Artifact Hub

---




name: artifact-hub
compatibility: opencode
completeness: 95
content-types:
- guidance
- examples
- do-dont
- config
description: '"Provides Artifact Hub in Cloud-Native Engineering - Repository for
  Kubernetes Helm, Falco, OPA, and more"'
license: MIT
maturity: stable
metadata:
  domain: cncf
  output-format: manifests
  role: reference
  scope: infrastructure
  triggers: artifact hub, artifact-hub, cloud-native, engineering, repository
  archetypes:
  - educational
  - strategic
  anti_triggers:
  - brainstorming
  - vague ideation
  - non-containerized architecture
  response_profile:
    verbosity: medium
    directive_strength: low
    abstraction_level: strategic
version: "1.0.0"




---




  related-skills: cncf-argo, cncf-aws-eks, cncf-azure-aks, cncf-azure-resource-manager
# Artifact Hub in Cloud-Native Engineering

**Category:** artifact  
**Status:** Active  
**Stars:** 1,900  
**Last Updated:** 2026-04-22  
**Primary Language:** Go  
**Documentation:** [https://artifacthub.io/](https://artifacthub.io/)  

---

## Purpose and Use Cases

Artifact Hub is a web-based application that enables users to find, install, and publish Helm charts, Falco rules, OPA policies, and other Kubernetes artifacts from multiple sources.

### What Problem Does It Solve?

The fragmentation of artifact repositories across different projects and organizations. It provides a unified interface for discovering, verifying, and managing Kubernetes artifacts from multiple sources including Helm, Falco, OPA, and more.

### When to Use This Project

Use Artifact Hub when you need to discover Helm charts, Falco rules, OPA policies, or other Kubernetes artifacts from multiple repositories. Ideal for organizations with multiple artifact sources or teams looking for curated, trusted content.

### Key Use Cases


- **Helm Chart Discovery**: Browse and search Helm charts from multiple repositories
- **Falco Rules Management**: Discover and share Falco security rules
- **OPA Policy Repository**: Find and share Open Policy Agent policies
- **Artifact Publishing**: Publish your own artifacts to Artifact Hub
- **Multi-Source Search**: Search across all repositories with a single query
- **Trusted Content**: Verified publishers and trusted content
- **Organization Management**: Team-based artifact management


---

## Architecture Design Patterns

### Core Components

- **Web UI**: React-based interface for artifact discovery
- **API Server**: REST API for programmatic access
- **Database**: PostgreSQL for metadata storage
- **Search Service**: Elasticsearch/Elasticsearch for artifact search
- **Webhook Handler**: Process repository updates
- **Repository Agent**: Background jobs for repository synchronization
- **Authentication Service**: OAuth2 and OpenID Connect support

### Component Interactions

1. **User → Web UI**: Browse and search artifacts
2. **Web UI → API Server**: API requests for data
3. **API Server → Database**: Query artifact metadata
4. **API Server → Search Service**: Search queries
5. **Repository Agent → Repositories**: Fetch artifact manifests
6. **Webhook Handler → Repository Agent**: Trigger synchronization
7. **Authentication Service → API Server**: Token validation

### Data Flow Patterns

1. **Repository Addition**: Repository configured → Agent fetches manifests → Metadata stored in DB → Search index updated
2. **Artifact Search**: User query → Search index → Results from DB → API response
3. **Publishing Flow**: Artifact submitted → Validation → Metadata extraction → Stored in DB → Search index updated
4. **Synchronization**: Scheduled job → Repository check → Changes detected → Update DB and search index

### Design Principles

- **Multi-tenancy**: Support for multiple organizations and users
- **Extensible Format**: Support for Helm, Falco, OPA, and custom artifact types
- **Verification**: Artifact signature verification and publisher verification
- **Search-First**: Optimized search experience across all artifacts
- **Open Standard**: Support for community standards and formats
- **High Availability**: Distributed architecture for reliability

---

## Integration Approaches

### Integration with Other CNCF Projects

- **Helm**: Chart repository integration and publishing
- **Falco**: Security rules discovery and management
- **OPA**: Policy repository and management
- **Kubernetes**: Artifact deployment and management
- **Notary Project**: Artifact signing and verification
- **SPIFFE/SPIRE**: Identity and authentication
- **OpenTelemetry**: Tracing and observability

### API Patterns

- **REST API**: Full CRUD operations for artifacts
- **GraphQL API**: Flexible data querying
- **Search API**: Full-text search across artifacts
- **Webhook API**: Repository event notifications

