Private-registry / restricted-egress install

Pull every image from your own registry; outbound HTTPS to Billing only.

Not a disconnected deployment

Anyray does not support a fully disconnected runtime. Every deployment connects to app.anyray.ai with an adt_… token for content-free metering; prompts and responses are never sent. Allow only this required Billing app egress, plus the vendor hosts for any spend connectors you enable.

Locked-down clusters can't reach public registries, and many platform teams require every image to come from an internal registry (Harbor, ECR, Artifactory, Nexus) that's scanned and admission-gated. Anyray's Helm chart supports this directly: a global.imageRegistry value repoints every image, and a BOM script tells you exactly what to mirror.

Prerequisites

• An internet-connected "jump" host with helm 3.10+ and crane (or skopeo) — used once to pull and mirror artifacts across the gap.
• Your internal container registry (Harbor / ECR / Artifactory / Nexus) reachable from the cluster, with push credentials.
• The target Kubernetes cluster (1.24+), a default StorageClass, and an image pull secret for your registry if it requires auth.
• Outbound HTTPS from the gateway to the Anyray Billing app.
• An Anyray deployment token (adt_…) from app.anyray.ai — used at runtime for mandatory metering (metadata-only; content is never sent to Anyray).

Optional spend connectors need their vendor hosts: api.cursor.com, api.devin.ai, or api.github.com plus copilot-reports.github.com. Allow only the connectors you enable.

Install

1

Generate the image bill-of-materials (BOM)

List the exact images the chart deploys — digest-pinned for reproducible mirrors:

git clone https://github.com/anyrayHQ/install anyray && cd anyray
./scripts/gen-image-bom.sh > anyray-images.txt

anyray-images.txt

docker.io/postgres@sha256:0af6…                # docker.io/postgres:17
public.ecr.aws/anyray/gateway@sha256:14ee…     # …/gateway:v1.10.94
public.ecr.aws/anyray/optimizer@sha256:f092…   # …/optimizer:v1.10.94
public.ecr.aws/anyray/proxy@sha256:e190…       # …/proxy:v1.10.94

No install-repo clone in your pipeline? The list is just helm template anyray oci://public.ecr.aws/anyray/anyray --version <x.y.z> | grep 'image:'.

2

Mirror the images into your registry

Copy each image into your internal registry, preserving the path so the chart's override lines up:

REG=my.registry:5000
grep -v '^#' anyray-images.txt | while read -r img _; do
  crane cp "$img" "$REG/${img#*/}"   # public.ecr.aws/anyray/gateway@… → my.registry:5000/anyray/gateway@…
done

(skopeo copy docker://<src> docker://<dst> works the same. If the registry network cannot reach public registries, use crane pull/docker save on the jump host, carry the image tarball in, then crane push/docker load.)

3

Pull the chart to a local archive

helm pull oci://public.ecr.aws/anyray/anyray --version <x.y.z>   # → anyray-<x.y.z>.tgz

Pin <x.y.z> to a released chart version (helm show chart oci://public.ecr.aws/anyray/anyray). Carry anyray-<x.y.z>.tgz across the gap alongside the mirrored images.

4

Install from your registry

One value repoints every image at your registry:

helm install anyray ./anyray-<x.y.z>.tgz -n anyray --create-namespace \
  --set global.imageRegistry=my.registry:5000 \
  -f my-values.yaml

If your registry needs credentials, create a pull secret and reference it in your values:

my-values.yaml

global:
  imageRegistry: my.registry:5000    # or pass via --set as above
image:
  pullSecrets:
    - name: my-registry-creds

Author my-values.yaml and the anyray-secrets Secret exactly as in the Kubernetes guide — neither needs registry access.

Success

kubectl get pods -n anyray shows every pod pulling from my.registry:5000. An ImagePullBackOff means the chart version and your mirrored tags are out of step — the chart's appVersion must have a matching image in your registry.

Secrets, GitOps, and upgrades

• Secrets stay yours. The anyray-secrets Secret is managed by your own tooling (External Secrets Operator, Sealed Secrets, SOPS) — no vendor script runs in your cluster. Keys are listed under Generated file examples.
• GitOps. Host anyray-<x.y.z>.tgz in your own chart registry and point an ArgoCD Application / Flux HelmRelease at it with global.imageRegistry in the values — see the ArgoCD example.
• Upgrades. Re-run the BOM for the new version, mirror the new images, helm pull the new chart, then helm upgrade — the same four steps.