app.image"," a full digest reference of its own.",[146,356,357,358,361],{},"The license agent, the email worker and the realtime service are full image references already, and they take the ",[150,359,360],{},"repo@sha256:..."," form directly. A fully pinned install sets all five:",[167,363,365],{"className":169,"code":364,"language":171,"meta":172,"style":172},"--set image.digest=sha256:\u003Cmvno-api-digest> \\\n--set app.image=ghcr.io\u002Fsolvegio\u002Fmvno@sha256:\u003Cmvno-web-digest> \\\n--set images.licenseAgent=ghcr.io\u002Fsolvegio\u002Flicense-agent@sha256:\u003Cdigest> \\\n--set images.ess=ghcr.io\u002Fsolvegio\u002Fess@sha256:\u003Cdigest> \\\n--set images.realtime=ghcr.io\u002Fsolvegio\u002Frealtime@sha256:\u003Cdigest>\n",[150,366,367,384,403,421,438],{"__ignoreMap":172},[176,368,369,371,373,375,378,380,382],{"class":178,"line":179},[176,370,311],{"class":182},[176,372,314],{"class":186},[176,374,218],{"class":217},[176,376,377],{"class":186},"mvno-api-diges",[176,379,322],{"class":199},[176,381,224],{"class":217},[176,383,200],{"class":199},[176,385,386,389,392,394,397,399,401],{"class":178,"line":203},[176,387,388],{"class":199},"--set ",[176,390,391],{"class":186},"app.image=ghcr.io\u002Fsolvegio\u002Fmvno@sha256:",[176,393,218],{"class":217},[176,395,396],{"class":186},"mvno-web-diges",[176,398,322],{"class":199},[176,400,224],{"class":217},[176,402,200],{"class":199},[176,404,405,407,410,412,415,417,419],{"class":178,"line":211},[176,406,388],{"class":199},[176,408,409],{"class":186},"images.licenseAgent=ghcr.io\u002Fsolvegio\u002Flicense-agent@sha256:",[176,411,218],{"class":217},[176,413,414],{"class":186},"diges",[176,416,322],{"class":199},[176,418,224],{"class":217},[176,420,200],{"class":199},[176,422,423,425,428,430,432,434,436],{"class":178,"line":229},[176,424,388],{"class":199},[176,426,427],{"class":186},"images.ess=ghcr.io\u002Fsolvegio\u002Fess@sha256:",[176,429,218],{"class":217},[176,431,414],{"class":186},[176,433,322],{"class":199},[176,435,224],{"class":217},[176,437,200],{"class":199},[176,439,440,442,445,447,449,451],{"class":178,"line":244},[176,441,388],{"class":199},[176,443,444],{"class":186},"images.realtime=ghcr.io\u002Fsolvegio\u002Frealtime@sha256:",[176,446,218],{"class":217},[176,448,414],{"class":186},[176,450,322],{"class":199},[176,452,325],{"class":217},[146,454,455,456,343,459,462,463,466,467,470,471,294],{},"GoTrue is structured differently: ",[150,457,458],{},"images.auth.repository",[150,460,461],{},"images.auth.tag"," (default ",[150,464,465],{},"supabase\u002Fgotrue"," at ",[150,468,469],{},"v2.188.1","). It already ships on a version tag rather than ",[150,472,473],{},"latest",[146,475,476,462,479,482,483,486,487,489,490,493],{},[150,477,478],{},"image.pullPolicy",[150,480,481],{},"IfNotPresent",") covers all five first-party workloads: the API, the web tier, the email worker, realtime and the license agent. GoTrue reads ",[150,484,485],{},"images.auth.pullPolicy"," instead. ",[150,488,481],{}," is right for digests and released tags. ",[150,491,492],{},"Always"," only earns its registry round trip if you keep re-pushing one moving tag.",[155,495,497],{"id":496},"mirroring-the-image-set","Mirroring the image set",[146,499,500,501,504],{},"On a host that can reach GHCR, copy each image into your own registry. ",[150,502,503],{},"skopeo"," preserves the digest and every architecture in the manifest list:",[167,506,508],{"className":169,"code":507,"language":171,"meta":172,"style":172},"skopeo copy --all \\\n  docker:\u002F\u002Fghcr.io\u002Fsolvegio\u002Fmvno-api:latest \\\n  