Allow approved plugin registries
Require plugin downloads, cached activation, and registry operations to use an approved OCI registry.
Plugins and catalogs must use an approved company registry
apiVersion: atmos/v1
kind: Policy
metadata:
name: allowed-plugin-registries
description: Require plugin downloads, cached activation, and registry operations to use an approved OCI registry.
spec:
policies:
allowed-plugin-registries:
on: plugin
action: deny
reason: Plugins and catalogs must use an approved company registry
with:
allowed_registries:
- registry.example.com
rule: >-
input.origin in ['development', 'layout'] || !(input.registry in params.allowed_registries)
1 Configure
Set with.allowed_registries to the exact registry authorities your company permits, including a
port when required. Entries are host names such as registry.example.com or
registry.example.com:5000, without oci://, a repository path, or a wildcard. A lookalike host or
different port does not match.
The rule applies to both source and package phases and every plugin operation. It checks the
actual package repository as well as a discovery catalog's repository, so an approved catalog cannot
redirect installation to an unapproved registry. Cached activation is checked again against the
current policy without requiring a new download. Protect the project lockfile that selects those
cached bytes as part of the governing workflow.
The rule also denies origin: development and origin: layout. Local development and conformance
testing have no registry. Explicit --from-layout imports can claim an approved repository without
contacting it, so a matching registry alone is insufficient. Offline layouts require an explicit
governing policy exception.
If your governing policy permits local development while still rejecting layouts, use
input.origin == 'layout' || (input.origin != 'development' && !(input.registry in params.allowed_registries))
(or the equivalent Starlark). Do not add an empty registry entry accidentally.
Pair this with approved plugin packages
to restrict package names, and with signature verification
to authenticate release publishers. source records a declared repository, not a cryptographically
authenticated publisher identity. Registry membership alone does not authenticate the code, and
origin exceptions cannot weaken signature requirements.
2 Save
Save the CEL policy as policy.d/allowed-plugin-registries.yaml. Install only one implementation of each policy.
Atmos discovers policy.d/ at the project root selected by atmos.yaml discovery. Set ATMOS_POLICY_DIR to use another directory.
3 Run
atmos plugin install oci://registry.example.com/team/oidc --as corporate --version 1.2.0
Review required tools and callback settings before running. In CI, load policies from a protected, pinned revision. See enforcement configuration.
