Container Registry and Software Supply Chain Platform  ·  View 23 of 33  ·  5 · Operations

Deployment and Infrastructure

What runs where, on hardware the team owns, and which failure domains that creates.

Editable source SVG draw.io All views
DC-1 — platform control plane (Kubernetes, 3 control + 12 worker) Registry pool harbor-core 6 pods harbor-registry 8 pods harbor-jobservice 4 pods Evidence pool attestation-api 6 pods indexer 8 pods Fulcio 3 pods Rekor 3 pods Stateful pool PostgreSQL Patroni · 3 ClickHouse 6 shards × 2 Kafka Strimzi · 5 DC-1 — storage and backup tier Object storage MinIO 12 nodes · EC 8+4 NVMe Write Cache Backup Offline Backup object lock Restore Drill quarterly Workload clusters — the enforcement plane is an add-on, not a service call Production admission-webhook 3 pods · fail-closed evidence-sync 2 pods Staging admission-webhook 2 pods · fail-closed Development admission-webhook 2 pods Fail-open posture stated choice DC-2 — read region Cache and replicas Proxy Cache 4 pods MinIO Replica Evidence Replica HSM Appliance PKCS#11 · not exportable HAProxy + MetalLB Prometheus + Grafana S3 API CA key operation evidence topic async replication RPO ≤ 15 min Deployment and Infrastructure — On-Premises Interface / broker Application we own Security / platform Data store Queue / topic Risk / gap synchronous event / async batch No component is a managed cloud service. Every failure domain shown is one the platform team operates. v 1.0 · owner Platform Engineering · date 2026-09

Decisions

  • Two data centres: DC-1 is the write region and holds the evidence primary; DC-2 caches blobs and replicates evidence
  • The enforcement plane is a cluster add-on, deployed into every workload cluster, not a service those clusters call
  • The HSM is a physical appliance reachable only from the key zone

Availability

  • Registry pull ≥ 99.95% monthly per region; push ≥ 99.9%
  • Decision point ≥ 99.99% as seen by admission, achieved by the local cache rather than by the central service
  • Development clusters run fail-open; that is a stated posture recorded in the bundle, and it is drawn as a risk because it is one

Assumptions

  • Sized for one platform Kubernetes cluster of 3 control-plane and 12 worker nodes per data centre
  • MinIO at EC 8+4 gives 14 TB usable with four-node fault tolerance
  • Backup is to offline object-locked storage; the quarterly restore drill is what makes the RTO real
◀  Exceptions and Suppressions All views Delivery of the Platform Itself  ▶
Solution Architecture v1.0 · Data & AI Global Practice · 2026-09 · 33 views · open-source, on-premises23-deployment-architecture