the artifact management market is up for grabs

. In a hot market, you’re going to see some interesting and not-entirely-logical attacks. And if I could creatively paraphrase 

, it’s hard to get someone to understand something when their company’s success depends on them not understanding it.

I’m thinking about a curious criticism that one of our competitors, JFrog, leveled at us in a 

. They said they spotted some “red flags” about Cloudsmith, the first and most damning being that we are “

packaging [a] competitor’s open source as an enterprise solution,

[s]elling a paid ‘security’ solution that’s little more than a thin UI layer over someone else’s open-source tool.

 and the underlying Trivy DB as one source of software package vulnerability data.)

They stick to this point pretty persistently, saying we are “

charging you for an open-source solution,” 

rely on open source software as [our] SCA solution,

“if Trivy becomes unsupported or compromised, Cloudsmith’s entire SCA capability could suffer, leaving users vulnerable.

JFrog has it wrong on several counts here.

For starters, pretty much every enterprise tool in the last few decades, including 

, is built on foundations of open-source software (OSS). Does this mean we’re all “charging” customers for “packaging” OSS as an “enterprise solution” in some nefarious way? Like most OSS, Trivy DB is “generic by nature,” which leaves room for developers and software vendors to build custom capabilities on top of it. Which is exactly what Cloudsmith has done. If Cloudsmith is wrong for using “generic” OSS, then we’re all wrong.

In accusing Cloudsmith of using a “competitor’s” OSS, they’re referring to Aqua Security. They’re confused on several key points.

First, they’re failing to acknowledge the distinction between the role of a primary OSS maintainer and a commercial vendor. Aqua Security, the company, is the primary maintainer of the Trivy OSS project. It is also the vendor behind Aqua Enterprise, a commercial product that is built around Trivy.

Second, they’ve tellingly assumed that Cloudsmith considers Aqua Security to be a competitor. We very much don’t. We regard Aqua as a complementary solution; we support integration between Cloudsmith and Aqua Security; and we see Cloudsmith as the data plane & control plane for software supply chain security, so customers can process metadata and execute policies based on vulnerabilities identified by Cloudsmith’s scanning process, or sourced from third-party vulnerability data from the likes of Aqua Enterprise or others, or a combination.

 software can “become unsupported.” But that actually tends to be a much bigger risk with commercial software than with OSS. Trivy is published under an Apache 2.0 license. Even if the maintainers stop publishing future versions as open source, the community could fork an older version. We don’t think this will happen, but if it does, Cloudsmith relies on multiple data sources, and we can easily change our mix from time to time. There are numerous other providers of data similar to Trivy’s.

So why is JFrog attacking Cloudsmith so stridently for relying on OSS, like virtually every commercial software company does, and specifically for relying on Trivy? I can only speculate, but JFrog sees its own security product, Xray, as an important revenue source, and they seem to regard Aqua Security, along with other similar companies, as competitors to Xray.

To state the obvious point: of course we embrace open source. 

 about Cloudsmith’s support for OSS projects, and we Cloudsmithers all believe deeply in the power of software reuse via OSS. I’m old enough to remember when reuse was essentially an unsolved problem in software; we never could have envisioned back in the 1990s how OSS would fundamentally change that. The core functionality of our platform helps enterprises everywhere to efficiently and securely manage the thousands of OSS artifacts and dependencies that make up such a large part of any company’s software supply chain.

And to state another obvious point: we’re not just serving up generic OSS and then somehow convincing customers to pay us for it. It’s what Cloudsmith has built on top of OSS that we’re really charging for. Things like our unmatched global cloud-scale infrastructure, our 24x7 service levels, our policy-as-code enterprise policy manager (EPM) that evaluates every package using your company’s risk criteria, our ability to proxy and cache public upstream registries at unmatched performance levels, our artifact synchronization process that performs scanning and metadata enrichment before a package even hits your repository and gets served to CI/CD pipelines or developer IDEs, our stellar customer support, and much more.

