chainctl
chainctl Chainguard Control
For the complete documentation index, see llms.txt.
Add a Chainguard Helm chart and its image dependencies to an organization.
Add a Chainguard Helm chart and its image dependencies to an organization.
Creates synced image repositories in the destination organization for the given Helm chart and all image dependencies listed in the chart’s metadata. Repositories that already exist in the destination organization are skipped. All tags are synced.
Charts are looked up by name in the community catalog by default. To add a chart from the iamguarded catalog, prefix the name with “iamguarded-charts/”.
The chart’s image dependencies are read from a single chart tag. By default the newest non-FIPS tag is used; pass –fips to use the newest FIPS tag instead, or –tag to inspect a specific chart version. –fips and –tag can’t be combined.
On a plan with an image allowance (per-image, Starter or Team), every image the chart depends on is entitled, and each one the organization doesn’t already hold uses a slot. Use –dry-run to list the repositories that would be created. A chart whose metadata lists no image dependencies is refused with an entitlement error.
Examples:
chainctl images helm add-chart argo-cd –parent my-org
chainctl images helm add-chart argo-cd –tag 9.5.20 –parent my-org
chainctl images helm add-chart argo-cd –fips –parent my-org
chainctl images helm add-chart iamguarded-charts/redis –parent my-org
chainctl images helm add-chart CHART [flags] --dry-run Dry-run mode: don't create repos, only show what would change.
--fips Default to the newest FIPS tag of the chart.
--parent string The organization to add the chart and its images to.
--tag string The chart tag to inspect for image dependencies. Defaults to the newest non-FIPS tag. --api string The url of the Chainguard platform API. (default "https://console-api.enforce.dev")
--audience string The Chainguard token audience to request. (default "https://console-api.enforce.dev")
--config string A specific chainctl config file. Uses CHAINCTL_CONFIG environment variable if a file is not passed explicitly.
--console string The url of the Chainguard platform Console. (default "https://console.chainguard.dev")
--force-color Force color output even when stdout is not a TTY.
-h, --help Help for chainctl
--issuer string The url of the Chainguard STS endpoint. (default "https://issuer.enforce.dev")
--log-level string Set the log level (debug, info) (default "ERROR")
-o, --output string Output format. One of: [csv, env, go-template, id, json, markdown, none, table, terse, tree, wide]
-v, --v int Set the log verbosity level.Last updated: 2026-10-28 16:22