Container Registry and Software Supply Chain Platform

Architecture Views

33 views, in reading order. Every view ships three ways: an HTML page, an SVG that re-opens in diagrams.net fully editable, and draw.io source.

One trusted path from a source commit to a running workload, and machine-checkable evidence that the path was followed. Read the set in order: acts 1 and 2 fix the boundary and the four planes; act 3 says which store is authoritative and which is rebuildable; act 4 shows what happens when an image is built, scanned, admitted and re-evaluated; act 5 covers running it; act 6 covers why it is safe and how it degrades. One decision governs all of them — the registry stores evidence, never a verdict.

1 · Context and scope

The boundary, the producers and consumers, and the plane separation that governs everything after it.
01 Producers Build Pipelines Tekton Base Image Factory Upstream Registries Docker Hub · Quay People Developer Security Engineer Exception Approver Platform SRE Consumers Kubernetes Clusters prod · stage · dev Edge and Air-Gapped Argo CD Container Supply Chain Platform commit to admitted pod Sources of truth we do not own GitLab OSV Mirror Distro and NVD Feeds Keycloak and SPIRE reads deny reason authors policy grants, with expiry operates push + attest hardened bases proxy cache admission review offline verify deploys digests source revision advisories advisories workload identity Container Supply Chain — System Context External / third party Person or role synchronous event / async Build systems, cluster runtimes and the applications themselves are integrated with, not replaced. v 1.0 · owner Enterprise Architecture · date 2026-09 System Context Who produces artifacts, who consumes them, and what the platform deliberately does not own. HTML page SVG draw.io
02 Source GitLab app + policy repos Build and attest Tekton Pipelines ephemeral runners Tekton Chains SLSA v1 provenance Syft CycloneDX SBOM Artifact plane Harbor Registry OCI 1.1 referrers MinIO 14 TB · EC 8+4 Evidence plane Attestation Store append-only · 7 y Rekor transparency log Component Index ClickHouse Intelligence Scanner Pool Trivy + Grype Advisory Reconciler two feeds Policy plane Policy Bundle Service OPA · signed Exception Registry all expire Enforcement Admission Controller p99 ≤ 150 ms Workload Clusters 400 reviews/s push event match allow / deny Container Supply Chain — High-Level Architecture External / third party Application we own Interface / broker Data store Security / platform event / async synchronous The registry stores evidence; it never stores a verdict. The verdict is computed at admission. v 1.0 · owner Enterprise Architecture · date 2026-09 High-Level Architecture The shape of the platform in one picture, for the reader who will see only one. HTML page SVG draw.io
03 Artifact plane — bytes, never verdicts Registry services Harbor Core auth · quota · GC Distribution OCI dist v2 Proxy Cache per region Artifact storage MinIO Blob Store content addressed Metadata Store PostgreSQL · regional Evidence plane — the system of record Authoritative Attestation Store append-only DSSE Rekor Log inclusion proofs Fulcio CA 10 min certs Derived and rebuildable Component Index rebuild ≤ 4 h Findings Store history kept 3 y Policy plane — versioned, reviewed data Authoring and build Policy Repository Rego in Git Bundle Builder opa build · signed Registers and rehearsal Exception Registry Suppression Registry Dry-Run Engine last 24 h traffic Enforcement plane — one per cluster In-cluster Admission Controller OPA embedded Local Bundle Cache max stale 30 min Local Evidence Cache BoltDB Build Pipelines Tekton Workload Clusters kubelet pulls blobs push by digest artifact event evidence feed bundle poll allow / deny blob pull The Four Planes and the Load-Bearing Seam Interface / broker Data store Security / platform External / third party Application we own synchronous event / async batch The registry may be unavailable without the platform losing its ability to decide. v 1.0 · owner Enterprise Architecture · date 2026-09 The Four Planes Why the boundary between the artifact plane and the evidence plane is the load-bearing seam of the whole system. HTML page SVG draw.io

