Zarf

https://docs.zarf.dev/
Admin
Zarf is an open-source tool for declaratively creating and distributing software into air-gapped or...
Tokens:138,883
Snippets:1,359
Trust Score:7.2
Update:1 month ago
Show doc for...
Tokens:
Raw
### Log in to a registry example

Source: https://docs.zarf.dev/commands/zarf_tools_sbom_login

An example of logging into a specific registry using a username and password.

```bash
  # Log in to reg.example.com
  zarf tools sbom login reg.example.com -u AzureDiamond -p hunter2
```

--------------------------------

### YAML configuration file example

Source: https://docs.zarf.dev/ref/config-files

Example of a YAML-formatted Zarf configuration file.

```yaml
# Example config file, use "zarf prepare generate-config zarf-config.yaml" to generate a new one
log_level : 'info'


package:
  create:
    skip_sbom : false
    set:
      zebra : 'stripes'
      leopard : 'spots'
  deploy:
    components: 'lion'
    values:
      - deploy-values.yaml
```

--------------------------------

### zarf tools wait-for resource usage examples

Source: https://docs.zarf.dev/commands/zarf_tools_wait-for_resource

Various examples demonstrating how to wait for different Kubernetes resources, conditions, and namespaces.

```bash
$ zarf tools wait-for resource deployment my-deployment -n default               #  wait for deployment to be reconciled (default condition)
$ zarf tools wait-for resource po cool-pod-name -n cool                          #  wait for pod (using po alias) cool-pod-name in namespace cool to be reconciled
$ zarf tools wait-for resource pod my-pod-name ready -n default                  #  wait for pod my-pod-name in namespace default to have the ready condition
$ zarf tools wait-for resource pod app=podinfo -n podinfo                        #  wait for pod(s) with label app=podinfo in namespace podinfo to be reconciled
$ zarf tools wait-for resource deployment zarf-docker-registry exists -n zarf    #  wait for deployment zarf-docker-registry in namespace zarf to exist
$ zarf tools wait-for resource svc zarf-docker-registry delete -n zarf           #  wait for service zarf-docker-registry in namespace zarf to not exist
$ zarf tools wait-for resource pvc -n zarf                                       #  wait for any pvc in namespace zarf to exist
$ zarf tools wait-for resource crd addons.k3s.cattle.io                          #  wait for crd addons.k3s.cattle.io to exist
$ zarf tools wait-for resource sts test-sts '{.status.availableReplicas}'=23     #  wait for statefulset test-sts to have 23 available replicas
```

--------------------------------

### Install pre-commit hooks and golangci-lint

Source: https://docs.zarf.dev/contribute/contributor-guide

Commands to initialize pre-commit hooks in the local repository and install the required golangci-lint tool.

```bash
# install hooks into .git/hooks
pre-commit install


# install golangci-lint (used by the goimports and lint hooks)
go install github.com/golangci/golangci-lint/cmd/golangci-lint@latest
```

--------------------------------

### Get image digest examples

Source: https://docs.zarf.dev/commands/zarf_tools_registry_digest

Examples of retrieving image digests from internal and external repositories.

```bash
# Return an image digest for an internal repo in Zarf
$ zarf tools registry digest 127.0.0.1:31999/stefanprodan/podinfo:6.4.0


# Return an image digest from a repo hosted at reg.example.com
$ zarf tools registry digest reg.example.com/stefanprodan/podinfo:6.4.0
```

--------------------------------

### TOML configuration file example

Source: https://docs.zarf.dev/ref/config-files

Example of a TOML-formatted Zarf configuration file.

```toml
# Example config file, use "zarf prepare generate-config" to generate a new one
log_level = 'info'


[package]
[package.create]
skip_sbom = false


[package.create.set]
zebra = 'stripes'
leopard = 'spots'


[package.deploy]
components = 'lion'
values = ['deploy-values.yaml']
```

