Integrated Registry for Sensor Collector

Crosswork Assurance includes a built-in registry that delivers Sensor Collector container images and Helm charts directly from your deployment. No access to external container registries are required. Air-gapped and connected deployments follow the same download procedure.

Overview

The built-in registry gives every Crosswork Assurance deployment a single, in-cluster endpoint for distributing Sensor Collector images and Helm charts to customer environments, regardless of whether the deployment is connected or air-gapped.

Key Benefits

• Simplified downloads: Sensor Collector deployment packages include pre-authenticated credentials. No manual registry configuration required.
• Unified experience: Air-gapped and connected deployments follow the same procedure.
• No external registry access: Customer environments pull images through the Crosswork Assurance deployment, not from external registries.
• Secure by default: Authentication is handled automatically using credentials already configured for your Sensor Collector zone.

How It Works

When you download a Sensor Collector deployment package (Docker or Kubernetes), the package includes:

• Pre-authenticated download token
• Pre-configured registry endpoint pointing to your Crosswork Assurance deployment
• Automated install scripts that handle authentication

The download token is scoped to read-only operations. It can pull images but cannot push or modify content.

Connected Deployments

In connected (online) deployments, the built-in registry fetches images from the upstream Cisco registry on demand and serves them to your environment.

Air-Gapped Deployments

In air-gapped deployments, the built-in registry serves images from the embedded registry bundled with your installation. No external network access is required.

Authentication

The built-in registry uses pre-authenticated tokens for secure image distribution. These tokens are:

• Automatically generated: Created when you download a deployment package
• Pre-configured: Included in the deployment package
• Scoped to read-only: Can only pull images, not push
• Non-expiring: Valid until the associated service account is deleted

You do not need to manage these tokens manually. The deployment scripts handle authentication automatically.

Deployment Workflows

Kubernetes Deployments

For Kubernetes deployments, the Helm package includes everything needed:

1. Download the Helm package from Sensors > Collectors > Sensor Collectors > Download (Kubernetes)
2. Extract the package
3. Run the install script, it handles authentication automatically

See Deploy Sensor Collector in Kubernetes for complete instructions.

Docker Deployments

For Docker deployments, the Docker package includes pre-configured credentials:

1. Download the Docker package from Sensors > Collectors > Sensor Collectors > Download (Docker)
2. Transfer and extract the package
3. Run the startup script, it handles authentication automatically

See Deploy Sensor Collector in Docker for complete instructions.

CA Certificate Trust

If your Crosswork Assurance deployment uses a self-signed TLS certificate, the container runtime on your deployment target must trust the CA certificate before pulling images.

The deployment packages include the pca_ca.crt file when applicable. See the deployment guides for platform-specific instructions:

• Kubernetes: Configure contained or k0s to trust the CA
• Docker: Add the CA to Docker's certificate directory

Troubleshooting

Related Documentation

• Deploy Sensor Collector in Kubernetes
• Deploy Sensor Collector in Docker
• Configure Sensor Collector