Quickstart with a bundled registry and sign-in

For an evaluation cluster, the chart ships the profile values-quickstart.yaml. It installs zot as an in-cluster registry with persistence and native OCI referrers, installs Dex as the dashboard's identity provider and turns on delivery with its recorder writing to zot. The chart generates the dashboard's client secret, the first sign-in password and the recorder's signing key at install and keeps them across upgrades.

helm pull oci://ghcr.io/trianalab/pacto/charts/pacto-operator --untar
helm install pacto-operator ./pacto-operator \
  --namespace pacto-operator-system --create-namespace \
  -f pacto-operator/values-quickstart.yaml

The profile is for evaluation. zot and Dex speak plain HTTP, zot accepts anonymous pushes, Dex keeps sessions in memory and the operator can read the recorder's key. The registry host in the profile names the namespace pacto-operator-system; to install elsewhere, edit it in the file first.

The browser and the dashboard reach Dex at the same issuer URL, http://pacto-dex:5556/dex. To sign in, point that name at your machine, forward both Services and read the password of admin@example.com:

echo "127.0.0.1 pacto-dex" | sudo tee -a /etc/hosts
kubectl -n pacto-operator-system port-forward svc/pacto-dex 5556:5556 &
kubectl -n pacto-operator-system port-forward svc/pacto-dashboard 3000:3000 &
kubectl -n pacto-operator-system get secret pacto-dashboard-oidc \
  -o jsonpath='{.data.admin-password}' | base64 -d

Per-person Kubernetes RBAC needs the API server to trust the Dex issuer through structured authentication with the profile's claim mapping (email and groups, no prefixes). No chart can set that; kind takes it at cluster creation. The API server also accepts only an https issuer, so the bundled Dex needs TLS first. Until then, a Dex sign-in completes and every request is refused, so use token sign-in, which the profile turns on. A token session decides on no held change, so approve with pacto delivery approve (approve or unblock a change).

Health and metrics checks

The profile keeps the chart's runtime defaults. The metrics dimension of a contract that declares metrics reads Unsupported, and health is read passively, so Pacto can confirm it but never contradict it. To check both actively, add to helm install --set controller.enableProbing=true --set controller.enableMetricsObservation=true; see Opt-in features.