--------------------------------

### Configure K3s component deployment

Source: https://docs.zarf.dev/ref/components

Example of a complex component configuration for installing K3s, including file transfers, symlink creation, and deployment actions for system setup.

```yaml
  - name: k3s
    only:
      localOS: linux
      cluster:
        architecture: amd64
    description: >
      *** REQUIRES ROOT (not sudo) ***
      Install K3s, a certified Kubernetes distribution built for IoT & Edge computing.
      K3s provides the cluster need for Zarf running in Appliance Mode as well as can
      host a low-resource Gitops Service if not using an existing Kubernetes platform.
    files:
      # K3s removal script
      - source: zarf-clean-k3s.sh
        target: /opt/zarf/zarf-clean-k3s.sh
        executable: true
      # The K3s systemd service definition
      - source: k3s.service
        target: /etc/systemd/system/k3s.service
        symlinks:
          - /etc/systemd/system/multi-user.target.wants/k3s.service
      # Include the actual K3s binary
      - source: https://github.com/k3s-io/k3s/releases/download/v1.34.3+k3s1/k3s
        shasum: f95350e3997165974d1d1406f01aabaf869aed7ca790cc2d83a92a82f26a06c5
        target: /usr/sbin/k3s
        executable: true
        # K3s magic provides these tools when symlinking
        symlinks:
          - /usr/sbin/kubectl
          - /usr/sbin/ctr
          - /usr/sbin/crictl
      # Transfer the K3s images for containerd to pick them up
      - source: https://github.com/k3s-io/k3s/releases/download/v1.34.3+k3s1/k3s-airgap-images-amd64.tar.zst
        shasum: b8dff3265568e1be66ab72ac0ded68bd266fa37a32c010f1253dba6547a49ce8
        target: /var/lib/rancher/k3s/agent/images/k3s.tar.zst
    actions:
      onDeploy:
        defaults:
          maxRetries: 5
        before:
          - cmd: if [ "$(uname -m)" != "x86_64" ]; then echo "this package architecture is amd64, but the target system has a different architecture. These architectures must be the same" && exit 1; fi
            description: Check that the host architecture matches the package architecture
            maxRetries: 0
          - cmd: ./zarf internal is-valid-hostname
            maxRetries: 0
            description: Check if the current system has a, RFC1123 compliant hostname
          # If running RHEL variant, disable firewalld
          # https://rancher.com/docs/k3s/latest/en/advanced/#additional-preparation-for-red-hat-centos-enterprise-linux
          # NOTE: The empty echo prevents infinite retry loops on non-RHEL systems where the exit code would be an error
          - cmd: "[ -e /etc/redhat-release ] && systemctl disable firewalld --now || echo ''"
            description: If running a RHEL variant, disable 'firewalld' per k3s docs
        after:
          # Configure K3s systemd service
          - cmd: systemctl daemon-reload
            description: Reload the system services
          - cmd: systemctl enable k3s
            description: Enable 'k3s' to run at system boot
          - cmd: systemctl restart k3s
            description: Start the 'k3s' system service
      onRemove:
        before:
          - cmd: /opt/zarf/zarf-clean-k3s.sh
            description: Remove 'k3s' from the system
          - cmd: rm /opt/zarf/zarf-clean-k3s.sh
            description: Remove the cleanup script
```

--------------------------------

### Zarf Package Configuration Template Example

Source: https://docs.zarf.dev/ref/create

An example of a 'zarf.yaml' file using '###ZARF_PKG_TMPL_PROMPT_ON_CREATE###' to prompt for a variable during package creation.

```yaml
kind: ZarfPackageConfig
metadata:
  name: 'pkg-variables'
  description: 'Prompt for a variables during package create'


constants:
  - name: PROMPT_IMAGE
    value: '###ZARF_PKG_TMPL_PROMPT_ON_CREATE###'


components:
  - name: zarf-prompt-image
    required: true
    images:
      - '###ZARF_PKG_TMPL_PROMPT_ON_CREATE###'
```

--------------------------------

### Install Zarf and Create Package in GitHub Action

Source: https://docs.zarf.dev/ref/github-action

This snippet shows how to use the setup-zarf action to install a specific Zarf version and then create a Zarf package. Ensure the Zarf version is valid.

```yaml
jobs:
  create_package:
    runs-on: ubuntu-latest


    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 1


      - name: Install Zarf
        uses: zarf-dev/setup-zarf@main # use action's main branch
        with:
          version: v0.69.0 # any valid zarf version, leave blank to use latest


      - name: Create the package
        run: zarf package create --confirm

```

--------------------------------

### Retrieve image manifest examples

Source: https://docs.zarf.dev/commands/zarf_tools_registry_manifest

Examples showing how to retrieve manifests from an internal Zarf repository and a public GitHub Container Registry (ghcr.io) repository.

```bash
# Return an image manifest for an internal repo in Zarf
$ zarf tools registry manifest 127.0.0.1:31999/stefanprodan/podinfo:6.4.0


# Return an image manifest from a repo hosted at ghcr.io
$ zarf tools registry manifest ghcr.io/stefanprodan/podinfo:6.4.0
```