docker:\u002F\u002Fregistry.acme.internal\u002Fsolvegio\u002Fmvno-api:latest\n",[150,509,510,522,529],{"__ignoreMap":172},[176,511,512,514,517,520],{"class":178,"line":179},[176,513,503],{"class":182},[176,515,516],{"class":186}," copy",[176,518,519],{"class":186}," --all",[176,521,200],{"class":199},[176,523,524,527],{"class":178,"line":203},[176,525,526],{"class":186},"  docker:\u002F\u002Fghcr.io\u002Fsolvegio\u002Fmvno-api:latest",[176,528,200],{"class":199},[176,530,531],{"class":178,"line":211},[176,532,533],{"class":186},"  docker:\u002F\u002Fregistry.acme.internal\u002Fsolvegio\u002Fmvno-api:latest\n",[146,535,536,539],{},[150,537,538],{},"crane"," does the same thing if that is what you already have:",[167,541,543],{"className":169,"code":542,"language":171,"meta":172,"style":172},"crane copy \\\n  ghcr.io\u002Fsolvegio\u002Fmvno-api:latest \\\n  registry.acme.internal\u002Fsolvegio\u002Fmvno-api:latest\n",[150,544,545,553,560],{"__ignoreMap":172},[176,546,547,549,551],{"class":178,"line":179},[176,548,538],{"class":182},[176,550,516],{"class":186},[176,552,200],{"class":199},[176,554,555,558],{"class":178,"line":203},[176,556,557],{"class":186},"  ghcr.io\u002Fsolvegio\u002Fmvno-api:latest",[176,559,200],{"class":199},[176,561,562],{"class":178,"line":211},[176,563,564],{"class":186},"  registry.acme.internal\u002Fsolvegio\u002Fmvno-api:latest\n",[146,566,567,568,570],{},"Then point the chart at the mirror. ",[150,569,338],{}," covers the API image and the derived web image. Everything else is named explicitly:",[167,572,574],{"className":169,"code":573,"language":171,"meta":172,"style":172},"--set image.registry=registry.acme.internal \\\n--set images.licenseAgent=registry.acme.internal\u002Fsolvegio\u002Flicense-agent:latest \\\n--set images.ess=registry.acme.internal\u002Fsolvegio\u002Fess:latest \\\n--set images.realtime=registry.acme.internal\u002Fsolvegio\u002Frealtime:latest \\\n--set images.auth.repository=registry.acme.internal\u002Fsupabase\u002Fgotrue \\\n--set imagePullSecret=\u003Cyour-registry-cred-secret>\n",[150,575,576,585,594,603,612,621],{"__ignoreMap":172},[176,577,578,580,583],{"class":178,"line":179},[176,579,311],{"class":182},[176,581,582],{"class":186}," image.registry=registry.acme.internal",[176,584,200],{"class":199},[176,586,587,589,592],{"class":178,"line":203},[176,588,388],{"class":199},[176,590,591],{"class":186},"images.licenseAgent=registry.acme.internal\u002Fsolvegio\u002Flicense-agent:latest",[176,593,200],{"class":199},[176,595,596,598,601],{"class":178,"line":211},[176,597,388],{"class":199},[176,599,600],{"class":186},"images.ess=registry.acme.internal\u002Fsolvegio\u002Fess:latest",[176,602,200],{"class":199},[176,604,605,607,610],{"class":178,"line":229},[176,606,388],{"class":199},[176,608,609],{"class":186},"images.realtime=registry.acme.internal\u002Fsolvegio\u002Frealtime:latest",[176,611,200],{"class":199},[176,613,614,616,619],{"class":178,"line":244},[176,615,388],{"class":199},[176,617,618],{"class":186},"images.auth.repository=registry.acme.internal\u002Fsupabase\u002Fgotrue",[176,620,200],{"class":199},[176,622,623,625,628,630,633,635],{"class":178,"line":253},[176,624,388],{"class":199},[176,626,627],{"class":186},"imagePullSecret=",[176,629,218],{"class":217},[176,631,632],{"class":186},"your-registry-cred-secre",[176,634,322],{"class":199},[176,636,325],{"class":217},[146,638,639,640,642,643,645],{},"Note that ",[150,641,458],{}," carries its own registry prefix. It does not read ",[150,644,338],{},", so a mirrored install has to name it in full or the auth pods will still try Docker