Yes, we rely on OSS, and we think that’s a significant strength from which customers benefit.


Glenn Weinstein

Of Course We Embrace Open Source!

Exploring AI and the future of the software supply chain

AI assistants will shape the future of the software supply chain, and today, we’re sharing a glimpse of a powerful idea in motion: 

 server that connects large language models (LLMs) like ChatGPT and Claude directly to your software supply chain using the emerging 

Imagine managing policies, surfacing security insights, or orchestrating package workflows with a simple natural language prompt. No dashboards, no scripting, just a simple question or instruction that delivers the right end result. If this sounds interesting, you should 

This isn’t a launched product (yet), but it’s a clear signal of where we think Cloudsmith is headed: toward 

 that make it easier to control your software supply chain.

is a standard way to make information available to LLMs. Similar to an API, MCP provides a documented, standardized way for a client to integrate services from external sources.

MCP enables AI assistants to query and interact with software supply chain data, so it creates a foundation for smarter workflows and more accessible control over artifact management.

In essence, adding MCP capabilities to Cloudsmith offers up an entirely new interface to your software supply chain, with AI agents and LLMs working together to achieve your goals. We're exited to see MCP becoming a flexible new point of integration between our customers' third-party services and Cloudsmith.

MCP server demo

Our MCP prototype leverages Cloudsmith’s API-first architecture to provide programmatic access to developers through their AI assistant. Through standardized MCP requests, you can ask questions about your software supply chain or take safe, controlled actions - like managing policies or promoting packages - directly within Cloudsmith. This opens up conversational workflows with the Cloudsmith platform.

For example, you might ask your AI assistant to identify what package is trending up in usage month over month or see all of the versions of a particular package in use across your workspace. In the future, your AI assistant will be able to review your organization’s compliance and security requirements and recommend or create a set of policies in Cloudsmith’s Enterprise Policy Manager based on that input.

Building this prototype was a good reminder of a few fundamentals. First, an API-first foundation makes it easier to experiment, so it’s good that Cloudsmith is built truly API-first. Second, the data running through platforms like Cloudsmith can offer valuable insights when it’s made accessible to clients in lots of different ways. We’re giving developers and AI assistants simpler ways to ask questions, take actions, and get things done.

There’s still plenty to figure out, but MCP is already making artifact management and software supply chain management more intuitive and straightforward, especially at enterprise scale.

 for select customers and partners. If you're exploring the intersection of DevOps, AI, and supply chain security, we’d love to work with you. 

Alison Sickelka

VP of Product

Prototyping an MCP Server

OpenID Connect (OIDC) provides ephemeral tokens, reducing the risk of long-lived credentials being exposed. For many organizations, artifact management tokens are among the most widely used credentials, making them a significant target for security breaches.

Shifting to OIDC is an excellent way to strengthen security posture, offering substantial benefits with minimal implementation effort. While direct 

Dependabot integration with OIDC in GitHub Actions isn’t available

, API-based token rotation offers a reliable workaround.

This guide will walk you through configuring GitHub Dependabot to authenticate with Cloudsmith using OIDC. It includes steps for setting up a Cloudsmith service account, configuring OIDC in Cloudsmith, setting up GitHub permissions, and creating a GitHub Actions workflow to dynamically update the Dependabot API key.

Step 1: Create a Service Account in Cloudsmith

 that the service account should be associated with for broader permissions.

Step 2: Configure OIDC Authentication for GitHub Actions in Cloudsmith

: Enter a descriptive name (e.g., GitHub Actions).

: Enter https://token.actions.githubusercontent.com.

 as the required claim for GitHub OIDC tokens to restrict access to your specific GitHub organization.

, select the service account created in Step 1 (Dependabot Service Account).

OIDC setup with GitHub Actions in Cloudsmith

Step 3: Set Up Access Controls in Cloudsmith

 for the repository where you want Dependabot to manage dependencies.

Step 4: Add a Fine-Grained Personal Access Token (PAT) in GitHub for Dependabot

 to the specific repository where you want to use Dependabot.