--------------------------------

### Log out from a registry example

Source: https://docs.zarf.dev/commands/zarf_tools_registry_logout

Example of logging out from a specific registry.

```bash
# Log out from a registry
  $ zarf tools registry logout registry.example.com
```

--------------------------------

### zarf tools wait-for network usage examples

Source: https://docs.zarf.dev/commands/zarf_tools_wait-for_network

Examples demonstrating how to wait for HTTP, HTTPS, and TCP endpoints with optional status code requirements.

```bash
$ zarf tools wait-for network http localhost:8080 200                           #  wait for a 200 response from http://localhost:8080
$ zarf tools wait-for network tcp localhost:8080                                #  wait for a connection to be established on localhost:8080
$ zarf tools wait-for network https 1.1.1.1 200                                 #  wait for a 200 response from https://1.1.1.1
$ zarf tools wait-for network http google.com                                   #  wait for any 2xx response from http://google.com
$ zarf tools wait-for network http google.com success                           #  wait for any 2xx response from http://google.com
```

--------------------------------

### Zarf Init Package Definition Example

Source: https://docs.zarf.dev/tutorials/7-custom-init-packages

This is an example of the Zarf init package definition that will be displayed when `zarf package create` is executed. It outlines the components, actions, and files included in the package.

```yaml
**$zarf package create .**

**kind**: ZarfInitConfig**
******metadata**:****
**  name**: init**
**  ****description**: Used to establish a new Zarf cluster**
******components**: 
-** name**: k3s**
  ****description**: "*** REQUIRES ROOT *** Install K3s, certified Kubernetes distribution built for IoT & Edge computing. K3s provides the cluster need for Zarf running in Appliance Mode as well as can host a low-resource Gitops Service if not using an existing Kubernetes platform."******
  only**:****
    localOS**: linux**
    ****cluster**:****
      architecture**: arm64**
  ****actions**:****
    onDeploy**:****
      defaults**:****
        maxRetries**: 5**
      ****before**: 
      -** maxRetries**: 0**
        ****cmd**: ./zarf internal is-valid-hostname**
      **-** cmd**: "[ -e /etc/redhat-release ] && systemctl disable firewalld --now || echo ''"******
      after**: 
      -** cmd**: systemctl daemon-reload**
      **-** cmd**: systemctl enable k3s**
      **-** cmd**: systemctl start k3s**
  ****files**: 
  -** source**: packages/distros/k3s/common/zarf-clean-k3s.sh**
    ****target**: /opt/zarf/zarf-clean-k3s.sh**
    ****executable**: true**
  **-** source**: packages/distros/k3s/common/k3s.service**
    ****target**: /etc/systemd/system/k3s.service**
    ****symlinks**: 
    - /etc/systemd/system/multi-user.target.wants/k3s.service**
  **-** source**: https://github.com/k3s-io/k3s/releases/download/v1.24.1+k3s1/k3s-arm64**
    ****shasum**: bd8b87d215f7a073d0139a0ab70e3fbeaa76e1b9ce6c00cd8d471cb44ba80687**
    ****target**: /usr/sbin/k3s**
    ****executable**: true**
    ****symlinks**: 
    - /usr/sbin/kubectl**
    **-** /usr/sbin/ctr**
    **-** /usr/sbin/crictl**
  **-** source**: https://github.com/k3s-io/k3s/releases/download/v1.24.1+k3s1/k3s-airgap-images-arm64.tar.zst**
    ****shasum**: 12029e4bbfecfa16942345aeac798f4790e568a7202c2b85ee068d7b4756ba04**
    ****target**: /var/lib/rancher/k3s/agent/images/k3s.tar.zst**
****-** name**: zarf-injector**
  ****description**: |
    Bootstraps a Kubernetes cluster by cloning a running pod in the cluster and hosting the registry image.
    Removed and destroyed after the Zarf Registry is self-hosting the registry image.**
  ****required**: true**
  ****cosignKeyPath**: cosign.pub**
  ****files**: 
  -** source**: sget://defenseunicorns/zarf-injector:arm64-2023-02-09**

```

--------------------------------

### zarf dev generate example

Source: https://docs.zarf.dev/commands/zarf_dev_generate

An example of generating a zarf.yaml for the podinfo chart from a specific git repository and version.

```bash
zarf dev generate podinfo --url https://github.com/stefanprodan/podinfo.git --version 6.4.0 --gitPath charts/podinfo --output-directory ./podinfo
```

