Registry access

This guide explains how to pull TokenTimer Enterprise container images and the Helm chart from the private TokenTimer registry at harbor.tokentimer.ch.

What you receive from TokenTimer

When your enterprise license is issued you also receive a one-time credentials file (.creds.txt) containing:

Field	Example	Purpose
Robot username	robot$tokentimer-enterprise+customer-acme-001	Identity for docker login and helm registry login
Robot token	a long opaque string	Password for the robot account
Expiry date	2027-04-09	Matches the validity of your license
Registry URL	harbor.tokentimer.ch	Endpoint to authenticate against
Project	tokentimer-enterprise	Path prefix for all enterprise artifacts

The token grants pull-only access scoped to the tokentimer-enterprise project. It cannot push, mutate, or list any other project. The token is displayed once at issuance and is never recoverable from Harbor afterwards; store it in a secret manager (1Password, Vault, AWS Secrets Manager).

The same credentials let you pull three kinds of artifact from Harbor:

Artifact	Path	Used by
Container images	harbor.tokentimer.ch/tokentimer-enterprise/tokentimer-enterprise-{api,worker,dashboard}	Docker, containerd, Kubernetes nodes
Helm chart (OCI)	oci://harbor.tokentimer.ch/tokentimer-enterprise/charts/tokentimer-enterprise	helm pull and helm install
Delivery tarball (OCI generic)	harbor.tokentimer.ch/tokentimer-enterprise/bundles/tokentimer-enterprise	oras pull (Compose file, env template, Helm values, docs)

Network requirements

• Outbound HTTPS to harbor.tokentimer.ch:443 from every node that will run TokenTimer Enterprise pods, plus the workstation running helm pull.
• The TLS certificate is issued by Let's Encrypt; no custom CA bundle is required.

1. Pull the Helm chart

The chart is published as an OCI artifact. Use Helm 3.14 or newer. List the published chart versions to pick one (or ask TokenTimer support for the current recommended version):

curl -sSf -u 'robot$tokentimer-enterprise+customer-acme-001' \
  https://harbor.tokentimer.ch/api/v2.0/projects/tokentimer-enterprise/repositories/charts%2Ftokentimer-enterprise/artifacts \
  | jq -r '.[].tags[].name' | sort -V

helm registry login harbor.tokentimer.ch \
  -u 'robot$tokentimer-enterprise+customer-acme-001'
# Enter the robot token at the password prompt.

read -r -p 'Enterprise chart version: ' ENTERPRISE_VERSION
helm pull oci://harbor.tokentimer.ch/tokentimer-enterprise/charts/tokentimer-enterprise \
  --version "$ENTERPRISE_VERSION"

This downloads tokentimer-enterprise-<chart-version>.tgz to the working directory. The chart bundles the core subchart, so no separate tokentimer-core install is required. Inspect the full values schema (enterprise keys plus tokentimer: subchart defaults) with:

helm show values "./tokentimer-enterprise-${ENTERPRISE_VERSION}.tgz"

On an existing release: helm get values tokentimer -n tokentimer -a.

1b. Pull the delivery tarball (for upgrades)

Your initial license delivery already contains tokentimer-enterprise-<version>.tar.gz (Compose file, env template, Helm value examples and defaults, and documentation). It does not ship the Helm chart tarball; pull the chart separately (section 1) when you need helm show values or an air-gapped install artifact. For ongoing upgrades you can re-pull the bundle from Harbor using ORAS and the same robot credentials:

oras login harbor.tokentimer.ch \
  -u 'robot$tokentimer-enterprise+customer-acme-001'
# Enter the robot token at the password prompt.

read -r -p 'Enterprise release: ' ENTERPRISE_VERSION
oras pull "harbor.tokentimer.ch/tokentimer-enterprise/bundles/tokentimer-enterprise:${ENTERPRISE_VERSION}"
mkdir -p ./tokentimer-delivery
tar -xzf "tokentimer-enterprise-${ENTERPRISE_VERSION}.tar.gz" -C ./tokentimer-delivery

The artifact mediaType is application/vnd.tokentimer.bundle.v1+tar+gzip. The latest tag always points at the most recent published version; pin to an explicit version tag instead of latest if you need a reproducible upgrade artifact.