Add a new secret with the name FINE_GRAINED_PAT and paste the PAT as the value.

Step 5: Create DEP_CLOUDSMITH_API_KEY Secret for Dependabot

, enter a placeholder value (e.g., INITIAL_VALUE or a temporary token from Cloudsmith).

This sets up DEP_CLOUDSMITH_API_KEY as a Dependabot-compatible secret so that the GitHub Action can later overwrite it with an ephemeral OIDC token each time it runs.

The initial value doesn’t need to be valid long-term, as it will be regularly replaced by the OIDC-generated token.

After this initial setup, the GitHub Actions workflow you configured will take over, updating DEP_CLOUDSMITH_API_KEY with each run.

Step 6: Configure the dependabot.yml File

In your GitHub repository, create or update .github/dependabot.yml. The example below uses a Maven repository configuration, but this works with other package ecosystems, including npm, pip, and more (see the Dependabot configuration guide for details).:

Replace YOUR-ORG and YOUR-REPO with your actual Cloudsmith organization and repository details. This configuration will enable Dependabot to connect to Cloudsmith for dependency updates.

Step 7: Set Up a GitHub Action Workflow to Overwrite the Dependabot API Key with an Ephemeral OIDC Token

This workflow will authenticate with Cloudsmith via OIDC, generate a short-lived token, and overwrite the DEP_CLOUDSMITH_API_KEY used by Dependabot. Given that Cloudsmith’s OIDC tokens expire every 2 hours, this example schedules token rotation every 11 hours to align with Dependabot’s run schedule. If your setup requires more frequent rotations or encounters token expiration issues, adjust the schedule accordingly.

In your repository, create a file at .github/workflows/update-cloudsmith-key.yml.

Replace YOUR-ORG with your Cloudsmith organization slug.

Replace YOUR-SERVICE-SLUG with the slug of the Cloudsmith service account created earlier.

This workflow uses OIDC to obtain a JWT from Cloudsmith, overwriting the DEP_CLOUDSMITH_API_KEY Dependabot secret with an ephemeral, short-lived token.

 in your GitHub repository and manually run the workflow.

Ensure Dependabot is fetching updates from Cloudsmith and creating pull requests as expected.

This setup allows Dependabot to use a short-lived Cloudsmith OIDC token, enhancing security by overwriting the DEP_CLOUDSMITH_API_KEY secret with each token request.

Next: Learn how to leverage Cloudsmith with Dependabot to streamline your dependency management 

Ciara Carey

Solutions Engineer

Integrating Dependabot with Cloudsmith Using OIDC

 is a modern CI/CD platform designed for Kubernetes and microservices applications. It provides developers with fast, powerful pipelines and deep integration with Kubernetes. The platform’s features, such as enhanced caching, parallelization, and flexible triggers, allow teams to optimize their continuous integration workflows.

 to offer a comprehensive GitOps platform for Kubernetes. GitOps helps teams automate their infrastructure and application management, using Git as the single source of truth for deployments. By leveraging Argo within Codefresh, developers can employ advanced deployment strategies such as canary releases and blue-green deployments, improving release quality and reducing risks.

Benefits of Using Codefresh and Cloudsmith Together

, a cloud-native artifact management platform, with 

 enhances your CI/CD workflows in several significant ways. This powerful combination automates artifact handling, simplifies deployments, and enables the adoption of GitOps practices for Kubernetes deployments.

By automating artifact publishing within Codefresh pipelines, developers can significantly reduce manual steps, minimizing errors and ensuring artifacts are securely available for deployment. Cloudsmith’s support for multiformat repositories ensures that microservices using different package formats—such as Docker, npm, Helm, and Maven—can be managed and retrieved consistently.

Integrating Cloudsmith with Codefresh streamlines deployment processes by allowing developers to pull artifacts directly into their Codefresh pipelines. Whether deploying Docker images or Helm charts, this integration ensures consistency across all environments, from development to production, reducing deployment discrepancies.

