service-provider-ocm
An openMCP Service Provider that installs and manages
OCM K8s Toolkit on
workload clusters via Flux HelmReleases.

How It Works
When an OCM resource is created on the onboarding cluster, the controller:
- Replicates the configured image pull secret into the tenant namespace and wires it into the
OCIRepository
- Creates a Flux
OCIRepository pointing at the chart URL from the ProviderConfig and the version from the OCM spec
- Creates a Flux
HelmRelease that deploys the chart into ocm-k8s-toolkit-system on the workload cluster via a kubeconfig reference
API Reference
OCM
The domain service API. Created on the onboarding cluster, one per tenant.
apiVersion: ocm.services.openmcp.cloud/v1alpha1
kind: OCM
metadata:
name: mcp-01 # must match your MCP cluster so it will track the right cluster
spec:
# renovate: datasource=docker depName=ghcr.io/open-component-model/kubernetes/controller/chart
version: 0.4.0
| Field |
Type |
Required |
Description |
spec.version |
string |
yes |
Chart version tag |
Note: The name of the object MUST match the name of your MCP cluster offering. This
is to ensure that no multiple installations can exist for the same cluster.
ProviderConfig
Cluster-scoped operational configuration. Controls the chart location, image pull
secret replication, and Helm values passed to managed HelmReleases.
apiVersion: ocm.services.openmcp.cloud/v1alpha1
kind: ProviderConfig
metadata:
name: ocm # This name here is important!
spec:
pollInterval: 5m
chartURL: ghcr.io/open-component-model/kubernetes/controller/chart
imagePullSecret:
name: my-registry-secret
values:
manager:
concurrency:
resource: 10
spec
| Field |
Type |
Required |
Default |
Description |
chartURL |
string |
no |
ghcr.io/open-component-model/kubernetes/controller/chart |
OCI URL of the Helm chart (oci:// prefix is added automatically if missing) |
pollInterval |
duration |
no |
1m |
How often the controller polls for changes |
imagePullSecret |
LocalObjectReference |
no |
— |
Secret to replicate from the controller's namespace into tenant namespaces and set as secretRef on the OCIRepository |
values |
object |
no |
— |
Arbitrary Helm values passed directly to the HelmRelease |
Check out the controller concept and our guides, e.g.
Deploy Helm Charts.
Running E2E Tests
task test-e2e
Contributing
Code contributions, feature requests, bug reports, and help requests are very welcome. Please refer to the
Contributing Guide in the Community repository
for more information on how to contribute to OCM.
OCM follows the NeoNephos Code of Conduct.
Licensing
Please see our LICENSE for copyright and license information.
Detailed information including third-party components and their licensing/copyright information is available
via the REUSE tool.
