> ## Documentation Index
> Fetch the complete documentation index at: https://notes.kodekloud.com/llms.txt
> Use this file to discover all available pages before exploring further.

# What are OCI Artifacts

> This guide explains how OCI Artifacts streamline the storage and distribution of Kubernetes resources in a unified registry.

In this guide, you’ll discover how **OCI Artifacts** simplify storing and distributing a variety of Kubernetes-related resources in a single, unified registry. By leveraging any OCI-compliant registry, you benefit from consistent authentication, authorization, and versioning across:

* Container images
* Helm charts
* Kubernetes manifests
* Kustomize overlays
* OPA policies

## Traditional vs. OCI-Based Storage

| Resource Type                   | Traditional Storage                                                           | Unified OCI Registry   |
| ------------------------------- | ----------------------------------------------------------------------------- | ---------------------- |
| Container images                | Container registries                                                          | OCI-compliant registry |
| Helm charts                     | [Artifact Hub](https://artifacthub.io) or Helm registries                     | OCI-compliant registry |
| Kubernetes manifests & overlays | Git repositories                                                              | OCI-compliant registry |
| OPA policies                    | [Open Policy Registry](https://openpolicyagent.org/docs/latest/opa-registry/) | OCI-compliant registry |

<Callout icon="lightbulb" color="#1CB2FE">
  An OCI registry implements the [OCI Distribution Specification](https://github.com/opencontainers/distribution-spec), enabling you to store any artifact type beyond container images.
</Callout>

***

## OCI Registries and Repositories

An **OCI Registry** is a server-side component that hosts one or more **repositories**, each containing multiple **artifacts** at various tags or digests.

* Registry → Repository → Artifact
* Artifacts can be images, charts, manifests, or any OCI-compatible payload

Next, we’ll walk through pushing three artifact types—Docker images, Helm charts, and plain Kubernetes manifests—to GitHub Container Registry (`ghcr.io`). The workflow applies equally to Azure, GCR, ECR, and other OCI-compliant registries.

***

## 1. Pushing a Docker Image

1. Authenticate with the registry.
2. Tag your local image.
3. Push it upstream.

```bash theme={null}
# 1. Log in to ghcr.io
docker login ghcr.io \
  --username sidd-harth \
  --password <GH_PERSONAL_ACCESS_TOKEN>
# 2. Verify local image
docker images nginx
# REPOSITORY   TAG       IMAGE ID    CREATED     SIZE
# 3. Tag for ghcr.io
docker tag nginx ghcr.io/sidd-harth/nginx:1.1.0

# 4. Push the tagged image
docker push ghcr.io/sidd-harth/nginx:1.1.0
# The push refers to repository [ghcr.io/sidd-harth/nginx]
# 1.1.0: digest sha256:6ad839ec10c687385 size: 1570
```

<Callout icon="triangle-alert" color="#FF6B6B">
  Never commit your `Personal Access Token` or other credentials to version control. Store them securely with your CI/CD secrets manager.
</Callout>

***

## 2. Pushing a Helm Chart

1. Generate a new chart.
2. Package it into a `.tgz`.
3. Authenticate via Helm.
4. Push to the OCI registry.

```bash theme={null}
# 1. Create a chart named "app1"
helm create app1
# 2. Package the chart
helm package app1
# 3. Log in to ghcr.io with Helm
helm registry login ghcr.io \
  --username sidd-harth \
  --password <GH_PERSONAL_ACCESS_TOKEN>
# 4. Push the chart to OCI
helm push app1-1.0.0.tgz oci://ghcr.io/sidd-harth/nginx
# Pushed: ghcr.io/sidd-harth/nginx/app1:1.0.0
# Digest: sha256:81de917eaf38536b1145bdde2984d2cfd14
```

***

## 3. Publishing Plain Kubernetes Manifests

Bundle your plain YAML manifests as an OCI artifact using the Flux CLI.

```bash theme={null}
# Example directory layout
tree nginx/
├── manifests
│   ├── deployment.yaml
│   └── service.yaml
```

1. Ensure you’re logged in (via Docker).
2. Push the manifest directory.

```bash theme={null}
# 1. Authenticate (if not already)
docker login ghcr.io \
  --username sidd-harth \
  --password <GH_PERSONAL_ACCESS_TOKEN>
# 2. Push manifests as OCI artifact
flux push artifact oci://ghcr.io/sidd-harth/nginx-2:$(git rev-parse --short HEAD) \
  --path="./nginx/manifests" \
  --source="$(git config --get remote.origin.url)" \
  --revision="$(git branch --show-current)-$(git rev-parse HEAD)"
# ✓ pushing to ghcr.io/sidd-harth/nginx-2:1b31558
# artifact successfully pushed to ghcr.io/sidd-harth/nginx-2@sha256:235b486d4f4a38f0151
```

***

## What’s Next?

With your artifacts securely stored in an OCI registry, you can seamlessly integrate any GitOps tool—such as [Flux](https://fluxcd.io)—to pull, verify, and deploy them into your Kubernetes clusters.

***

## Links and References

* [Open Container Initiative (OCI)](https://opencontainers.org)
* [OCI Distribution Specification](https://github.com/opencontainers/distribution-spec)
* [GitHub Container Registry](https://github.com/features/packages)
* [Helm OCI Registry Support](https://helm.sh/docs/topics/registries/)
* [Flux CLI: push artifact](https://fluxcd.io/docs/cmd/flux_push_artifact/)

<CardGroup>
  <Card title="Watch Video" icon="video" cta="Learn more" href="https://learn.kodekloud.com/user/courses/gitops-with-fluxcd/module/205ec7c7-4cb6-4ecb-9bb5-fa50419f1e68/lesson/a341e1a3-4789-4f0e-8f85-52391332cb74" />
</CardGroup>