, developers can ensure that only approved and secure components are used in their pipelines. Features like quarantine and upstream proxying add further control over unapproved or vulnerable dependencies. This guarantees a secure, compliant software supply chain.

Adopting GitOps for Kubernetes Deployments

Combining Cloudsmith and Codefresh enables teams to fully adopt GitOps practices for Kubernetes deployments. GitOps ensures that deployments are automated and aligned with the desired state defined in Git repositories. With Argo built into Codefresh, continuous reconciliation of your Kubernetes clusters keeps your infrastructure consistent with what’s declared in your codebase.

By integrating these platforms, you automate artifact handling, simplify deployments, and enhance security—all while adopting GitOps practices for Kubernetes deployments. This empowers your team to focus on delivering value—writing code, innovating features, and improving products—while the integration handles the complexities of artifact management and deployment.

How to Set Up a Pipeline with Codefresh and Cloudsmith

Setting up a CI/CD pipeline that integrates Codefresh and Cloudsmith is straightforward. Below is a guide to configure your pipeline for seamless artifact management and deployment using either 

 and create repositories for your artifacts.

: Ensure you have access to a Kubernetes cluster connected to Codefresh for deployments.

Open your Codefresh pipeline and go to the 

Name the variable (e.g., CLOUDSMITH_API_KEY), input your API key, and toggle 

Reference the API key in your pipeline YAML using ${{CLOUDSMITH_API_KEY}}.

 in Cloudsmith (required for OIDC to work with Cloudsmith).

Claims: For example add your Codefresh account ID to restrict access. For more information on claims consult the 

Assign the service account you created earlier.

In Codefresh, set up OIDC authentication by configuring your pipeline to request OIDC tokens during execution.

Add steps in your pipeline YAML to obtain and use the OIDC token for authenticating with Cloudsmith.

Modify your pipeline YAML to include steps that push build artifacts to Cloudsmith after successful builds.

To publish Helm charts, you need to use the Cloudsmith CLI. Ensure that the CLI is installed in your pipeline environment. For more details, refer to the Cloudsmith Helm documentation.

Deploying Artifacts from Cloudsmith Using Codefresh

Codefresh offers several ways to deploy your Docker images and Helm charts to your Kubernetes cluster using artifacts stored in Cloudsmith:

Using the Codefresh GUI to Deploy on Demand

: Choose Docker images from your connected Cloudsmith Docker registry.

: Select Helm charts from your added Cloudsmith Helm repository.

: Use Docker images stored in Cloudsmith within your pipeline steps.

: Utilize the Helm step in your pipeline to deploy charts from your Cloudsmith Helm repository.

Kubernetes Templating (cf-deploy-kubernetes)

: Employ templated deployments for consistent configurations.

: Execute custom kubectl commands within your pipeline, referencing artifacts from Cloudsmith.

: Directly deploy Helm charts to your Kubernetes clusters.

: For advanced GitOps deployments, integrate 

 with Codefresh. This allows automated deployment of applications to Kubernetes clusters using Cloudsmith as your artifact source.

Example of Pulling a Docker Image Using OIDC

Below is an example pipeline demonstrating how to authenticate with Cloudsmith using OIDC and deploy a Docker image:

: Retrieves an OIDC token required for authentication.

: Uses the OIDC token to obtain a Cloudsmith-specific token.

: Logs into the Cloudsmith Docker registry using the obtained OIDC token and pulls the desired Docker image.

: Verifies the successful pull by checking the Docker image's history.

: Ensure that the Cloudsmith CLI is installed in your pipeline environment if you plan to publish Helm charts or perform other CLI-based operations. Refer to the Cloudsmith Helm documentation for more details.

: Prefer OIDC over API keys for enhanced security and simplified credential management.

 when deploying artifacts from Cloudsmith. This ensures that deployment pipelines only have the necessary access to pull artifacts without the risk of modifying or deleting them, thus improving the security of your deployment process.

