Access and credentials

A Tersane licence gives your organisation two credentials. They are separate, and each is used in a different place.

Credential	Used for	Used by
Chart repository	Downloading the charts from tersane.maml.uk	Helm, on the machine that installs and upgrades releases
Image registry	Pulling the container images the charts run from 1x.ax	Kubernetes, on every node, through a pull secret

Both credentials are issued in the Mamluk console when the licence starts. Each remains valid for the term of the licence and is revoked when the licence ends. A credential can be replaced in the console at any time, for example when someone who held it leaves; the old credential is revoked when the new one is issued.

The chart repository

The charts are served from a Helm repository at tersane.maml.uk. Add it once on each machine that runs Helm:

helm repo add tersane https://tersane.maml.uk \
  --username <organisation> --password <chart credential>
helm repo update

Helm stores the credential in its own repository configuration on that machine. It is never needed inside the cluster.

Each convoy is a separate repository, available to organisations that license it, under tersane.maml.uk/convoys/. The Banking Convoy is added in the same way:

helm repo add banking-convoy https://tersane.maml.uk/convoys/banking \
  --username <organisation> --password <chart credential>

A published chart version is never changed or withdrawn, so a release pinned to a version can always be reinstalled.

The image registry

The charts that run images built by Mamluk pull them from 1x.ax, which needs the image credential. Kubernetes reads it from a pull secret, which must exist in every namespace that runs such a chart:

kubectl create secret docker-registry 1x-ax \
  --namespace <namespace> \
  --docker-server=1x.ax \
  --docker-username=<organisation> \
  --docker-password=<image credential>

Then name the secret in the release’s values:

imagePullSecrets:
  - name: 1x-ax

Set imagePullSecrets explicitly in each release’s values file. The charts’ own defaults name different secrets, and a release that names a secret which does not exist leaves its pods unable to start.

Charts that run upstream images only, such as memcached and clamav, do not need the image credential.