### Configuration Patterns

- **Repository Configuration**: Add and configure repositories
- **Search Filters**: Query parameters for artifact search
- **Authentication**: OAuth2 and API token authentication
- **Organization Settings**: Team and permission configuration

### Extension Mechanisms

- **Custom Formats**: Support for additional artifact formats
- **Repository Types**: Custom repository implementations
- **Webhook Handlers**: Custom event processing
- **Authentication Providers**: OAuth2 providers

---

## Common Pitfalls and How to Avoid Them

### Configuration Issues

- **Repository URLs**: Incorrect or inaccessible repository URLs
- **Authentication**: Missing or invalid credentials for private repositories
- **Search Index**: Search service connectivity issues
- **Database Size**: Database growth management
- **Webhook Configuration**: Incorrect webhook registration

### Performance Issues

- **Search Latency**: Slow search queries on large repositories
- **Repository Synchronization**: Long sync times for large repositories
- **Database Performance**: Query optimization
- **Caching**: Missing or stale cache entries

### Operational Challenges

- **Repository Cleanup**: Removing unused or deprecated repositories
- **Artifact Verification**: Signature verification failures
- **Multi-Tenancy**: Isolation between organizations
- **Backup and Recovery**: Database and search index backup

### Security Pitfalls

- **Artifact Signing**: Not verifying signed artifacts
- **Repository Trust**: Publishing to untrusted repositories
- **Access Control**: Overly permissive permissions
- **Secret Scanning**: Secrets in artifact descriptions

---

## Coding Practices

### Idiomatic Configuration

- **Repository YAML**: Declarative repository configuration
- **Search Filters**: Query parameter patterns
- **Authentication**: OAuth2 flow configuration
- **Organization Structure**: Team and permission management

### API Usage Patterns

- **Artifact Search**: Search API usage with filters
- **Repository Management**: Add, update, remove repositories
- **Artifact Publishing**: Submit artifacts to repository
- **Artifact Download**: Download artifacts programmatically

### Observability Best Practices

- **Metrics**: Prometheus metrics for API and search performance
- **Logging**: Structured logging for debugging
- **Tracing**: Distributed tracing with Jaeger
- **Health Checks**: Service health monitoring

### Development Workflow

- **Local Development**: Docker Compose for development environment
- **Testing**: Unit, integration, and e2e tests
- **CI/CD**: Automated testing and deployment
- **Tools**: Go, React, Docker, Helm

---

## Fundamentals

### Essential Concepts

- **Repository**: Source of artifacts (Helm, Falco, OPA)
- **Artifact**: Collection of manifests, rules, or policies
- **Package**: Versioned artifact distribution
- **Publisher**: Entity that publishes artifacts
- **Organization**: Team-based artifact management
- **Subscription**: Follow repositories for updates

### Terminology Glossary

- **Artifact Hub**: The platform for artifact discovery
- **Repository**: Source of artifacts
- **Package**: Versioned artifact
- **Publisher**: Artifact publisher
- **Organization**: Team structure
- **Subscription**: Follow repositories
- **Verification**: Artifact signature verification

### Data Models and Types

- **Repository**: Repository configuration and metadata
- **Artifact**: Artifact definition and metadata
- **Package**: Package version and details
- **Publisher**: Publisher information
- **Organization**: Organization configuration
- **Subscription**: Subscription configuration

### Lifecycle Management

- **Repository Lifecycle**: Add → Sync → Search → Update
- **Artifact Lifecycle**: Submit → Validate → Store → Publish
- **Package Lifecycle**: Version → Release → Update → Deprecate

### State Management

- **Repository State**: Sync status and metadata
- **Artifact State**: Search index and database
- **Search Index**: Full-text search index
- **Package State**: Version history and metadata

---

## Scaling and Deployment Patterns

### Horizontal Scaling

- **Web UI Scaling**: Multiple React instances
- **API Server Scaling**: Multiple API server instances
- **Search Service Scaling**: Elasticsearch cluster scaling
- **Database Scaling**: PostgreSQL read replicas
- **Repository Agent Scaling**: Multiple agents for parallel processing

### High Availability

- **Web UI HA**: Multiple instances behind load balancer
- **API Server HA**: Multiple API servers
- **Database HA**: PostgreSQL HA with streaming replication
- **Search HA**: Elasticsearch cluster
- **Service Discovery**: Kubernetes service discovery