: Store sensitive information like API keys or OIDC tokens securely using Codefresh's encrypted variables or secret management features.

: Leverage Codefresh pipelines and GitOps practices to automate deployment steps, reducing manual intervention and potential errors.

: Utilize Codefresh's dashboards and integrations to monitor deployment status and health, ensuring quick identification and resolution of issues.

: Maintain your deployment manifests in Git repositories for version control, traceability, and easier collaboration.

Integrating Cloudsmith with Codefresh optimizes your CI/CD pipelines by providing secure, automated artifact management and simplifying deployments. With Cloudsmith’s support for multiple package formats and Codefresh’s robust CI/CD capabilities tailored for Kubernetes and microservices, this integration is ideal for modern, distributed applications.

GitOps Pipelines with Codefresh and Cloudsmith

User management is the backbone of secure and efficient software operations. As businesses grow and evolve, the tools they use must keep pace. Enter OKTA and Cloudsmith. OKTA, a titan in identity and access management, combined with Cloudsmith, the powerhouse of software artifact management, offers a solution that's both robust and user-friendly. This guide looks at how these platforms can be integrated to elevate your user management game.

User management is about controlling access to a system or application. It's a delicate balance: ensuring security while facilitating collaboration. Effective user management optimizes resource use, prevents unauthorized access, and tailors user experiences based on roles and needs.

The road to effective user management is often dotted with hurdles. These can range from setting up appropriate permissions, managing inactive users, to staying compliant with industry regulations.

Since its inception in 2009, OKTA has carved a niche for itself in the identity and access management sector. Its cloud-based platform, equipped with tools for user authentication, caters to businesses of all sizes, ensuring secure and seamless user experiences.

Okta offers a suite of features such as Provisioning, Single Sign-On (SSO), integration with Active Directory (AD) and LDAP, centralized user deprovisioning, multifactor authentication (MFA), and mobile identity management. These are complemented by adaptable policies tailored for organizational security. These capabilities are seamlessly integrated through the Okta Integration Network (OIN), a collection of pre-integrated applications. The OIN ensures that users can enjoy SSO login across all essential apps they interact with daily.

OKTA's strengths lie in its single sign-on capabilities, multi-factor authentication, and comprehensive lifecycle management. For those looking to streamline user management, OKTA's intuitive interface and extensive API integrations make it an indispensable tool.

Cloudsmith stands out as a leading software artifact management platform. It offers teams a centralized hub to store, manage, and distribute software artifacts, ensuring that software components are consistently available and secure.

Users can upload data, software, and dependencies into Cloudsmith or pull it from third-party sources. We then control distribution to their developers, servers, or external customers. Our primary mission is to contain 100% of the software and related data for users within Cloudsmith, keeping everyone safe.

But of course, we understand that different users have different needs. While some may be uploading artifacts, others might be in roles that require only viewing or downloading capabilities. Effective user management in Cloudsmith ensures that each user has the right permissions, enhancing security and operational efficiency.

Pairing OKTA with Cloudsmith is like merging the best of both worlds. Cloudsmith's prowess in artifact management is complemented by OKTA's user management capabilities. This integration not only simplifies access but also amplifies security measures, ensuring that the right people access the right artifacts at the right time.

Setting up the OKTA integration is quite straightforward, and to help you through the process we have put together a 

 in our Help Center. The integration includes SCIM provisioning, making it easier to manage users in your organization with minimal impact to your workflows.

Cloudsmith’s OKTA integration not only allows for user management, but also group management. This allows your organization to define clear user roles and groups based on job responsibilities and access levels.

Automated Provisioning and Deprovisioning

One of the standout features of Cloudsmith's OKTA integration is the ability to automate user provisioning and deprovisioning. This automation is crucial for organizations that prioritize security and efficiency.

When a new team member joins, the onboarding process often involves granting access to multiple tools and platforms. With automated provisioning, as soon as a user is added to OKTA, they're automatically granted access to Cloudsmith, eliminating manual steps and potential oversights. Conversely, when an employee leaves or changes roles, their access can be automatically adjusted or revoked, ensuring that only current team members have access to your critical systems.

