Private Registry

By default, NetBox Enterprise pulls its Helm charts from registry.enterprise.netboxlabs.com and its container images from proxy.enterprise.netboxlabs.com, and the bundled Replicated SDK provisions the image-pull secret for you (see Registry Access).

To pull every image from your own private registry instead - for example an internal Harbor that mirrors or proxies the NetBox Labs images - use the settings below. This applies to Helm installs; Embedded Cluster handles registries through the Administration Console.

Redirect operator-built images

Set spec.registry on the NetBoxEnterprise custom resource. This redirects every image the operator builds - NetBox, workers, Diode, Redis, Sentinel, and the Redis exporter - to your registry:

netboxEnterprise:
  spec:
    registry: my-registry.example.com

spec.registry replaces the registry host on each image and keeps the repository path. Mirror the images under your registry with those paths intact:

Operator image	Renders as
ghcr.io/netboxlabs/nbe-core	my-registry.example.com/netboxlabs/nbe-core
docker.io/netboxlabs/diode-ingester	my-registry.example.com/netboxlabs/diode-ingester
quay.io/opstree/redis	my-registry.example.com/opstree/redis
registry.developers.crunchydata.com/crunchydata/crunchy-postgres	my-registry.example.com/crunchydata/crunchy-postgres

The registry value can include a path prefix (for example my-registry.example.com/netbox), which the operator keeps in front of each repository path.

If your registry serves everything from a single flat project rather than nested repository paths - a Harbor project, for example - add spec.registryNamespace instead. The operator then reduces each image to its name and places it directly under that one project:

netboxEnterprise:
  spec:
    registry: harbor.example.com
    registryNamespace: netbox-enterprise

Operator image	Renders as
ghcr.io/netboxlabs/nbe-core	harbor.example.com/netbox-enterprise/nbe-core
docker.io/netboxlabs/diode-ingester	harbor.example.com/netbox-enterprise/diode-ingester
quay.io/opstree/redis	harbor.example.com/netbox-enterprise/redis
registry.developers.crunchydata.com/crunchydata/crunchy-postgres	harbor.example.com/netbox-enterprise/crunchy-postgres

Set registry to a bare host when you use registryNamespace - a path prefix on registry stacks in front of the namespace and produces a doubled path. The image tag is unchanged in both modes. Mirror the images your deployment uses before applying these settings, or the pods fail to pull.

Per-image redis value overrides do not reach the Redis containers - the operator sets those images itself, and only spec.registry moves them.

Redirect subchart images

The operator, Redis Operator, PostgreSQL Operator (PGO), and Replicated SDK images are deployed by the chart directly and are not covered by spec.registry. Override them in your Helm values:

Image	Values key
Operator	operator.image.*
Redis Operator	redis-operator.redisOperator.imageName / imageTag
PGO	pgo.controllerImages.* and pgo.relatedImages.*
Replicated SDK	replicated.image.*

Pull credentials

Provide credentials for your registry with spec.imagePullSecrets. This covers the NetBox and worker, Diode, and PostgreSQL pods:

netboxEnterprise:
  spec:
    imagePullSecrets:
      - my-registry-creds

Redis and Sentinel are the exception: they do not honor spec.imagePullSecrets. The operator always attaches a pull secret named netbox-enterprise-helm-registry to the Redis pods, so create a secret with that exact name holding your registry credentials (or allow anonymous pulls from your registry):

kubectl -n netbox create secret docker-registry netbox-enterprise-helm-registry \
  --docker-server=my-registry.example.com \
  --docker-username=<username> \
  --docker-password=<password>

The secret must sit in the same namespace as the Redis pods, so replace netbox with the namespace you installed into (default for Quickstart).

Without it, the Redis pods fail to pull with ImagePullBackOff. A future release will let Redis and Sentinel use spec.imagePullSecrets directly.

Next Steps

• Prerequisites - Registry access and other install requirements
• External Database - Connect to an external PostgreSQL database