Container Registry and Software Supply Chain Platform  ·  View 02 of 33  ·  1 · Context and scope

High-Level Architecture

The shape of the platform in one picture, for the reader who will see only one.

Editable source SVG draw.io All views
Source GitLab app + policy repos Build and attest Tekton Pipelines ephemeral runners Tekton Chains SLSA v1 provenance Syft CycloneDX SBOM Artifact plane Harbor Registry OCI 1.1 referrers MinIO 14 TB · EC 8+4 Evidence plane Attestation Store append-only · 7 y Rekor transparency log Component Index ClickHouse Intelligence Scanner Pool Trivy + Grype Advisory Reconciler two feeds Policy plane Policy Bundle Service OPA · signed Exception Registry all expire Enforcement Admission Controller p99 ≤ 150 ms Workload Clusters 400 reviews/s push event match allow / deny Container Supply Chain — High-Level Architecture External / third party Application we own Interface / broker Data store Security / platform event / async synchronous The registry stores evidence; it never stores a verdict. The verdict is computed at admission. v 1.0 · owner Enterprise Architecture · date 2026-09

Decisions

  • Harbor is the registry; MinIO holds the bytes; neither ever holds a verdict
  • Tekton Chains produces provenance in the build, so provenance is not something the platform infers later
  • The admission controller embeds OPA rather than calling a central policy service, so a pod start does not depend on a network hop

Open-source substitutions

  • ECR → Harbor + MinIO · KMS → Vault with PKCS#11 to an HSM · EventBridge → Kafka
  • Lambda → Kubernetes jobs and Go services · DynamoDB → PostgreSQL and ClickHouse
  • Sigstore (Fulcio, Rekor, Cosign) replaces a managed signing service entirely

Targets

  • Admission p50 ≤ 25 ms, p99 ≤ 150 ms, hard timeout 2 s
  • Push to first scan verdict p95 ≤ 10 min; advisory to re-evaluated findings p95 ≤ 60 min
  • Pull path ≥ 99.95% per region; decision point ≥ 99.99% as seen by admission
◀  System Context All views The Four Planes  ▶
Solution Architecture v1.0 · Data & AI Global Practice · 2026-09 · 33 views · open-source, on-premises02-high-level-architecture