--------------------------------

### Autogenerate registry credentials

Source: https://docs.zarf.dev/commands/zarf_tools_update-creds_registry

Example of running the command to autogenerate new registry credentials.

```bash
$ zarf tools update-creds registry
```

--------------------------------

### Install bash completions on Linux

Source: https://docs.zarf.dev/commands/zarf_completion_bash

Persist autocompletion for new sessions by writing the script to the bash_completion.d directory.

```bash
zarf completion bash > /etc/bash_completion.d/zarf
```

--------------------------------

### Set external registry credentials

Source: https://docs.zarf.dev/commands/zarf_tools_update-creds_registry

Example of running the command to set specific credentials for an external registry.

```bash
$ zarf tools update-creds registry --registry-push-username={USERNAME} --registry-push-password={PASSWORD}
```

--------------------------------

### Provide user-managed agent TLS certificates

Source: https://docs.zarf.dev/commands/zarf_tools_update-creds_agent

Example of running the command with user-provided CA, certificate, and key paths.

```bash
# Provide user-managed agent TLS certificates:
$ zarf tools update-creds agent --agent-tls-ca={CA_PATH} --agent-tls-cert={CERT_PATH} --agent-tls-key={KEY_PATH}
```

--------------------------------

### Define variable with default and prompt

Source: https://docs.zarf.dev/ref/values

Example of configuring a variable with a default value and enabling user prompts.

```yaml

variables:
  name: DATABASE_USERNAME
  default: 'postgres'
  prompt: true

```

--------------------------------

### Inspect values-files for a local package

Source: https://docs.zarf.dev/commands/zarf_package_inspect_values-files

Example showing how to inspect values-files for a local Zarf package tarball.

```bash
$ zarf package inspect values-files zarf-package-my-app-amd64-1.0.0.tar.zst
```

--------------------------------

### Initialize with custom init package

Source: https://docs.zarf.dev/commands/zarf_init

Use a specific OCI registry path for the init package.

```bash
$ zarf init oci://ghcr.io/zarf-dev/packages/init:v0.69.0
```

--------------------------------

### Get digest of a package in an OCI registry

Source: https://docs.zarf.dev/commands/zarf_package_inspect_digest

Example of retrieving the digest directly from an OCI registry.

```bash
$ zarf package inspect digest oci://ghcr.io/my-org/my-package:1.0.0
```

--------------------------------

### Get digest of a local package tarball

Source: https://docs.zarf.dev/commands/zarf_package_inspect_digest

Example of retrieving the digest from a local .tar.zst file.

```bash
$ zarf package inspect digest zarf-package-my-app-amd64-1.0.0.tar.zst
```

--------------------------------

### Get stored digest of a deployed package

Source: https://docs.zarf.dev/commands/zarf_package_inspect_digest

Example of retrieving the digest for a package already deployed to a cluster.

```bash
$ zarf package inspect digest my-package
```

--------------------------------

### Deploying Zarf packages

Source: https://docs.zarf.dev/commands/zarf_package_deploy

Examples of deploying packages from different sources including local files, OCI registries, HTTPS URLs, and split package files.

```bash
# Deploy a local package tarball
$ zarf package deploy zarf-package-my-app-amd64-1.0.0.tar.zst --confirm


# Deploy a package from an OCI registry (oci:// prefix optional)
$ zarf package deploy oci://ghcr.io/my-org/my-package:1.0.0 --confirm


# Deploy a package from an HTTPS URL (--shasum required for integrity verification)
$ zarf package deploy https://example.com/zarf-package-my-app-amd64-1.0.0.tar.zst --shasum <sha256sum> --confirm


# Deploy a split package (pass the .part000 file)
$ zarf package deploy zarf-package-my-app-amd64-1.0.0.tar.zst.part000 --confirm
```

--------------------------------

### Minimal zarf.yaml for init package

Source: https://docs.zarf.dev/ref/init-package

A minimal configuration example for a Zarf init package, showing the required components and their respective import paths.

```yaml
kind: ZarfInitConfig
metadata:
  name: init


components:
  - name: zarf-injector
    required: true
    import:
      path: packages/zarf-registry


  - name: zarf-seed-registry
    required: true
    import:
      path: packages/zarf-registry


  - name: zarf-registry
    required: true
    import:
      path: packages/zarf-registry


  - name: zarf-agent
    required: true
    import:
      path: packages/zarf-agent
```

