For the complete documentation index, see llms.txt. Markdown versions of all docs pages are available by appending .md to any docs URL.

Install Solo Enterprise for agentregistry on a Kubernetes cluster.

Before you begin

1. Set up an OIDC provider. This guide assumes you installed Keycloak and have the following environment variables set.

   echo "KEYCLOAK_ISSUER: $KEYCLOAK_ISSUER"
   echo "AR_BACKEND_SECRET: $AR_BACKEND_SECRET"

2. Save your Solo Enterprise for agentregistry license key in an environment variable. To obtain the key, contact an account representative. For more options, such as providing the key in a secret, see Licensing.

   export AGENTREGISTRY_LICENSE_KEY=<license_key>

Step 1: Install

Install Solo Enterprise for agentregistry.

helm upgrade --install agentregistry \
  oci://us-docker.pkg.dev/solo-public/agentregistry-enterprise/helm/agentregistry-enterprise \
  --version 2026.8.0 \
  --namespace agentregistry-system \
  --create-namespace \
  --set licensing.createSecret=true \
  --set licensing.licenseKey=$AGENTREGISTRY_LICENSE_KEY \
  --set oidc.issuer=$KEYCLOAK_ISSUER \
  --set oidc.clientId=ar-backend \
  --set oidc.clientSecret=$AR_BACKEND_SECRET \
  --set oidc.publicClientId=ar-ui \
  --set oidc.roleClaim=Groups \
  --set oidc.superuserRole=admins

Step 2: Verify

Verify that the Solo Enterprise for agentregistry pods are up and running.

kubectl get pods -n agentregistry-system

Example output:

NAME                                                            READY   STATUS    RESTARTS   AGE
agentregistry-clickhouse-shard0-0                               1/1     Running   0          51s
agentregistry-enterprise-postgresql-764898cbff-l8477            1/1     Running   0          51s
agentregistry-enterprise-server-7d56d5b698-zxj8k                1/1     Running   0          51s
agentregistry-enterprise-telemetry-collector-6ff77cbc4f-fgzwk   1/1     Running   0          51s

Step 3: Access the registry

Port-forward the Solo Enterprise for agentregistry server on port 12121. The registry service is not exposed externally by default, so port-forwarding is required to reach it from your local machine. The arctl CLI and the UI both default to http://localhost:12121 as the registry endpoint.

kubectl -n agentregistry-system port-forward svc/agentregistry-enterprise-server 12121:12121

Open the Solo Enterprise for agentregistry UI and log in with the admin-user username and password password. Verify that you see the dashboard.

Step 4: Install the arctl CLI

The arctl CLI is the primary tool for managing AI artifacts in Solo Enterprise for agentregistry. You use it to create, publish, and deploy AI artifacts. Before you can run any arctl commands, you must authenticate the CLI with Keycloak to obtain a valid access token.

1. Download and install the arctl CLI.

   curl -sSL https://storage.googleapis.com/agentregistry-enterprise/install.sh | ARCTL_VERSION=v2026.8.0 sh
   export PATH=$HOME/.arctl/bin:$PATH

2. Log in to the registry. Choose between the interactive device authorization and the static username and password credential flow.

   Use this flow for interactive logins from a terminal. The CLI uses the ar-cli-interactive public client and starts a device authorization grant flow that prints a URL and a one-time code for you to approve in a browser.

   1. Configure the CLI to use the Keycloak issuer and ar-cli-interactive client. Then, log in to Solo Enterprise for agentregistry.

      export OIDC_ISSUER=$KEYCLOAK_ISSUER
      export OIDC_CLIENT_ID=ar-cli-interactive
      arctl user login

      Example output:

      To complete the login process, please:
       1. Open: http://172.18.0.13:8080/realms/agentregistry/device
       2. Enter the code: SYSQ-SNSP
       - or go to: http://172.18.0.13:8080/realms/agentregistry/device?user_code=SYSQ-SNSP
      

   2. Open the URL in a web browser and log into Keycloak with the admin-user username and password password. Confirming the code in the browser tells Keycloak to issue an access token for the CLI session. After authorization is complete, the CLI stores the token in your system keychain so you do not have to log in again until it expires.

   Use this flow for scripted logins where a specific user identity is required in CI/CD pipelines. The CLI uses the ar-cli-password public client and exchanges a username and password directly for an access token.

   1. Log in to Solo Enterprise for agentregistry with the admin-user/password credentials.

      export OIDC_ISSUER=$KEYCLOAK_ISSUER
      arctl user login \
        --oidc-flow=password-credentials \
        --oidc-client-id=ar-cli-password \
        --oidc-username=admin-user \
        --oidc-password=password

   2. Save the access token in the ARCTL_API_TOKEN environment variable.

      export ARCTL_API_TOKEN=$(arctl user info --show-tokens | jq -r .access_token)

3. Verify that you can run arctl commands.

   arctl user whoami

   Example output:

   FIELD       VALUE
   Subject     8d7ffd9c-1f75-459a-b900-bfa4f5e3b492
   Email       admin-user@example.com
   Issuer      http://172.18.0.10:8080/realms/agentregistry
   Superuser   true (overrides role-based permission checks)
   
   ROLE     STATUS
   admins   no explicit permissions configured
   

   Note

   If you see 401 errors in the CLI, you might have previously stored a token in the ARCTL_API_TOKEN environment variable. This environment variable takes precedence over the token that you obtain via the CLI login flow. Try running unset ARCTL_API_TOKEN. Then, repeat the CLI login flow.

Next steps

Connect a runtime so that you can start discovering and deploying AI artifacts.