Mirror connector images to a private registry

Mirror container images from the Cortex Cloud source registry to your private registry, enabling secure, air-gapped Kubernetes cluster deployments.

Notice

Licensed under the Apache License, Version 2.0.

What is image mirroring?

Image mirroring is the process of copying container images from a source registry to a private registry under your control. This capability is essential for organizations operating in air-gapped environments, restricted networks, or those requiring centralized image governance.

The Cortex Cloud Konnector Image Mirroring CLI (kcli) automates this process by pulling multi-architecture konnector images from the Cortex source registry, pushing them to your private registry, and rewriting your Helm values file to reference the mirrored images. This eliminates the need for cluster nodes to access external registries during deployment, reducing attack surface and enabling compliance with network isolation policies.

Why image mirroring matters

• Network isolation: Clusters pull images from internal registries only, not from external sources
• Compliance: Meets requirements for air-gapped deployments and restricted egress policies
• Supply chain control: Centralize image governance and scanning before deployment
• Deployment reliability: Eliminates external registry dependencies during cluster operations

Scope and limitations

What kcli does

• Pulls multi-architecture konnector images from the Cortex source registry
• Pushes images to your private registry
• Rewrites your Helm values file to reference the mirrored images

What kcli does not do

• Execute helm install or helm upgrade commands (the portal's installation wizard is the source of truth)
• Create Kubernetes Secret resources in your cluster
• Manage Namespaces, RBAC, or cluster prerequisites
• Commit or push the rewritten values file to Git (GitOps workflows must handle this)
• Commit or push the rewritten values file to Git (GitOps workflows must handle this)