feat(oci): add ability to use OCI registries for storage #6017

Clockwork-Muse · 2025-11-17T02:13:20Z

Fixes #5134
Adds the ability to reference OCI registries.

Adds capability to pull from remote registries
Adds capability to pull from "oci-layout"
Adds command to package kustomization directories (and push to remote registries)

k8s-ci-robot · 2025-11-17T02:13:23Z

This PR has multiple commits, and the default merge method is: merge.
You can request commits to be squashed using the label: tide/merge-method-squash

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

linux-foundation-easycla · 2025-11-17T02:13:27Z

The committers listed above are authorized under a signed CLA.

✅ login: Clockwork-Muse / name: Stephen A. Imhoff (0ee651b, 2196d2a, 49ae7d3, 588760c, 9a63f81, b6bf9ec, d391857)

k8s-ci-robot · 2025-11-17T02:13:27Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: Clockwork-Muse
Once this PR has been reviewed and has the lgtm label, please assign varshaprasad96 for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

k8s-ci-robot · 2025-11-17T02:13:29Z

Welcome @Clockwork-Muse!

It looks like this is your first PR to kubernetes-sigs/kustomize 🎉. Please refer to our pull request process documentation to help your PR have a smooth ride to approval.

You will be prompted by a bot to use commands during the review process. Do not be afraid to follow the prompts! It is okay to experiment. Here is the bot commands documentation.

You can also check if kubernetes-sigs/kustomize has its own contribution guidelines.

You may want to refer to our testing guide if you run into trouble with your tests not passing.

If you are having difficulty getting your pull request seen, please follow the recommended escalation practices. Also, for tips and tricks in the contribution process you may want to read the Kubernetes contributor cheat sheet. We want to make sure your contribution gets all the attention it needs!

Thank you, and welcome to Kubernetes. 😃

k8s-ci-robot · 2025-11-17T02:13:30Z

Hi @Clockwork-Muse. Thanks for your PR.

I'm waiting for a github.com member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

Clockwork-Muse · 2025-11-17T02:17:48Z

/hold

TerryHowe · 2025-12-25T15:54:28Z

api/internal/oci/repospec.go

+}
+
+const ociScheme = "oci://"
+const ociLayoutScheme = "oci-layout://"


Are people really using oci-layout:// for a scheme here? Does flux support that?

I don't think I've seen an official "scheme" for this here. ORAS itself has CLI flags for remote vs layout directories/archives (as do some other tools), but that's not really an option in this case.

Flux doesn't appear to support OCI Layout artifacts currently.

I don't think there is an official scheme, but...

Helm uses the uri oci:// so that lines up.

The ORAS CLI uses oci-layout to indicate the file OCI layout, so that could be confusing if people thing that is going to be read from a file.

TerryHowe · 2025-12-25T15:57:23Z

api/internal/oci/repospec_test.go

+}
+
+func TestNewRepoSpecFromUrl_Smoke(t *testing.T) {
+	// A set of end to end parsing tests that smoke out obvious issues


I'm just passing through here, but I think it would be better to use a web server on localhost to mock out a registry rather than ghcr. I prefer tests I can run with no Internet and that don't rely on other services being available.

Oh, absolutely.

This is why I have a (intended to be temporary) devcontainer here; one of the things it spins up (besides the golang tooling) is a container registry.

Frankly, the reason I was adding the oci-layout capability was for "simpler"/local-only testing purposes for basic behavior. I need to investigate the e2e stack more to see if I can get it to host a registry, but otherwise things are more complicated.

Whatever AI agent you are using could probably create a mock on a port on localhost.

TerryHowe · 2025-12-25T16:02:22Z

api/internal/oci/repospec.go

+// Arbitrary, but non-infinite, timeout for running commands.
+const defaultTimeout = 27 * time.Second
+
+func extractDigest(n string) (string, string, error) {


Did you consider using ParseReference here?

Will look into.

TerryHowe · 2025-12-25T16:12:32Z

api/internal/oci/repospec.go

+	return "", n, nil
+}
+
+func extractHost(n string) (string, string, error) {


If you named the returns here, it would document what the represent and you would need to declare them.

Suggested change

func extractHost(n string) (string, string, error) {

func extractHost(n string) (host string, rest string, err error) {

TerryHowe · 2025-12-25T16:17:04Z

api/internal/oci/repospec.go

+			return "", "", errors.Errorf("failed to parse digest")
+		}
+
+		return digest, n[:digestIndex], nil


it is a little confusing the pass back the result in reverse order here.

Also, this doesn't support valid form B oci://registry/repo@sha256:asdfasdf:v1.0.0

Will fix the reverse order, you're right.

I was not previously aware that form B was valid.

TerryHowe · 2025-12-25T16:24:47Z

kustomize/commands/publish/publish.go

+		return err
+	}
+
+	dst, err := oci.New(o.registry)


Seems like it would be nicer to toss this code in the api/internal/oci package as a Pusher function.

TerryHowe · 2025-12-25T19:44:13Z

Nice work in general. I think this would be a useful feature!

Clockwork-Muse added 5 commits November 16, 2025 20:23

feat(publish): add publish command stub

d391857

fix(publish): add pack to artifact

b6bf9ec

fix(oci): add initial ocispec

49ae7d3

chore(dev): add devcontainer

9a63f81

feat(oci): initial oci-layout pull implementation

0ee651b

k8s-ci-robot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Nov 17, 2025

k8s-ci-robot requested review from koba1t and varshaprasad96 November 17, 2025 02:13

k8s-ci-robot added needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. cncf-cla: no Indicates the PR's author has not signed the CNCF CLA. labels Nov 17, 2025

k8s-ci-robot added size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. and removed cncf-cla: no Indicates the PR's author has not signed the CNCF CLA. labels Nov 17, 2025

k8s-ci-robot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Nov 17, 2025

int128 mentioned this pull request Dec 7, 2025

Test kustomize OCI feature int128/hello-kustomize-oci#6

Draft

test: add initial publish test

2196d2a

TerryHowe reviewed Dec 25, 2025

View reviewed changes

chore: wip

588760c

	func extractHost(n string) (string, string, error) {
	func extractHost(n string) (host string, rest string, err error) {

feat(oci): add ability to use OCI registries for storage #6017

Are you sure you want to change the base?

feat(oci): add ability to use OCI registries for storage #6017

Uh oh!

Conversation

Clockwork-Muse commented Nov 17, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

k8s-ci-robot commented Nov 17, 2025

Uh oh!

linux-foundation-easycla bot commented Nov 17, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

k8s-ci-robot commented Nov 17, 2025

Uh oh!

k8s-ci-robot commented Nov 17, 2025

Uh oh!

k8s-ci-robot commented Nov 17, 2025

Uh oh!

Clockwork-Muse commented Nov 17, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

TerryHowe commented Dec 25, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Clockwork-Muse commented Nov 17, 2025 •

edited

Loading

linux-foundation-easycla bot commented Nov 17, 2025 •

edited

Loading