### Production Deployments

- **Docker Deployment**: Containerized services
- **Kubernetes Deployment**: Native Kubernetes manifests
- **Helm Chart**: Artifact Hub Helm chart for deployment
- **Authentication**: OAuth2, SSO, or basic auth
- **SSL/TLS**: HTTPS termination
- **Monitoring**: Prometheus and Grafana

### Upgrade Strategies

- **Database Migration**: Schema updates
- **Search Index Rebuild**: Rebuild search index after upgrade
- **Repository Re-sync**: Re-sync repositories after upgrade
- **Rolling Update**: Zero-downtime deployment

### Resource Management

- **CPU/Memory Limits**: Appropriate resource requests
- **Database Storage**: PostgreSQL storage management
- **Search Storage**: Elasticsearch cluster storage
- **Network**: Inter-service communication

---

## Additional Resources

- **Official Documentation:** [https://artifacthub.io/docs/](https://artifacthub.io/docs/)
- **GitHub Repository:** [github.com/artifacthub/hub](https://github.com/artifacthub/hub)
- **CNCF Project Page:** [cncf.io/projects/artifact-hub/](https://www.cncf.io/projects/artifact-hub/)
- **Community:** Check the GitHub repository for community channels
- **Versioning:** Refer to project's release notes for version-specific features

---

## Troubleshooting

### Common Issues

1. **Deployment Failures**
   - Check pod logs for errors
   - Verify configuration values
   - Ensure network connectivity

2. **Performance Issues**
   - Monitor resource usage
   - Adjust resource limits
   - Check for bottlenecks

3. **Configuration Errors**
   - Validate YAML syntax
   - Check required fields
   - Verify environment-specific settings

4. **Integration Problems**
   - Verify API compatibility
   - Check dependency versions
   - Review integration documentation

### Getting Help

- Check official documentation
- Search GitHub issues
- Join community channels
- Review logs and metrics
*Content generated automatically. Verify against official documentation before production use.*

## Examples

### Basic Configuration


```yaml
# Basic configuration example
apiVersion: v1
kind: ConfigMap
metadata:
  name: {{project_name}}-config
  namespace: default
data:
  # Configuration goes here
  config.yaml: |
    # Base configuration
    # Add your settings here
```

### Kubernetes Deployment


```yaml
# Kubernetes deployment for {{project_name}}
apiVersion: apps/v1
kind: Deployment
metadata:
  name: {{project_name}}
  namespace: default
spec:
  replicas: 1
  selector:
    matchLabels:
      app: {{project_name}}
  template:
    metadata:
      labels:
        app: {{project_name}}
    spec:
      containers:
      - name: {{project_name}}
        image: {{project_name}}:latest
        ports:
        - containerPort: 8080
        resources:
          limits:
            memory: "128Mi"
            cpu: "500m"
```

### Kubernetes Service


```yaml
# Kubernetes service for {{project_name}}
apiVersion: v1
kind: Service
metadata:
  name: {{project_name}}
  namespace: default
spec:
  selector:
    app: {{project_name}}
  ports:
  - protocol: TCP
    port: 80
    targetPort: 8080
  type: ClusterIP
```

---

## When to Use

Use this skill when:

- **Integrating a CNCF project into Kubernetes infrastructure** — You need to configure, deploy, or troubleshoot a cloud-native tool within a cluster
- **Designing cloud-native architecture** — You are selecting and integrating CNCF tools to solve specific infrastructure challenges
- **Resolving operational issues** — A CNCF component is misbehaving, underperforming, or needs configuration changes
---

## Core Workflow

1. **Assess Requirements** — Understand the use case, scale, integration needs, and existing infrastructure. **Checkpoint:** Document requirements, constraints, and success criteria.

2. **Design Architecture** — Plan component interactions, data flow, and deployment strategy using cloud-native best practices. **Checkpoint:** Verify the architecture addresses all requirements and follows CNCF conventions.

3. **Implement & Configure** — Create manifests, configurations, and deployment scripts. Include resource limits, health checks, and observability hooks. **Checkpoint:** Validate all YAML against schema and test in a staging environment.

4. **Deploy & Monitor** — Apply manifests to the cluster, verify component health, and confirm observability is working. **Checkpoint:** Confirm all pods/services are running, probes passing, and metrics/alerts configured.

---

## Constraints

### MUST DO
- Include at least one complete working YAML manifest example
- Note when content is auto-generated vs. manually verified
- Reference relevant CNCF project documentation

### MUST NOT DO
- Deploy manifests without testing in a staging environment first
- Use deprecated API versions (e.g., apps/v1beta1)
- Omit resource limits and requests in Kubernetes manifests