RegistryConnection

A private package or container registry that Vulnetix scans may read, and how to authenticate to it: an npm registry, a PyPI index, a Maven repository or an OCI registry. The credential is kept in the tenant’s secrets vault (a connector entry), never in the connection; a scanner asks the platform to resolve the connection for a registry host and a package, and the credential is opened and the open recorded in the vault activity log. A connection with a username authenticates with basic authentication and the secret as the password; without one, the secret is a bearer token. Apply checks the credential against the registry before storing it and refuses a login the registry rejects. This is separate from the paid container registry logins on the Integrations page, which the crawler uses. Needs the saas migration 20261228020000_scan_registry_connection; until it is applied, plan refuses a document naming it.

apiVersion	vulnetix.com/v1
kind	RegistryConnection
Group	Integrations
Status	Served. The config engine plans and applies it.
Objects per tenant	many, keyed by metadata.name
Token and role	An owner or admin session, or a vmt_ config management token with the owner or admin role that lists RegistryConnection in its kinds. See Management tokens.
Secret fields	spec.secret: read on the client from valueFrom, sent once, never exported or shown in a plan
Terraform resource	vulnetix_registry_connection, imported by name (see Terraform and OpenTofu)
CLI	vulnetix config apply, CLI v3.168.0 and later.
Pinned schema	v1.15.0/RegistryConnection.schema.json
Newest schema	latest/RegistryConnection.schema.json
First released in	v1.10.0
Print the built-in copy	vulnetix config schema RegistryConnection

Minimal

Only the fields the kind requires. From examples/RegistryConnection/minimal.yaml.

YAML

# yaml-language-server: $schema=https://github.com/Vulnetix/config-schemas/releases/latest/download/RegistryConnection.schema.json
apiVersion: vulnetix.com/v1
kind: RegistryConnection
metadata:
  name: github-packages
spec:
  ecosystem: npm
  url: https://npm.pkg.github.com/

HCL (resource vulnetix_registry_connection)

# Only the arguments the kind requires. From config-schemas examples/RegistryConnection/minimal.yaml.

resource "vulnetix_registry_connection" "github_packages" {
  name      = "github-packages"
  ecosystem = "npm"
  url       = "https://npm.pkg.github.com/"
}

CLI (applies it)

export VULNETIX_CONFIG_TOKEN=vmt_...   # a config management token
vulnetix config apply -f - --manager gitops:acme/platform --auto-approve <<'EOF'
# yaml-language-server: $schema=https://github.com/Vulnetix/config-schemas/releases/latest/download/RegistryConnection.schema.json
apiVersion: vulnetix.com/v1
kind: RegistryConnection
metadata:
  name: github-packages
spec:
  ecosystem: npm
  url: https://npm.pkg.github.com/
EOF

Advanced

Every field the kind supports, with a when expression where it takes one. From examples/RegistryConnection/advanced.yaml.

YAML

# yaml-language-server: $schema=https://github.com/Vulnetix/config-schemas/releases/latest/download/RegistryConnection.schema.json
apiVersion: vulnetix.com/v1
kind: RegistryConnection
metadata:
  name: acme-artifactory-npm
  labels:
    team: platform
  annotations:
    ticket: https://tracker.example.com/PLAT-482
spec:
  ecosystem: npm
  url: https://artifactory.acme.example/artifactory/api/npm/npm-local/
  scope: ["@acme", "@acme-internal"]
  username: vulnetix-scanner
  secret: { env: VULNETIX_ARTIFACTORY_PASSWORD }
  enabled: true
---
apiVersion: vulnetix.com/v1
kind: RegistryConnection
metadata:
  name: acme-registry
spec:
  ecosystem: oci
  url: registry.acme.example
  scope: [acme/payments, acme/platform]
  secret: { env: VULNETIX_ACME_REGISTRY_TOKEN }

HCL (resource vulnetix_registry_connection)