--------------------------------

### Initialize Zarf with Components and Confirmation

Source: https://docs.zarf.dev/tutorials/4-creating-a-k8s-cluster-with-zarf

Automatically accept the k3s component and confirm the package deployment using the '--components' and '--confirm' flags.

```bash
zarf init --components="k3s" --confirm
```

--------------------------------

### Verify Zarf Installation

Source: https://docs.zarf.dev/getting-started/install

Check the installed version of Zarf to verify it is in your PATH.

```bash
$ zarf version


vX.X.X  # X.X.X is replaced with the version number of your specific installation
```

--------------------------------

### Deploy all components using globbing

Source: https://docs.zarf.dev/ref/components

Use the asterisk glob pattern to deploy all components regardless of their optional status.

```bash
# deploy optional-component-1 and optional-component-2 components whether they are required or not
$ zarf package deploy ./path/to/package.tar.zst --components=*
```

--------------------------------

### Install Zarf via Homebrew

Source: https://docs.zarf.dev/getting-started/install

Use Homebrew to install Zarf on macOS or Linux.

```bash
brew install defenseunicorns/tap/zarf
```

--------------------------------

### Command help options

Source: https://docs.zarf.dev/commands/zarf_tools_registry_manifest

Displays the help flag for the manifest command.

```bash
  -h, --help   help for manifest
```

--------------------------------

### Install and Use vexctl

Source: https://docs.zarf.dev/contribute/vulnerability-management

Install the vexctl tool and add a non-affected statement to the Zarf VEX document.

```bash
# Install vexctl when it is not already available.
go install github.com/openvex/vexctl@latest


vexctl add \
  --in-place \
  --product "pkg:golang/<module>@<version>" \
  --vuln "GHSA-XXXX-XXXX-XXXX" \
  --status not_affected \
  --justification vulnerable_code_not_in_execute_path \
  --impact-statement "Describe the vulnerable function, the required trigger, and why Zarf cannot reach it." \
  .vex/zarf.cli.openvex.json
```

--------------------------------

### Initialize without optional components

Source: https://docs.zarf.dev/commands/zarf_init

Run zarf init without any additional components.

```bash
$ zarf init
```

--------------------------------

### Zarf onCreate Action Configuration

Source: https://docs.zarf.dev/ref/actions

An example of an onCreate action set defining defaults, before, and after hooks. It demonstrates setting environment variables, retries, timeouts, and shell overrides.

```yaml
  - name: on-create
    actions:
      # runs during "zarf package create"
      onCreate:
        # defaults are applied to all actions in this action set - below are the default defaults
        defaults:
          dir: ""
          env: []
          maxRetries: 0
          maxTotalSeconds: 300
          mute: false
          shell:
            darwin: sh
            linux: sh
            windows: powershell
        # runs before the component is created
        before:
          # on Windows with `pwsh` or `powershell`, `touch` is replaced with New-Item
          - cmd: touch test-create-before.txt
            # description shows a more user friendly message when waiting for the command
            description: Create a test file
            # dir is the directory to run the command in
            dir: ""
            # env sets environment variables for this action only
            env:
              - thing=stuff
            # maxRetries is the number of times to retry the action if it fails
            maxRetries: 0
            # maxTotalSeconds is the maximum amount of times the action can run before it is killed, over all retries
            maxTotalSeconds: 30
            # mute determine if actions output should be printed to the console
            mute: false
            # shell sets the preferred shell across operating systems, in this case "pwsh" instead of "powershell" on Windows
            shell:
              windows: pwsh
        # runs after the component is created
        after:
          # actions in a list run in order
          - cmd: touch test-create-after.txt
          - cmd: sleep 0.5
          - cmd: echo "I can print!"
          - cmd: sleep 0.5
          # cmd actions can also specify a multiline string to run like a script
          - cmd: |
              echo "multiline!"
              sleep 0.5
              echo "updates!"
              sleep 1
              echo "in!"
              sleep 0.5
              echo "realtime!"
              sleep 0.5
```

--------------------------------

### Build Zarf from Source

Source: https://docs.zarf.dev/getting-started/install

Clone the repository and build the Zarf CLI using make.

```bash
git clone https://github.com/zarf-dev/zarf
cd zarf
# build the CLI for your current OS and architecture
make


# see all available make targets
make help
```

