Application Marketplace on Cozystack

Publishing a Repository

Mon, 01 Jan 0001 00:00:00 +0000

This guide is for publishers: developers who package applications and make them available to Cozystack clusters. It covers scaffolding a repository, validating it offline, pushing it as an OCI artifact, and, optionally, listing it in the community index.

For the operator side (connecting a published repository to a cluster), see Connecting a Repository.

Prerequisites

The cozypkg CLI; see Install cozypkg.
The flux CLI, which cozypkg push uses to build and push the OCI artifact.
git, and a checkout with an origin remote, if you want push to record the artifact’s provenance for you. See Push for the alternative.
Access to an OCI registry you can push to (for example GitHub Container Registry).
helm on your PATH if you want --helm-lint to run helm lint on the charts.
cosign on your PATH if you use --require-signature; validation stops without it.

Scaffold a repository

cozypkg init writes a complete repository skeleton that passes validation as-is:

Connecting a Repository

Mon, 01 Jan 0001 00:00:00 +0000

This guide is for operators: cluster administrators who connect external repositories and install their applications. It covers discovering repositories, connecting them from the CLI or the dashboard, installing applications, and disconnecting.

For the publisher side (packaging and pushing a repository), see Publishing a Repository.

Prerequisites

The cozypkg CLI (see Install cozypkg) and a kubeconfig for the target cluster. Creating cluster-scoped resources requires cluster-admin.
The flux CLI on your PATH. cozypkg tap pulls the artifact to your own machine before it creates anything on the cluster, and it shells out to flux pull artifact to do it. --skip-validate skips the validation, not the pull, so flux is needed either way.
A Cozystack release that includes the marketplace. There is no switch to enable: the taps API and the tap materializer are always present.

Warning: Installing an application from a connected repository runs its charts in your management cluster (tapping itself installs nothing). Connect only sources you trust, or repositories listed in a curated index whose gate verifies signatures. See the Trust model.

Discover repositories

cozypkg search queries the community index and lists matching repositories without connecting them. Point it at an index with --index or the COZYPKG_INDEX environment variable (a local directory or an oci:// reference):

cozypkg Reference

Mon, 01 Jan 0001 00:00:00 +0000

cozypkg is the CLI for authoring, publishing, and managing Cozystack marketplace repositories. This page is a reference for its commands; for task-oriented walkthroughs see Publishing a Repository and Connecting a Repository.

Commands that create or read cluster resources accept --kubeconfig and otherwise fall back to ~/.kube/config or the KUBECONFIG environment variable. Creating cluster-scoped resources requires cluster-admin.

push shells out to the flux binary, and so does anything that reads an oci:// reference: tap, validate against an artifact, and search or short-name tap against an oci:// index. flux must be on your PATH for those. Its pulls run on your machine and use the registry credentials found there.