2. Create the image pull Secret

The chart references an imagePullSecret named tokentimer-enterprise-registry. Create it in the namespace where you intend to install:

kubectl create namespace tokentimer
# Use a new private directory; enter the robot token at the Docker prompt.
mkdir -m 700 ./registry-auth
docker --config ./registry-auth login harbor.tokentimer.ch -u 'robot$tokentimer-enterprise+customer-acme-001'
kubectl create secret generic tokentimer-enterprise-registry \
  --type=kubernetes.io/dockerconfigjson \
  --from-file=.dockerconfigjson=./registry-auth/config.json \
  -n tokentimer --dry-run=client -o yaml | kubectl apply -f -
# Remove this temporary credential copy after verifying the Secret.
rm ./registry-auth/config.json
rmdir ./registry-auth

If you prefer a GitOps-friendly workflow, generate the manifest with --dry-run=client -o yaml and store the result alongside your other secrets (SOPS, Sealed Secrets, External Secrets Operator).

3. Install the chart

Follow Install Enterprise with Helm for database, public URLs, TLS, administrator, and license configuration. Start from the scenario values under helm/examples/; registry authentication alone does not configure the application.

4. Verifying pulls

kubectl -n tokentimer get pods
kubectl -n tokentimer describe pod "<pod-name>" | grep -E 'Image|Events'
kubectl -n tokentimer get events --sort-by=.lastTimestamp

A successful pull shows Successfully pulled image "harbor.tokentimer.ch/... in the events. If you see ImagePullBackOff or ErrImagePull, see the troubleshooting section below.

5. Rotating credentials at renewal

When you renew your license, TokenTimer issues a new robot account; the old one is left in place until it expires naturally so there is no service gap.

Update the Kubernetes Secret in place:

# Use a new private directory; enter the robot token at the Docker prompt.
mkdir -m 700 ./registry-auth
docker --config ./registry-auth login harbor.tokentimer.ch -u 'robot$tokentimer-enterprise+customer-acme-001'
kubectl create secret generic tokentimer-enterprise-registry \
  --type=kubernetes.io/dockerconfigjson \
  --from-file=.dockerconfigjson=./registry-auth/config.json \
  -n tokentimer --dry-run=client -o yaml | kubectl apply -f -
# Remove this temporary credential copy after verifying the Secret.
rm ./registry-auth/config.json
rmdir ./registry-auth

Pods only re-authenticate to the registry on the next image pull. To force a fresh pull (e.g. for a chart upgrade), simply run helm upgrade or restart the deployments.

If your license is revoked or terminated, ask TokenTimer to delete the robot account; once deleted, no further pulls succeed.

6. Troubleshooting

unauthorized: authentication required

• Ensure you used the full robot username including the robot$ prefix and the project namespace, e.g. robot$tokentimer-enterprise+customer-acme-001.
• Confirm the token has not expired (check the Expiry date field on your delivery file).
• Test interactively with docker login harbor.tokentimer.ch -u '<robot>' (enter the token at its prompt).

denied: requested access to the resource is denied

The robot is project-scoped. You can only pull from harbor.tokentimer.ch/tokentimer-enterprise/.... Pulling from any other path is denied by design.

ImagePullBackOff

kubectl -n tokentimer describe pod "<pod-name>"

Common causes:

• Pull secret missing in the namespace, or named differently. The chart expects tokentimer-enterprise-registry. Override with --set tokentimer.global.imagePullSecrets[0].name=<your-secret-name>.
• Pull secret created in the wrong namespace. The Secret must live in the same namespace as the workload.

TLS / certificate errors

If your cluster sits behind a TLS-intercepting corporate proxy, add the proxy CA to each node's container runtime trust store. TokenTimer images are served with a public Let's Encrypt certificate and require no custom CA otherwise.

helm pull returns 404

Verify the chart version exists:

curl -sSf -u 'robot$tokentimer-enterprise+customer-acme-001' \
  https://harbor.tokentimer.ch/api/v2.0/projects/tokentimer-enterprise/repositories/charts%2Ftokentimer-enterprise/artifacts \
  | jq '.[].tags'

Reference

• Quick start: Install
• Architecture overview: Architecture
• Helm chart values reference: helm/values.yaml in the chart
• Example value files: helm/examples/ in the delivery tarball