# Repository configuration

Use this page to understand container image repository and pull-secret fields for Ripple Custody.

For the workflow to obtain and verify container images, see [Installation environment setup](/products/custody/deployment/install/helm-chart-installation).

## What this config controls

The `harmonize.repository` section configures where Kubernetes pulls Ripple Custody container images from and how image-pull credentials are supplied.

## Related procedures

- [Obtaining container images](/products/custody/deployment/install/helm-chart-installation#obtaining-container-images) - How to access and mirror images
- [Verifying image signatures](/products/custody/deployment/install/helm-chart-installation#verifying-image-signatures-critical) - Critical security verification
- [Container images reference](/products/custody/deployment/install/helm-chart-installation#container-images-reference) - Complete list of images


## Configuration fields

Location: `harmonize.repository`

| Parameter | Type | Default | Description |
|  --- | --- | --- | --- |
| `base` | string | `metaco.azurecr.io/harmonize` | Base URL for container images. |
| `pullSecrets` | See release values | See release values | Existing Kubernetes secrets for image pulling. |
| `pullSecret.enabled` | boolean | `false` | Enables creation of a pull secret from supplied credentials. |
| `pullSecret.registry` | string | `metaco.azurecr.io` | Registry URL for authentication. |
| `pullSecret.username` | string | `""` | Registry username. |
| `pullSecret.password` | string | `""` | Registry password. |
| `pullSecret.auth` | string | `""` | Pre-encoded base64 authentication string. |


**`pullSecrets` vs `pullSecret`**: These are two different configuration options. `pullSecrets` (plural) references *existing* Kubernetes secrets you have already created. `pullSecret` (singular) tells the deployment configuration to *create* a new pull secret from the credentials you provide. Use `pullSecrets` when managing secrets externally; use `pullSecret` for simple setups where the deployment manages credentials directly.

## Example

This example shows a registry base URL and generated pull secret:


```yaml
harmonize:
  repository:
    base: registry.example.com/harmonize
    pullSecret:
      enabled: true
      registry: registry.example.com
      username: "<registry-username>"
      password: "<registry-password>"
```

This example shows an existing pull secret:


```yaml
harmonize:
  repository:
    base: registry.example.com/harmonize
    pullSecrets:
      - "registry-secret"
```

## Related topics

- [Installation environment setup](/products/custody/deployment/install/helm-chart-installation)
- [Common configuration](/products/custody/deployment/reference/common)