2 · Structure

The layering rule, the deployable units, every interface, the OCI artifact model, and how policy becomes reviewed data.
04 Consumption kubelet + containerd Argo CD Developer CLI Ops Console Enforcement Admission Controller Evidence Sync Local Caches Policy OPA Evaluator Bundle Builder Exception Registry Dry-Run Engine Intelligence Scanner Pool Advisory Reconciler Re-Evaluator Impact Analyser Evidence Attestation Service Verifier Component Indexer Findings Service Artifact Harbor Core Distribution Proxy Cache Lifecycle and GC Data MinIO PostgreSQL ClickHouse Kafka Redis Platform Keycloak SPIRE Vault + HSM Fulcio + Rekor Audit Ledger AdmissionReview in-process cached input subscribe signed result referrers insert blobs trust roots Container Supply Chain — Layered Architecture External / third party Application we own Security / platform Interface / broker Data store Queue / topic synchronous event / async Dependencies point downward only. Evidence reaches the enforcement plane by subscription, not by an upward call. v 1.0 · owner Enterprise Architecture · date 2026-09 Layered Architecture What depends on what, and why no layer calls upward. HTML page SVG draw.io
05 Artifact plane Harbor harbor-core Go · 6 replicas harbor-registry distribution · 8 harbor-jobservice GC · replication · 4 harbor-proxy-cache 1 per region Artifact state MinIO 12 nodes · EC 8+4 PostgreSQL Patroni · 3 nodes Redis sentinel · 3 Evidence plane Evidence services attestation-api Go · gRPC · 6 verifier Go · 4 indexer Go · 8 workers findings-api Go · 4 Sigstore Fulcio private CA · 3 Rekor Trillian · 3 TUF Repository root of trust Evidence state ClickHouse 6 shards × 2 Kafka Strimzi · 5 brokers Policy plane Policy services bundle-builder opa build · CI job policy-api Go · 4 exception-api Go · 2 dryrun-runner batch job Enforcement plane — replicated into every workload cluster Cluster add-on admission-webhook Go + OPA · 3 evidence-sync Kafka consumer · 2 local cache BoltDB on PVC Tekton build identity Keycloak human OIDC SPIRE workload SVID Vault + HSM PKCS#11 push + referrers artifact events DSSE bytes component rows evidence topic local read CA key Container and Component Architecture Interface / broker Application we own Data store Security / platform Queue / topic External / third party synchronous event / async Replica counts are sized for 400 admission reviews/s per cluster and 2,500 builds on a release day. v 1.0 · owner Platform Engineering · date 2026-09 Container and Component Architecture Every deployable unit, its technology, and how many of it there are. HTML page SVG draw.io
06 Producers and consumers Tekton Builders Argo CD Developer CLI Admission Controllers Ops Console Platform interfaces Harbor API dist v2 + referrers Evidence API gRPC · 5 methods Policy Bundle Server signed OCI bundle Kafka Event Bus 6 topics Dependencies GitLab Keycloak SPIRE Server Vault + HSM OSV Mirror Distro and NVD Mirror Upstream Registries Audit Ledger OCI dist v2 · push digest resolve cosign · oras gRPC · evidence REST · read only revision check OIDC discovery SVID validation PKCS#11 sign 15 min poll hourly proxy pull append only Integration and Interface Catalogue External / third party Application we own Security / platform Interface / broker Queue / topic synchronous batch event / async Every interface is owned by the platform except the upstream registry and advisory feed contracts. v 1.0 · owner Integration Architecture · date 2026-09 Integration and Interface Catalogue Every way something enters or leaves the platform, with protocol and cadence. HTML page SVG draw.io