# Every argument the kind supports. From config-schemas examples/RegistryConnection/advanced.yaml.

variable "acme_artifactory_npm_secret" {
  type      = string
  sensitive = true
  ephemeral = true
}
variable "acme_registry_secret" {
  type      = string
  sensitive = true
  ephemeral = true
}

resource "vulnetix_registry_connection" "acme_artifactory_npm" {
  name              = "acme-artifactory-npm"
  ecosystem         = "npm"
  enabled           = true
  scope             = ["@acme", "@acme-internal"]
  secret_wo         = var.acme_artifactory_npm_secret
  secret_wo_version = 1
  url               = "https://artifactory.acme.example/artifactory/api/npm/npm-local/"
  username          = "vulnetix-scanner"
  labels = {
    team = "platform"
  }
  annotations = {
    ticket = "https://tracker.example.com/PLAT-482"
  }
}

resource "vulnetix_registry_connection" "acme_registry" {
  name              = "acme-registry"
  ecosystem         = "oci"
  scope             = ["acme/payments", "acme/platform"]
  secret_wo         = var.acme_registry_secret
  secret_wo_version = 1
  url               = "registry.acme.example"
}

CLI (applies it)

export VULNETIX_CONFIG_TOKEN=vmt_...   # a config management token
export VULNETIX_ARTIFACTORY_PASSWORD=...   # read on this machine by valueFrom, never written to the document
export VULNETIX_ACME_REGISTRY_TOKEN=...   # read on this machine by valueFrom, never written to the document
vulnetix config apply -f - --manager gitops:acme/platform --auto-approve <<'EOF'
# yaml-language-server: $schema=https://github.com/Vulnetix/config-schemas/releases/latest/download/RegistryConnection.schema.json
apiVersion: vulnetix.com/v1
kind: RegistryConnection
metadata:
  name: acme-artifactory-npm
  labels:
    team: platform
  annotations:
    ticket: https://tracker.example.com/PLAT-482
spec:
  ecosystem: npm
  url: https://artifactory.acme.example/artifactory/api/npm/npm-local/
  scope: ["@acme", "@acme-internal"]
  username: vulnetix-scanner
  secret: { env: VULNETIX_ARTIFACTORY_PASSWORD }
  enabled: true
---
apiVersion: vulnetix.com/v1
kind: RegistryConnection
metadata:
  name: acme-registry
spec:
  ecosystem: oci
  url: registry.acme.example
  scope: [acme/payments, acme/platform]
  secret: { env: VULNETIX_ACME_REGISTRY_TOKEN }
EOF

Fields

Paths use dots for nesting and [] for the items of a list. Required means required whenever the parent object is present. A default is what the server uses when the field is left out.

Field	Type	Required	Default	Allowed values	Secret	Description
apiVersion	string	yes		exactly vulnetix.com/v1		The document format version. Every kind in this release is vulnetix.com/v1.
kind	string	yes		exactly RegistryConnection		Always RegistryConnection.
metadata	object	yes		no other keys
metadata.name	string	yes		pattern ^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$		The object’s name, unique per kind within a tenant. It is the natural key: plan, apply, export and the Terraform provider all address an object by kind and name.
metadata.org	string	no		format uuid		The tenant (organization UUID) the document belongs to. When set, plan and apply refuse to run against any other tenant.
metadata.labels	object	no		map of string to string (length 0 to 256); keys match ^[a-z0-9]([a-z0-9._/-]{0,61}[a-z0-9])?$		Free key/value labels. Stored with the object, never interpreted by the server.
metadata.annotations	object	no		map of string to string (length 0 to 4096)		Free key/value notes for people and tools, such as a ticket link.
spec	object	yes		no other keys
spec.ecosystem	string	yes		oci, npm, pypi, maven		oci: a container registry. npm: an npm registry. pypi: a PyPI simple index. maven: a Maven repository.
spec.url	string	yes		length 0 to 512		For oci, the registry host with an optional port (registry.example.com, ghcr.io, registry.example.com:5000). For the others, the https URL of the registry or index (https://npm.pkg.github.com/, https://pypi.example.com/simple/, https://maven.example.com/releases/). It is matched against the registry a scan reaches by host.
spec.scope	array of string	no	[]	0 to 50 items; items unique; each item: pattern ^[A-Za-z0-9@._/:-]{1,214}$		The packages or repositories this connection serves. Left out, every one at the registry. npm: a scope (@acme). oci: a repository path prefix (acme/payments). maven: a group id prefix (com.acme). pypi: a project name prefix (acme-). When several connections serve one registry, the most specific scope wins.
spec.username	string	no		length 1 to 256		The user for basic authentication, with the secret as the password. Left out, the secret is a bearer token (an npm automation token, a registry access token).
spec.secret	object	no		1 to 1 keys; no other keys	yes	The password or token, read on the client and sent once. Required when the connection is created; left out afterwards, the stored credential is kept. It is stored in the secrets vault and never exported or shown in a plan. Changing it stores a new version of the vault entry.
spec.secret.env	string	no		pattern ^[A-Za-z_][A-Za-z0-9_]*$		Name of an environment variable.
spec.secret.file	string	no		length 1 to any		Path to a file holding the value. Trailing newlines are trimmed.
spec.enabled	boolean	no	true			False keeps the connection and its credential but stops scans using it.