Cloudsmith's OKTA integration can be seamlessly connected with HR systems. This means that any changes in the HR system, such as a new hire or a departure, can trigger the appropriate provisioning or deprovisioning actions in Cloudsmith. This integration further streamlines the user lifecycle management, reducing administrative overhead and potential errors.

It is not uncommon for user data to be scattered across multiple systems, and we all know how difficult that can be to manage! This fragmentation can lead to inconsistencies, security vulnerabilities, and administrative headaches. Cloudsmith's OKTA integration addresses this challenge head-on by ensuring that OKTA serves as the single, central source of truth for user information.

When OKTA is the authoritative source, any changes made there—like updating an email address or changing a department—will automatically sync to Cloudsmith. This ensures that user data remains consistent across platforms. By centralizing user information, organizations can reduce the risk of data discrepancies, improve auditability, and simplify user management.

Learn more about getting started with creating and managing teams in in Cloudsmith in the short video below:

Teams and Access Controls

As organizations increasingly rely on platforms like Cloudsmith for their operations, ensuring the protection of user data and maintaining a secure user management system becomes paramount. Let's delve into the security considerations you should be aware of when managing users with Cloudsmith and OKTA.

User data is a valuable asset, and its protection is non-negotiable. Cloudsmith is committed to safeguarding this data, implementing stringent security measures that align with industry best practices. When integrated with OKTA, the data protection capabilities are further enhanced. OKTA employs robust encryption methods, both in transit and at rest, ensuring that user data remains confidential and tamper-proof. Regular security audits, penetration testing, and compliance certifications further attest to the platform's commitment to data protection.

Role of OKTA in Enhancing Cloudsmith's Security

OKTA doesn't just streamline user management—it amplifies security. By integrating with Cloudsmith, OKTA brings its advanced security features, such as multifactor authentication (MFA), to the table. MFA requires users to provide multiple forms of identification before gaining access, significantly reducing the risk of unauthorized access. Additionally, OKTA's adaptive authentication measures assess various risk factors, like location and device, adjusting authentication requirements based on the perceived risk level. This dynamic approach ensures that security doesn't come at the expense of user experience.

Tips for Maintaining a Secure User Management System

: Periodically audit user roles and permissions. Ensure that employees only have access to the resources necessary for their roles.

: Ensure that all systems are regularly updated. Security patches and updates address vulnerabilities and enhance overall system security.

: A secure system is only as strong as its weakest link. Regularly train your team on security best practices, emphasizing the importance of strong, unique passwords and recognizing phishing attempts.

 Set up monitoring to detect any unusual activities. Immediate alerts for suspicious actions can help in quickly identifying and mitigating potential security threats.

: While not strictly a security measure, regular backups ensure that you can quickly recover user data in the event of any unforeseen circumstances, be it a technical glitch or a cyberattack.

The integration of OKTA with Cloudsmith is a testament to the evolution of user management in the digital age. By combining the strengths of two industry leaders, organizations can ensure a seamless, secure, and efficient user management experience. As the digital landscape continues to evolve, so do the challenges associated with user management. However, with tools like OKTA and Cloudsmith, businesses are well-equipped to navigate these challenges, ensuring that their operations remain secure, streamlined, and scalable. Whether you're just starting out or looking to enhance your existing setup, the OKTA-Cloudsmith integration offers a robust solution that caters to the diverse needs of modern organizations.

Lee Skillen

Chief Technology Officer

Managing Users and User Groups: A Guide to OKTA and Cloudsmith Integration

The team at Cloudsmith is excited to build upon our past support and integration with Hashicorp Terraform to include managing teams, update repository settings, and manage services (API Keys) via the Terraform Provider Module. And we are an official Partner, check out the fancy handshake badge!

While Cloudsmith and Terraform are nothing new to each other, the capabilities continue to grow based on community and customer feedback.

