Container Registry and Software Supply Chain Platform  ·  View 06 of 33  ·  2 · Structure

Integration and Interface Catalogue

Every way something enters or leaves the platform, with protocol and cadence.

Editable source SVG draw.io All views
Producers and consumers Tekton Builders Argo CD Developer CLI Admission Controllers Ops Console Platform interfaces Harbor API dist v2 + referrers Evidence API gRPC · 5 methods Policy Bundle Server signed OCI bundle Kafka Event Bus 6 topics Dependencies GitLab Keycloak SPIRE Server Vault + HSM OSV Mirror Distro and NVD Mirror Upstream Registries Audit Ledger OCI dist v2 · push digest resolve cosign · oras gRPC · evidence REST · read only revision check OIDC discovery SVID validation PKCS#11 sign 15 min poll hourly proxy pull append only Integration and Interface Catalogue External / third party Application we own Security / platform Interface / broker Queue / topic synchronous batch event / async Every interface is owned by the platform except the upstream registry and advisory feed contracts. v 1.0 · owner Integration Architecture · date 2026-09

Contracts we own

  • OCI distribution v2 plus the referrers API — standard, so any conformant client works
  • Evidence API over gRPC with mTLS, five methods, read scoped by tenant
  • The policy bundle is itself an OCI artifact, so bundle distribution reuses the registry rather than adding a service

Contracts we do not own

  • Upstream registry rate limits and availability — mitigated by the proxy cache
  • OSV and distro feed schemas — normalised on ingest into one advisory record
  • A cached upstream image is treated as a first-party artifact and acquires its own evidence

Deliberately omitted

  • Internal calls between platform services — see the container view
  • The event topic list — see the evidence pipeline
◀  Container and Component Architecture All views OCI Artifact Model  ▶
Solution Architecture v1.0 · Data & AI Global Practice · 2026-09 · 33 views · open-source, on-premises06-integration-architecture