--------------------------------

### zarf tools sbom scan examples

Source: https://docs.zarf.dev/commands/zarf_tools_sbom

Examples of scanning an image with different output formats, verbosity levels, and custom templates.

```bash
  zarf tools sbom scan alpine:latest                                a summary of discovered packages
  zarf tools sbom scan alpine:latest -o json                        show all possible cataloging details
  zarf tools sbom scan alpine:latest -o cyclonedx                   show a CycloneDX formatted SBOM
  zarf tools sbom scan alpine:latest -o cyclonedx-json              show a CycloneDX JSON formatted SBOM
  zarf tools sbom scan alpine:latest -o spdx                        show a SPDX 2.3 Tag-Value formatted SBOM
  zarf tools sbom scan alpine:latest -o spdx@2.2                    show a SPDX 2.2 Tag-Value formatted SBOM
  zarf tools sbom scan alpine:latest -o spdx-json                   show a SPDX 2.3 JSON formatted SBOM
  zarf tools sbom scan alpine:latest -o spdx-json@2.2               show a SPDX 2.2 JSON formatted SBOM
  zarf tools sbom scan alpine:latest -vv                            show verbose debug information
  zarf tools sbom scan alpine:latest -o template -t my_format.tmpl  show a SBOM formatted according to given template file
```

--------------------------------

### Configure Registry for High Availability

Source: https://docs.zarf.dev/ref/init-package

Example configuration file for the init package to enable ReadWriteMany storage, HPA auto-scaling, and custom pod anti-affinity.

```yaml
package:
  deploy:
    set:
      REGISTRY_PVC_ENABLED: "true"
      REGISTRY_PVC_ACCESS_MODE: "ReadWriteMany"
      REGISTRY_HPA_AUTO_SIZE: "true"
      REGISTRY_AFFINITY_CUSTOM: |
        podAntiAffinity:
          preferredDuringSchedulingIgnoredDuringExecution:
            - weight: 100
              podAffinityTerm:
                labelSelector:
                  matchExpressions:
                    - key: app
                      operator: In
                      values:
                        - docker-registry
                topologyKey: kubernetes.io/hostname
```

--------------------------------

### Create a Package

Source: https://docs.zarf.dev/tutorials/5-package-signing-and-verification

Create a WordPress package for the amd64 architecture. The output log confirms the path to the generated package file.

```bash
zarf package create ./zarf/examples/wordpress --architecture amd64
```

```bash
INF writing package to disk path=zarf-package-wordpress-amd64-26.0.0.tar.zst
```

--------------------------------

### zarf tools sbom convert examples

Source: https://docs.zarf.dev/commands/zarf_tools_sbom_convert

Common usage examples for converting SBOM files, including outputting to stdout or specific files.

```bash
  zarf tools sbom convert img.zarf tools sbom.json -o spdx-json                      convert a zarf tools sbom SBOM to spdx-json, output goes to stdout
  zarf tools sbom convert img.zarf tools sbom.json -o cyclonedx-json=img.cdx.json    convert a zarf tools sbom SBOM to CycloneDX, output is written to the file "img.cdx.json"
  zarf tools sbom convert - -o spdx-json                                  convert an SBOM from STDIN to spdx-json
```

--------------------------------

### Inspect values-files for an OCI registry package

Source: https://docs.zarf.dev/commands/zarf_package_inspect_values-files

Example showing how to inspect values-files for a package hosted in an OCI registry.

```bash
$ zarf package inspect values-files oci://ghcr.io/my-org/my-package:1.0.0
```

--------------------------------

### Deploy Zarf package with default, confirm, and specific component flags

Source: https://docs.zarf.dev/ref/components

Examples of deploying a Zarf package with standard prompts, automatic confirmation, or selecting specific components.

```bash
# deploy all required components, prompting for optional components and variables
$ zarf package deploy ./path/to/package.tar.zst


# deploy all required components, ignoring optional components and variable prompts
$ zarf package deploy ./path/to/package.tar.zst --confirm


# deploy optional-component-1 and optional-component-2 components whether they are required or not
$ zarf package deploy ./path/to/package.tar.zst --components=optional-component-1,optional-component-2
```

--------------------------------

### List Installed Zarf Packages

Source: https://docs.zarf.dev/tutorials/3-deploy-a-retro-arcade

Use `zarf package list` to view all installed packages and their components. This helps identify the package name for removal.

```bash
$ zarf package list
Saving log file to
/var/folders/bk/rz1xx2sd5zn134c0_j1s2n5r0000gp/T/zarf-2023-03-23-10-05-29-1632940529.log
**********     Package  ******** | ********Components                                                 ********
     init     ****** | **[zarf-injector zarf-seed-registry zarf-registry zarf-agent]
     dos-games****** | **[baseline]

