ARC (Artifact Conduit) is an open-source, Kubernetes-native orchestration layer for moving artifacts — container images, Helm charts, software packages, and other resources — from external sources into restricted environments where direct internet access is prohibited. An Order declares which artifacts to transfer; ARC resolves the referenced endpoints and credentials and runs an operator-authored Argo Workflows template for each artifact.
- Declarative API:
Order,Endpoint, andArtifactTyperesources, managed withkubectlor GitOps - Endpoint and credential handling: Reusable source and destination endpoints with referenced credentials, usage constraints, and reachability probing
- Validation:
Orders are checked on admission and against endpoint andArtifactTyperules before any workflow runs - Idempotency: Each artifact is identified by a hash of its definition, so unchanged artifacts are not re-run and changed ones get a new workflow
- Orchestration: One workflow per artifact, which ARC creates, tracks, schedules, and cleans up
- Aggregated status: Per-artifact progress reported in the
Orderstatus, plus Prometheus metrics - Custom artifact types: Operators define
ArtifactTypes, each bound to a workflow template and parameters
Pulling, scanning, verifying, and pushing artifacts happen entirely inside the Argo workflow template an ArtifactType references, which operators author. ARC passes the template its parameters and the endpoint credentials as workflow volumes; the template defines all artifact handling, for example:
- Pulling from OCI registries, Helm repositories, S3-compatible storage, or HTTP endpoints
- Malware scanning, CVE analysis, license checks, and signature verification
- Blocking transfer of artifacts that fail security and compliance policies
- Producing attestations or reports as workflow outputs
ARC ships no workflow templates. The templates in the
examplesdirectory illustrate the integration and are not production-ready. See Extending Artifact Types for writing custom templates.
Out of Scope: ARC does not replace existing registry solutions or artifact repositories, nor does it implement transfer or scanning logic itself. It coordinates artifact transfer between existing infrastructure components through operator-authored workflow templates.
For detailed information have a look at /docs or the live documentation on ARC Docs.
⚠️ Before contributing, make sure you read the contribution guidelines
Please see our documentation in the /docs folder for more details.
The hosted version of the documentation can be found at https://arc.opendefense.cloud/.
We'd love to get feedback from you. See the Contributing Guide for how to report bugs, suggestions, questions and security vulnerabilities and for our development workflow. Everyone participating is expected to follow our Code of Conduct.