07 Repository apps/checkout · release class, tags immutable Tags — pointers, never identity 2026.09.1 immutable latest mutable · dev only Tag History actor + timestamp Digest — the identity sha256:9f3c… image index Manifest amd64 Config Blob Layer Blobs × 7 shared across images Evidence attached to the digest by the referrers relationship Origin SLSA Provenance in-toto predicate Base Image Lineage layer composition Contents CycloneDX SBOM 1,800 components Scan Result OpenVEX Verification and lifecycle Cosign Signature DSSE envelope Inclusion Proof Rekor SET Promotion Attestation stage → prod Referrers API GET /v2/…/referrers GC Reference Guard running set + retained pointer only resolved digests subject digest subject digest lists evidence never collect OCI Artifact Model — Digest, Tags and Referrers Interface / broker Data store Application we own Security / platform synchronous failure / alternate A provenance document whose subject digest is absent from the registry is rejected on receipt. v 1.0 · owner Platform Engineering · date 2026-09 OCI Artifact Model How a tag, a digest and its evidence relate, and why only one of the three is an identity. HTML page SVG draw.io
08 Receive Attestation API DSSE envelope Artifact Event Consumer Harbor webhook Verify on receipt Subject in registry? Signer identity workload, not human Source allowlisted? Persist — authoritative Attestation Store MinIO object lock Append-Only Ledger PostgreSQL · hash chain Rekor Entry inclusion proof Derive — rebuildable Component Indexer purl rows Findings Projector Verdict Input Builder per digest Serve Evidence API p99 ≤ 40 ms Referrers Passthrough Replicate Evidence Topic ordered per subject Regional Replicas async · ordered Edge Caches one per cluster reject: no subject publish Evidence Plane — Receive, Verify, Persist, Derive Interface / broker Decision point Data store Security / platform Application we own Queue / topic failure / alternate event / async A correction is a new record that supersedes; no record is ever updated in place. v 1.0 · owner Platform Engineering · date 2026-09 Evidence Plane Pipeline What happens to a piece of evidence between arriving and being usable at an enforcement point. HTML page SVG draw.io
09 Author Rego in Git Review 2 approvers Build and Test opa build · conftest Dry Run last 24 h traffic Sign and Publish OCI bundle Distribute p95 ≤ 5 min Enforce and Observe decision logs Policy Bundle versioned · signed merge request approved bundle candidate impact report signed artifact at every cluster telemetry back Policy Bundle Lifecycle — Policy as Reviewed Data Application we own Decision point Security / platform Interface / broker A bundle that would have denied more than 2% of the last 24 h requires an explicit override. v 1.0 · owner Security Architecture · date 2026-09 Policy Bundle Lifecycle How a rule change reaches every enforcement point without becoming an outage. HTML page SVG draw.io