```

--------------------------------

### List Installed Zarf Packages

Source: https://docs.zarf.dev/tutorials/2-deploying-zarf-packages

Use `zarf package list` to view all installed Zarf packages and their components. This helps identify the correct package name for removal.

```bash
$ zarf package list
Saving log file to
/var/folders/bk/rz1xx2sd5zn134c0_j1s2n5r0000gp/T/zarf-2023-03-23-10-05-29-1632940529.log
**********     Package  ******** | ********Components                                                 ********
     init     ****** | **[zarf-injector zarf-seed-registry zarf-registry zarf-agent]
     wordpress****** | **[wordpress]

```

--------------------------------

### Deploy k3s with default arguments

Source: https://docs.zarf.dev/ref/init-package

Example command to initialize Zarf with the k3s component while resetting K3S_ARGS to an empty string to restore default k3s behavior.

```bash
root@machine ~ # zarf init --components k3s --set K3S_ARGS="" --confirm
```

--------------------------------

### Initialize Zarf

Source: https://docs.zarf.dev/tutorials/4-creating-a-k8s-cluster-with-zarf

Run the 'zarf init' command as root to begin the Zarf initialization process.

```bash
# zarf init
```

--------------------------------

### Autogenerate Zarf credentials

Source: https://docs.zarf.dev/commands/zarf_tools_update-creds

Examples for autogenerating all credentials at once or for specific services.

```bash
# Autogenerate all Zarf credentials at once:
$ zarf tools update-creds


# Autogenerate specific Zarf service credentials:
$ zarf tools update-creds registry
$ zarf tools update-creds git
$ zarf tools update-creds artifact
$ zarf tools update-creds agent
```

--------------------------------

### Successful verification output

Source: https://docs.zarf.dev/ref/package-signing

Example of the console output when a package verification succeeds.

```text
2025-11-15 14:17:13 INF checksum verification status=PASSED
Verified OK
2025-11-15 14:17:16 INF signature verification status=PASSED
2025-11-15 14:17:16 INF verification complete status=SUCCESS
```

--------------------------------

### generate-config help options

Source: https://docs.zarf.dev/commands/zarf_dev_generate-config

Displays the help information for the generate-config command.

```bash
-h, --help   help for generate-config
```

--------------------------------

### Example Output for Source Images

Source: https://docs.zarf.dev/best-practices/vulnerability-scanning

The output of the source image listing command.

```text
ghcr.io/go-gitea/gitea
ghcr.io/zarf-dev/agent
registry1.dso.mil/ironbank/redhat/ubi/ubi9-minimal
```

--------------------------------

### Zarf Package Configuration with Values Templating

Source: https://docs.zarf.dev/ref/examples/values-templating

A complete zarf.yaml example demonstrating manifest templating, Helm chart value mapping, and template processing in actions.

```yaml
kind: ZarfPackageConfig
metadata:
  name: values-templating
  description: Example nginx package to demonstrate Zarf Values templating
values:
  files:
    - values/values.yaml
  schema: values/values.schema.json


# Until Consts and Vars are fully deprecated, they'll be available in go-templates
constants:
  - name: EXAMPLE_CONST
    value: "foo"
variables:
  - name: EXAMPLE_VAR
    default: "bar"


components:
  - name: values-with-manifest
    description: This component demonstrates templating manifest files by deploying an nginx page to the cluster
    required: true
    images:
      - "docker.io/library/nginx:1.29.2"
    actions:
      onRemove:
        before:
          - cmd: |
              echo "============================================"
              echo "Removing {{ .Values.site.name }}"
              echo "Environment: {{ .Values.app.environment }}"
              echo "Organization: {{ .Values.site.organization }}"
              echo "============================================"
            template: true
    manifests:
      - name: values-with-nginx
        # Enables go-templating within the files.
        template: true
        files:
          - nginx-deployment.yaml
          - nginx-service.yaml
          - nginx-configmap.yaml


  - name: values-with-helm-chart
    description: This component demonstrates helm chart value overrides using Zarf values
    required: true
    charts:
      - name: example-chart
        version: 0.1.0
        localPath: "charts/example-chart"
        namespace: "helm-overrides"
        values:
          - sourcePath: ".app.name"
            targetPath: ".appName"
          - sourcePath: ".app.replicas"
            targetPath: ".replicaCount"
          - sourcePath: ".database.host"
            targetPath: ".config.database.host"
          # Multiple mappings are ok. They are evaluated first to last, so the latest mapping will take priority.
          - sourcePath: ".database.host2"
            targetPath: ".config.database.host"
          # excludePaths omit sourcePath sub-objects to prevent them from being mapped to the target.
          # Here we omit the image reference and hardcode it to the chart values file since it will always be the image used on create.
          - sourcePath: ".app.image"
            targetPath: ".image"
            excludePaths:
              - ".app.image.reference"


  - name: actions-with-templates
    description: "This component demonstrates using template: true to enable go-template processing in actions"
    required: true
    actions:
      onDeploy:
        before:
          # By default, templating is disabled in actions to avoid conflicts with external tools
          # Set template: true to enable Zarf's go-template processing
          - cmd: |
              echo "Organization: {{ .Values.site.organization }}"
              echo "Environment: {{ .Values.app.environment }}"
            template: true
          # Without template: true, go-template syntax is passed through unchanged
          - cmd: |
              echo "This {{ .wontBeProcessed }} stays as-is"


documentation:
  readme: readme.md
```

