Artifact Entitlements

This guide walks you through how to use Artifact Entitlements to control which artifacts and tags your end-customers can access and pull from your Distr registry.

With Artifact Entitlements, you can control access to specific artifacts and their tags in your registry. You can grant access to all tags, specific tags, or future tags for one or multiple artifacts. Once you create your first artifact entitlement, customers will only see artifacts they have a valid entitlement for.

Artifact Entitlements enable you to:

• Control registry access: Restrict which container images, Helm charts, and other artifacts customers can pull
• Tag-based access control: Grant access to specific tags (e.g., only stable releases) or all tags including future ones
• Tiered artifact access: Offer different artifact sets based on customer subscription tiers
• Multi-artifact bundling: Bundle multiple artifacts in a single entitlement for simpler management

1. Each entitlement can include one or multiple artifacts.
2. Each entitlement can grant access to specific tags, all tags, or all tags including future tags.
3. A customer can be associated with multiple entitlements.
4. Entitlement edits are reflected in the customer portal in real time.
5. Before creating your first entitlement, all customers can see all artifacts. After the first entitlement is created, customers only see entitled artifacts.
6. A public artifact is exempt: every customer sees it and can pull it, with or without an entitlement.

If you don’t see the feature yet, make sure you’re on a Pro plan or Pro Trial. Once you’re in, here’s how it works:

1. Create a customer: If none exist, create a customer first
2. Navigate to Licenses in the sidebar
3. Click the customer you want to create an entitlement for
4. Select the Artifact Entitlements tab and click “Create Entitlement”
5. Give it a name (required)
6. Set an expiration date (optional)
7. Select an artifact (required)
8. Choose the tags: grant All tags, or Specific tags with the tags you select and optionally an auto-add tag regex for future tags
9. Save: click “Save” and you’re done

The customer can now access and pull the assigned artifacts and tags directly from your registry through their customer portal.

An entitlement grants either All tags of its artifact, which includes every tag you push later, or Specific tags. With specific tags, you have to select at least one tag. The entitlement grants the manifest each selected tag points to, so the customer also gets every other tag pointing to one of these manifests, including tags you push later. A new tag with a new manifest is only added when it matches the auto-add tag regex.

An entitlement that bundles several artifacts opens in the legacy view. There you add artifacts with ”+ Add Artifact” and choose for each one whether it grants all tags or only the tags you select. The legacy view does not support an auto-add tag regex.

An entitlement with specific tags can grow with your releases. Enter a regular expression in Auto-add Tag Regex next to the tag picker, and every new tag of the artifact whose name matches it is added to the entitlement automatically. The regex is only available for an entitlement with a single artifact. See Auto-add Regex for when it runs, how to write it and examples.

You can view and manage all artifact entitlements for a customer from their detail view in the Licenses section:

• View entitlements: See all entitlements with name, associated artifacts, and expiration
• Edit entitlements: Click an entitlement to modify its settings
• Filter: Use the search bar to filter by name or artifact

• Start with broad access: Consider starting with “All tags” for new customers, then refine as needed
• Set expiration dates: Use expiration dates for time-limited access or trial periods
• Bundle related artifacts: Group related artifacts in a single entitlement for easier management
• Review regularly: Periodically review entitlements to ensure they match your current access policies