Rules

Conditions the schema enforces beyond each field’s own type. vulnetix config validate and the engine’s plan report a document that breaks one.

On	Rule
spec	When ecosystem is oci: url must be pattern ^[A-Za-z0-9]([A-Za-z0-9.-]*[A-Za-z0-9])?(:[0-9]{1,5})?$. Otherwise: url must be pattern ^https://[^\s/@?#]+(/[^\s?#]*)?$.

Applying this kind

• Command. vulnetix config apply -f <file>; the CLI line above says from which release. Plan first with vulnetix config plan: it shows each object as create, update, delete or no change, with a planHash that apply then holds to. Apply writes in one transaction.
• Manager. Each object records the manager that applied it (terraform, console or gitops:<repo>). --prune deletes only objects its own manager owns. See The manager and the config engine.
• Status. Applied, Unchanged or Deleted, with no other status fields. The phases the engine reports are explained under status phases.

How apply treats it

• A connection is a ScanRegistryConnection row, unique by metadata.name. It is not the Integrations page’s paid container registry login, which the crawler uses.
• The credential is spec.secret, a valueFrom the client reads and sends once. It is stored in the secrets vault as a connector entry and referenced from the row, never kept in the table, exported or shown in a plan. Left out on a later apply, the stored credential is kept.
• A new or changed credential, URL or username is checked with the registry first, and a login the registry refuses is stored by neither the console nor the engine. The check is made with a client that dials public addresses only.
• The URL and scope read back canonical: an OCI host lower-cased, the other registries https with a lower-case host and a trailing slash, the scope sorted without repeats.
• Each vault write registers its undo: a created entry is revoked, a rotated one is put back, a deleted one is restored. Deleting the document revokes the credential.
• It needs the registry credentials plan feature and saas migration 20261228020000_scan_registry_connection. Until it runs, plan refuses a document, naming the migration.

How a scan uses it

The connection chosen for a host and a package or repository is an enabled one whose scope serves the name, the most specific scope first. Two consumers read it. The manifest curator sends the organization’s own npm, PyPI and Maven connections to the lock runner with each job, only those matching the job’s dependencies plus at most one unscoped default, never to Poetry or pip-tools, and needs the registry credentials plan feature; a login that cannot be opened fails the job instead of running anonymously, and it is never stored in the plan or the result. The runner takes them only when its operator enabled it. vulnetix image asks for a short-lived pull token for one repository (CLI releases after v4.5.0), which needs an owner, admin or member and the plan feature, and falls back to docker login for a registry with no token service or a bearer-secret connection. Every vault read is recorded in the vault activity log. Dependency fetches by the SCA processors are not wired to it yet. The behaviour, the limits and what has not been verified against a real registry are in the private registries guide.

Terraform and OpenTofu

The resource is vulnetix_registry_connection in the vulnetix/resolve provider. Its arguments are the spec in snake case, beside name, labels and annotations from metadata. The Minimal and Advanced HCL are above. The provider’s own reference is vulnetix_registry_connection.

Import an object that already exists by its name:

# Import an existing RegistryConnection by its name (metadata.name).
terraform import vulnetix_registry_connection.github_packages github-packages

A secret is two arguments, never stored in the plan or the state: secret_wo (write-only) and secret_wo_version. Change the version number to send a new value. See Secrets.

Install, authentication and how state is read: Terraform and OpenTofu.

Check a file with vulnetix config validate -f <file>. See Validate documents. In an editor, start the file with the schema comment.