--------------------------------

### Configure imageArchives in Zarf

Source: https://docs.zarf.dev/ref/components

Example of pulling images from a tar archive into a Zarf package.

```yaml
- name: image-archive
  description: "pull in an image from a tar archive"
  required: true
  imageArchives:
  - path: image.tar
    images:
    - ghcr.io/fluxcd/helm-controller:v1.1.0
    - ghcr.io/fluxcd/image-automation-controller:v0.39.0
```

--------------------------------

### Sign a package during creation

Source: https://docs.zarf.dev/ref/package-signing

Use the --signing-key and --signing-key-pass flags during the package creation process to sign the package immediately.

```bash
zarf package create . --signing-key cosign.key --signing-key-pass <password>
```

--------------------------------

### Merge Multiple Files

Source: https://docs.zarf.dev/commands/zarf_tools_yq_eval-all

Example of merging all provided YAML files into a single output.

```bash
# Merge all given files
zarf tools yq ea '. as $item ireduce ({}; . * $item )' file1.yml file2.yml ...
```

--------------------------------

### Variable Template Syntax

Source: https://docs.zarf.dev/ref/values

Example of using the ###ZARF_VAR_DATABASE_USERNAME### syntax within a Kubernetes ConfigMap.

```yaml

apiVersion: v1
kind: ConfigMap
metadata:
  name: db-configmap
data:
  username: ###ZARF_VAR_DATABASE_USERNAME###

```

--------------------------------

### Clone the Zarf repository

Source: https://docs.zarf.dev/tutorials/5-package-signing-and-verification

Clone the Zarf source repository to access the example packages.

```bash
git clone https://github.com/zarf-dev/zarf.git
```

--------------------------------

### Initialize Zarf

Source: https://docs.zarf.dev/getting-started/install

Initialize Zarf and optionally download the init package without prompts.

```bash
# if no init package is detected, zarf will prompt you to download the default one on init
$ zarf init


# if you want to download the init package without being prompted
$ zarf tools download-init
$ zarf init --confirm
```

--------------------------------

### Command usage syntax

Source: https://docs.zarf.dev/commands/zarf_connect_resource

The basic syntax for executing the connect resource command.

```bash
zarf connect resource [flags]
```

--------------------------------

### Basic command usage

Source: https://docs.zarf.dev/commands/zarf_tools_registry_ls

The basic syntax for listing tags in a repository.

```bash
zarf tools registry ls REPO [flags]
```

--------------------------------

### Pull image from external repository

Source: https://docs.zarf.dev/commands/zarf_tools_registry_pull

Example of pulling an image from an external registry to a tarball.

```bash
$ zarf tools registry pull reg.example.com/stefanprodan/podinfo:6.4.0 image.tar
```

--------------------------------

### Download Latest Zarf Init Package

Source: https://docs.zarf.dev/best-practices/upgrading-zarf

Fetches the latest Zarf init package to the current working directory. Use `--output-directory` to specify a different location.

```bash
zarf tools download-init
```

--------------------------------

### Example Output for Critical/High Findings

Source: https://docs.zarf.dev/best-practices/vulnerability-scanning

The output of the Critical/High findings per image command.

```text
ghcr.io/go-gitea/gitea              Critical  CVE-2024-56337  tomcat-embed-core  10.1.31
ghcr.io/go-gitea/gitea              High      CVE-2025-24813  tomcat-embed-core  10.1.31
registry1.dso.mil/.../ubi9-minimal  High      CVE-2024-50602  expat              2.5.0-2
```
Tokens:
Raw