chainctl
chainctl Chainguard Control
For the complete documentation index, see llms.txt.
Add a Chainguard Helm chart and its image dependencies to an organization.
Add a Chainguard Helm chart and its image dependencies to an organization.
Creates synced image repositories in the destination organization for the given Helm chart and all image dependencies listed in the chart’s metadata. Repositories that already exist in the destination organization are skipped. All tags are synced.
Charts are looked up by name in the community catalog by default. To add a chart from the iamguarded catalog, prefix the name with “iamguarded-charts/”.
The chart’s image dependencies are read from a single chart tag. By default the newest non-FIPS tag is used; pass –fips to use the newest FIPS tag instead, or –tag to inspect a specific chart version. –fips and –tag can’t be combined.
Every image the chart requires is always added. By default every optional image is added as well; pass –optional-images to add only the optional images you name. Names are catalog repo names (e.g. “nginx”) and must belong to the chart. Use –dry-run to see which of a chart’s images are required and which are optional.
To add only the required images, pass the special value “none” (–optional-images none). It can’t be combined with image names. On a plan with an image allowance, “none” currently needs a free slot for every image in the chart, even though only the required images are added.
On a plan with an image allowance (per-image, Starter or Team), every image that is added is entitled, and each one the organization doesn’t already hold uses a slot. Use –dry-run to list the repositories that would be created. A chart whose metadata lists no image dependencies is refused with an entitlement error.
Examples:
chainctl images helm add-chart argo-cd –parent my-org
chainctl images helm add-chart argo-cd –tag 9.5.20 –parent my-org
chainctl images helm add-chart argo-cd –fips –parent my-org
chainctl images helm add-chart argo-cd –optional-images redis –parent my-org
chainctl images helm add-chart argo-cd –optional-images none –parent my-org
chainctl images helm add-chart iamguarded-charts/redis –parent my-org
chainctl images helm add-chart CHART [flags] --dry-run Dry-run mode: don't create repos, only show what would change.
--fips Default to the newest FIPS tag of the chart.
--optional-images strings The chart's optional images to add, by repo name. Required images are always added. Defaults to all optional images; pass "none" to add only the required images.
--parent string The organization to add the chart and its images to.
--tag string The chart tag to inspect for image dependencies. Defaults to the newest non-FIPS tag. --api string The url of the Chainguard platform API. (default "https://console-api.enforce.dev")
--audience string The Chainguard token audience to request. (default "https://console-api.enforce.dev")
--config string A specific chainctl config file. Uses CHAINCTL_CONFIG environment variable if a file is not passed explicitly.
--console string The url of the Chainguard platform Console. (default "https://console.chainguard.dev")
--force-color Force color output even when stdout is not a TTY.
-h, --help Help for chainctl
--issuer string The url of the Chainguard STS endpoint. (default "https://issuer.enforce.dev")
--log-level string Set the log level (debug, info) (default "ERROR")
-o, --output string Output format. One of: [csv, env, go-template, id, json, markdown, none, table, terse, tree, wide]
-v, --v int Set the log verbosity level.Last updated: 2026-11-11 10:22