Hub.",[647,648,650],"h3",{"id":649},"first-party-images","First-party images",[146,652,653,654,656],{},"Mirror the pair that matches your ",[150,655,342],{},", plus the three shared ones.",[658,659,660,676],"table",{},[661,662,663],"thead",{},[664,665,666,670,673],"tr",{},[667,668,669],"th",{},"Image",[667,671,672],{},"Value that points at it",[667,674,675],{},"Needed when",[677,678,679,709,736,751,768],"tbody",{},[664,680,681,691,704],{},[682,683,684,687,688],"td",{},[150,685,686],{},"ghcr.io\u002Fsolvegio\u002Fmvno-api"," or ",[150,689,690],{},"ghcr.io\u002Fsolvegio\u002Fmvne-api",[682,692,693,695,696,695,699,701,702],{},[150,694,338],{}," + ",[150,697,698],{},"image.repository",[150,700,346],{}," \u002F ",[150,703,333],{},[682,705,706,707,294],{},"Always. Derived from ",[150,708,342],{},[664,710,711,719,731],{},[682,712,713,687,716],{},[150,714,715],{},"ghcr.io\u002Fsolvegio\u002Fmvno",[150,717,718],{},"ghcr.io\u002Fsolvegio\u002Fmvne",[682,720,721,723,724,339,726,343,728,730],{},[150,722,353],{}," (or derived from ",[150,725,338],{},[150,727,342],{},[150,729,346],{},")",[682,732,733],{},[150,734,735],{},"app.enabled=true",[664,737,738,743,748],{},[682,739,740],{},[150,741,742],{},"ghcr.io\u002Fsolvegio\u002Flicense-agent",[682,744,745],{},[150,746,747],{},"images.licenseAgent",[682,749,750],{},"Always.",[664,752,753,758,763],{},[682,754,755],{},[150,756,757],{},"ghcr.io\u002Fsolvegio\u002Fess",[682,759,760],{},[150,761,762],{},"images.ess",[682,764,765],{},[150,766,767],{},"ess.enabled=true",[664,769,770,775,780],{},[682,771,772],{},[150,773,774],{},"ghcr.io\u002Fsolvegio\u002Frealtime",[682,776,777],{},[150,778,779],{},"images.realtime",[682,781,782],{},[150,783,784],{},"realtime.enabled=true",[647,786,788],{"id":787},"everything-else-the-chart-pulls","Everything else the chart pulls",[146,790,791,792,795],{},"An air-gapped install needs these too, or the pods stay in ",[150,793,794],{},"ImagePullBackOff"," while the first-party images sit there mirrored and ready.",[658,797,798,809],{},[661,799,800],{},[664,801,802,804,807],{},[667,803,669],{},[667,805,806],{},"Value",[667,808,675],{},[677,810,811,826,844,861,878,894],{},[664,812,813,818,824],{},[682,814,815],{},[150,816,817],{},"supabase\u002Fgotrue:v2.188.1",[682,819,820,339,822],{},[150,821,458],{},[150,823,461],{},[682,825,750],{},[664,827,828,833,838],{},[682,829,830],{},[150,831,832],{},"ghcr.io\u002Fcloudnative-pg\u002Fpostgresql:18",[682,834,835],{},[150,836,837],{},"postgres.imageName",[682,839,840,843],{},[150,841,842],{},"postgres.mode=operator",", the default",[664,845,846,851,856],{},[682,847,848],{},[150,849,850],{},"redis:7-alpine",[682,852,853],{},[150,854,855],{},"redis.image",[682,857,858,843],{},[150,859,860],{},"redis.mode=bundled",[664,862,863,868,873],{},[682,864,865],{},[150,866,867],{},"curlimages\u002Fcurl:8.10.1",[682,869,870],{},[150,871,872],{},"ordering.waitImage",[682,874,875,843],{},[150,876,877],{},"ordering.enabled=true",[664,879,880,885,890],{},[682,881,882],{},[150,883,884],{},"postgres:18-alpine",[682,886,887],{},[150,888,889],{},"ordering.dbWaitImage",[682,891,892,843],{},[150,893,877],{},[664,895,896,901,906],{},[682,897,898],{},[150,899,900],{},"busybox:1.36",[682,902,903],{},[150,904,905],{},"ordering.kafkaWaitImage",[682,907,908,843],{},[150,909,877],{},[146,911,912,913,916],{},"The three ",[150,914,915],{},"ordering.