Image mirroring

If your Kubernetes cluster resides in an environment with strict egress controls, or if policies such as OPA Gatekeeper block pulling images from external public registries, or you want a local copy of the images for resilience, you will need to mirror the required DataQI images into your own container registry.

Core application services

These images contain the core DataQI platform services and must be mirrored for any production deployment:

dataqi-api
dataqi-extractor
dataqi-keycloak
dataqi-transformer
dataqi-spa
dataqi-tokenbroker

Testing tools

These images are optional and generally used for sandbox environments, the DataQI team will let you know if you need to mirror them:

dataqi-local-dev-spa
mcp-sandbox

MCP services

If you intend to integrate with external systems via MCP, mirror the appropriate images:

dataqi-mcp-intersight
dataqi-mcp-vrops
dataqi-mcp-virtana
dataqi-mcp-servicenow

Custom databases

DataQI ships with pre-configured database images containing necessary extensions:

dataqi-cnpg-pgvector
dataqi-cnpg-timescale

Public dependencies

These are standard upstream open-source images used by the DataQI chart. If your environment blocks docker.io, quay.io, or ghcr.io, mirror these as well:

ghcr.io/cloudnative-pg/postgresql
docker.io/valkey/valkey
docker.io/otel/opentelemetry-collector-contrib
ghcr.io/cloudnative-pg/cloudnative-pg
docker.io/adorsys/keycloak-config-cli

docker.io/library/nats:2.10.24-alpine
docker.io/natsio/nats-server-config-reloader:0.16.1
docker.io/natsio/prometheus-nats-exporter:0.16.0

Configuring the Helm chart

Once you have mirrored the required images into your private registry, you can configure the Helm chart to pull from it instead of the default registries.

Create or update your values.yaml file to define your global image registry:

global:
  imageRegistry: "your-private-registry.com/your-project"

For public dependencies you may need to manually update some separate keys because by default they are not configured to pull from the global image registry. For example, you may need to update:

databases:
  keycloak:
    image:
      # Set to "" to use the global image registry.
      registry: ""

# NATS images do not use the global registry and must be fully specified
nats:
  reloader:
    image:
      repository: "your-private-registry.com/your-project/nats-server-config-reloader"
  promExporter:
    image:
      repository: "your-private-registry.com/your-project/prometheus-nats-exporter"
  container:
    image:
      repository: "your-private-registry.com/your-project/nats"

This configuration ensures all DataQI-specific workloads attempt to pull from your internal registry. Ensure you have properly tagged and pushed the images to match this structure.