For a few years now, Cloudsmith has included Terraform 

 capabilities to help manage both public and private modules or packages. Cloudsmith delivers on the promise of being truly universal and offering a variety of packaging formats in a consistent and secure way. Review the 

 has long been the industry standard for infrastructure and application provisioning via code.

Why not manage Cloudsmith with Terraform?

, users can quickly and easily provision Cloudsmith resources and realize the benefits of Infrastructure-As-Code for creating and managing repositories and access control.

Overview of the Cloudsmith Terraform Provider

 allows Cloudsmith users to automate the provisioning of resources using Terraform. New capabilities are highlighted below.

Users can:

Create and manage repositories, including 

Create and manage entitlement tokens, granting read-only access to end users

Create and manage services (API keys for machine-to-machine or programmatic access) for a Cloudsmith organization

Create and manage teams within a Cloudsmith organization

Create and manage webhooks for a given Cloudsmith repository

The trend to manage every aspect of the infrastructure lifecycle is expanding with each and every revision. Databases and database schemes are even being managed with Terraform and infrastructure as code. DevOps and Platform teams are attempting to realize the goal of a platform-as-a-service, and the Cloudsmith team wants to help everyone reach that potential.

provider "cloudsmith" {
api_key = "my-api-key"
}

data "cloudsmith_namespace" "my_namespace" {
slug = "my-namespace"
}

resource "cloudsmith_repository" "my_repository" {
description = "A certifiably-awesome private package repository"
name = "My Repository"
namespace = "${data.cloudsmith_namespace.my_namespace.slug_perm}"
slug = "my-repository"
}

resource "cloudsmith_entitlement" "my_entitlement" {
name = "Test Entitlement"
namespace = "${cloudsmith_repository.test.namespace}"
repository = "${cloudsmith_repository.test.slug_perm}"
}

Terraform plus Cloudsmith is a powerful combination. It allows you to automate the creation of your package repositories and associated access tokens in a controlled, reproducible way. Also, as you have now defined these resources as code, you can version them and treat them as you would any other source code that you have.

The Terraform Module Registry is the home for the validated Terraform provider; find out about the latest enhancements in the 

. If you like to test things out on your own, sign up for a 

 to realize the value and benefits of Terraform and Cloudsmith together!

Terraform Provider Enhancements

Cloudsmith is happy to announce an integration with Datadog to help our customers monitor their Cloudsmith account.

 is an observability service for cloud-scale apps, providing monitoring of servers, databases, tools, and services through a SaaS based data analytics platform. At Cloudsmith we are big fans of Datadog and use it to monitor and visualize how our system is performing across a range of services and tools.

The Datadog Cloudsmith Integration, allows users to monitor their storage, bandwidth, and token usage in Datadog. This 

 is crucial in monitoring your consumption and mitigating against getting an unexpected overage bill- the Datadog Cloudsmith integration is another way for you and your team to monitor this.

The following metrics will be tracked by the Datadog Cloudsmith integration:

- follow these steps to install and configure your Cloudsmith integration.

First things first you need to install the Datadog Agent.

The Datadog Agent is software that runs on your hosts. It collects events and metrics from hosts and sends them to Datadog, where you can analyze your monitoring and performance data. To install the datadog agent, follow the steps 

Cloudsmith Datadog Integration Installation

Cloudsmith Blog

Of Course We Embrace Open Source!

Prototyping an MCP Server

Integrating Dependabot with Cloudsmith Using OIDC

GitOps Pipelines with Codefresh and Cloudsmith

Managing Users and User Groups: A Guide to OKTA and Cloudsmith Integration

Terraform Provider Enhancements

Datadog Cloudsmith Integration

Using CircleCI to Push Packages to Cloudsmith

Continuous...Everything? Integration, Packaging, Delivery, and Security All in One!

Integrating a Cloudsmith Repository and a Buildkite pipeline

Integrating a Cloudsmith repository with a Semaphore CI workflow

Using Semaphore CI to Push packages to Cloudsmith