Create an upstream proxy

Learn how to configure your artifact registries with an upstream proxy.

An Upstream Proxy in Harness Artifact Registry is a proxy configuration that allows your registry to automatically fetch and cache artifacts from external or remote registries. When a user requests an artifact that isn't available locally, the registry directs the request to the configured upstream proxy, retrieves the artifact, and caches it for future use.

WHY USE AN UPSTREAM PROXY?

The upstream proxy is essential for caching open-source dependencies. During a build, if a required dependency is not already cached, it is retrieved from a public repository (e.g., Docker Hub or Maven Central) and stored in your Upstream Proxy. This ensures continuous availability, even if the source repository experiences downtime. Harness's caching mechanism enhances reliability and efficiency by reducing dependency on external services and safeguarding access to critical artifacts.

Key benefits

An upstream proxy provides these benefits:

• Caching: Faster access to artifacts by storing them locally once fetched

• Centralization: Consolidate external repositories into one location for easier management

• Access control: Enforce your security policies while fetching artifacts

• Reliability: Reduce dependency on external services by leveraging cached artifacts

• Automatic scanning: Artifacts cached through upstream proxies are automatically scanned at ingest time via Supply Chain Security (SCS), not STO

VERIFY YOUR CACHE PATH CONFIGURATION

An incorrect cache path causes builds to bypass the cache entirely, resulting in significantly longer build times. If your builds are unexpectedly slow, verify the cache path in your upstream proxy settings matches your dependency manager configuration.

Create an upstream proxy

Interactive Guide

Creating an Upstream Proxy in Harness Artifact Registry

Step-by-step

To create an upstream proxy, follow these steps:

1. On the Registries tab, select the dropdown next to + New Artifact Registry, then select Upstream Proxy.

2. Select a registry type.

3. Enter the Upstream Proxy Key.

   ALLOWED CHARACTERS

   The proxy key must start with a letter and can only contain lowercase alphanumerics, _, . and -

4. Depending on the registry type, configure the source settings:

5. Choose your Authentication method:

   PUBLIC VS PRIVATE AUTHENTICATION

   • Select Access Key and Secret Key for private sources

   • Select Anonymous (No credentials required) for public sources

6. Select Create Upstream Proxy.

HARNESS SECRET MANAGER REQUIRED

Upstream registry authentication details must be stored in Harness Secret Manager.

External secret managers are not supported for upstream authentication.

This requirement ensures that Harness Artifact Registry can securely decrypt and validate credentials during authentication.

Next steps

Go to Configure Registries to set an upstream proxy for a registry.