Image Registry
The store from which container images are pulled, and an under-appreciated availability and security dependency of every deployment and every autoscale event.
Easy to forget until it fails, at which point nothing can start. A registry outage does not affect running containers, but it prevents deployments, prevents autoscaling from adding capacity, and prevents any node from replacing a failed pod — which turns a routine instance failure into a capacity loss.
Design consequences worth adopting:
Do not depend on a public registry in the production path. Rate limits on public registries have caused real outages during scale-out events. Mirror or cache upstream images into a registry you control.
Treat it as tier-zero infrastructure: highly available, replicated across regions if your workloads are, and included in disaster recovery planning. Nodes should also retain a local image cache so a pull failure is not immediately fatal.
Scan on push and enforce on deploy. The registry is the natural choke point for vulnerability scanning and for signature verification — an admission policy that refuses unsigned or unscanned images is far more reliable than a pipeline step somebody can skip.
Set a lifecycle policy. Image storage grows without bound otherwise, and old images are both cost and risk. Retain by tag pattern and age, and keep whatever your rollback window requires.