*"," images are the init containers that hold each workload back until its dependency answers. They are small and they are easy to forget.",[647,918,920],{"id":919},"the-images-the-operators-bring","The images the operators bring",[146,922,923,924,294],{},"This is the part that catches people out. Postgres and Kafka run under CloudNativePG and Strimzi, and those operators pull images that this chart never names. Mirroring only the table above leaves you with a healthy set of first-party pods and a data tier stuck in ",[150,925,794],{},[146,927,928],{},"You need, at minimum:",[930,931,932,936,943],"ul",{},[933,934,935],"li",{},"the CloudNativePG operator image, from the version of its chart you install",[933,937,938,939,942],{},"the Strimzi operator image (",[150,940,941],{},"quay.io\u002Fstrimzi\u002Foperator","), from the version of its chart you install",[933,944,945],{},"the Kafka broker image Strimzi runs, which is the one worth thinking about",[146,947,948,955,956,958],{},[329,949,950,951,954],{},"Pin ",[150,952,953],{},"kafka.version"," before you mirror anything."," By default the chart leaves it empty and Strimzi picks a Kafka version it supports, which is the right behaviour on a connected cluster and the wrong one when you are trying to work out which image to copy into a private registry. Set ",[150,957,953],{}," to a version your installed Strimzi accepts, then mirror the broker image for exactly that version. A Strimzi release only accepts a narrow window of Kafka versions and refuses anything outside it, so check its release notes rather than guessing.",[155,960,962],{"id":961},"what-still-has-to-reach-the-internet","What still has to reach the internet",[146,964,965,966,969,970,973,974,976],{},"Mirroring the images does not make the deployment offline. The license agent has to reach ",[150,967,968],{},"activation.parentUrl"," (the Solvegio Hub by default, or your MVNE) to enroll, to renew its lease, and to send the heartbeat. An install that cannot make outbound HTTPS to that one host will come up, wait, and never start serving. See ",[971,972,82],"a",{"href":83}," for the exact traffic, and ",[971,975,74],{"href":75}," for what happens when a lease cannot be renewed.",[146,978,979,980,982,983,985],{},"Upgrading a pinned install means changing a digest rather than letting a tag drift: ",[971,981,95],{"href":96},". Every value here is listed with its default in the ",[971,984,129],{"href":130}," reference.",[987,988,989],"style",{},"html pre.shiki code .sBMFI, html code.shiki .sBMFI{--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B}html pre.shiki code .sfazB, html code.shiki .sfazB{--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D}html pre.shiki code .sTEyZ, html code.shiki .sTEyZ{--shiki-light:#90A4AE;--shiki-default:#EEFFFF;--shiki-dark:#BABED8}html pre.shiki code .sMK4o, html code.shiki .sMK4o{--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"title":172,"searchDepth":179,"depth":203,"links":991},[992,993,994,999],{"id":157,"depth":203,"text":158},{"id":297,"depth":203,"text":298},{"id":496,"depth":203,"text":497,"children":995},[996,997,998],{"id":649,"depth":211,"text":650},{"id":787,"depth":211,"text":788},{"id":919,"depth":211,"text":920},{"id":961,"depth":203,"text":962},"Pinning images by digest, mirroring the image set into your own registry, and pulling from a private one.","md",null,{},{"title":61,"description":1000},"BmaNLGrSStLQGhEuTXEtNMpBago9PCbPQx4HJYMJIsY",[1007,1009],{"title":57,"path":58,"stem":59,"description":1008,"children":-1},"What the chart generates, why an upgrade never rotates it, and how to bring your own Secret from SOPS, sealed-secrets or External Secrets Operator.",{"title":65,"path":66,"stem":67,"description":1010,"children":-1},"The optional pieces: outbound email, object storage, error reporting and the AI translation keys.",1783967741116]