3 · Data

Which store is the system of record, what is derived, what the model looks like, and how it moves across regions.
10 Authoritative — the system of record, never derived from anything else Evidence Attestation Store object lock · 7 y Append-Only Ledger hash chained · 7 y Rekor Log inclusion proofs · 7 y Artifact bytes Layer Blobs MinIO EC 8+4 · 14 TB Manifests content addressed Audit Audit Ledger immudb · 7 y Regional and strongly consistent — one write region per repository Registry metadata Repositories and Manifests PostgreSQL Tag History append rows only Promotion State projection of evidence Derived — may be destroyed and rebuilt Indexes Component Index rebuild ≤ 4 h Findings Store history 3 y Caches Verdict Input Cache BoltDB per cluster Trust Root Cache TUF · 30 d offline Layer Scan Cache Redis · by layer digest Backup Target offline object lock rebuild source RPO ≤ 1 min RPO ≤ 5 min RPO ≤ 15 min Data Architecture — Authoritative, Regional, Derived Data store Security / platform batch event / async Loss of the metadata store or the component index is a rebuild, not a data loss. v 1.0 · owner Data Architecture · date 2026-09 Data Architecture and Storage Zones Which store is the system of record, which are derived, and what backup actually has to cover. HTML page SVG draw.io
11 repository repository_id PK project FK -> tenant class release|dev quota_bytes immutable_tags artifact digest PK sha256 repository_id FK media_type size_bytes first_pushed_at attestation attestation_id PK subject_digest FK predicate_type generator superseded_by signature signature_id PK attestation_id FK signer_identity issuer cert_not_after tag_history tag_event_id PK repository_id FK tag digest FK actor occurred_at sbom_component component_id PK subject_digest FK purl version licence layer_digest promotion promotion_id PK attestation_id FK from_env to_env approver bundle_version inclusion_proof proof_id PK signature_id FK log_index tree_size signed_entry_ts finding finding_id PK subject_digest FK component_id FK advisory_id FK severity state first_observed_at advisory advisory_id PK CVE|GHSA feed_agreement severity_osv severity_distro amended_at policy_bundle bundle_version PK environment rego_digest signed_by effective_from suppression suppression_id PK finding_id FK justification approver expires_at NOT NULL exception exception_id PK scope owner justification expires_at NOT NULL admission_decision decision_id PK subject_digest bundle_version FK verdict reason_codes evidence_digests 1 : N 1 : N N : 1 1 : N 1 : 1 1 : 1 subtype 1 : N 1 : N 1 : N 0 : N 1 : N 1 : N Evidence Data Model expires_at is NOT NULL on both suppression and exception. A grant without an expiry cannot be written. v 1.0 · owner Data Architecture · date 2026-09 Evidence Data Model The entities a decision reads, and the two columns that cannot be null. HTML page SVG draw.io
12 Produce Source Commit GitLab revision Base Image hardened, attested Built Image 900–2,500 / day Land Blob Store write once Manifest and Tag strongly consistent Attest Provenance at build time SBOM ~90 MB / day Scan Result p95 ≤ 10 min Signature before promotion Index Component Rows 1,800 per SBOM Finding Set per digest Verdict Inputs compact per digest Decide Evidence Feed ordered per subject Edge Cache ≤ 30 min stale Admission Decision computed, not stored Retain Audit Records 7 years Finding History 3 years, never deleted Lifecycle Expiry dev untagged 30 d on push and on advisory every decision Supply Chain Data Flow and Cadence External / third party Application we own Data store Security / platform Queue / topic event / async Findings are recomputed when advisories move, not only when an image is pushed. v 1.0 · owner Data Architecture · date 2026-09 Supply Chain Data Flow Where each kind of data comes from, what it becomes, and how long it is kept. HTML page SVG draw.io
13 Cataloguer Index key Partition Determination Advisory source OS packages Syft OS cataloguer pkg:deb · rpm · apk by ecosystem present only Distro feed + OSV Go modules Syft go-module pkg:golang ecosystem + prefix reachable call graph OSV Go npm Syft javascript pkg:npm ecosystem + scope reachable import graph OSV + GHSA Java Syft java-archive pkg:maven ecosystem + groupId present only phase 3 OSV + GHSA Python Syft python pkg:pypi ecosystem + prefix reachable import graph OSV PyPI Base layers Layer cataloguer layer digest by layer digest inherited fan out to derived same as OS row Component Index — Partitioning and Determination Application we own Data store Decision point External / third party Every row is rebuildable by replaying SBOM attestations. Full rebuild budget: 4 hours. v 1.0 · owner Data Architecture · date 2026-09 Component Index How 'which images contain package X at version Y' stays a bounded query as the corpus grows. HTML page SVG draw.io
14 DC-1 — write region for this repository set Artifact plane Harbor Origin push accepted here MinIO Primary 14 TB Evidence plane Attestation Store primary Evidence Topic ordered per subject Rekor Metadata PostgreSQL Primary regional writes DC-2 — read region Artifact plane Proxy Cache absorbs pull storms MinIO Replica async · RPO 15 min Evidence plane Evidence Replica ordered per subject Unreplicated Evidence deny, retryable Metadata PostgreSQL Replica read only Edge and air-gapped sites Offline island Local Registry zot · seeded Evidence Bundle signed · transported Offline Trust Root TUF · 30 d validity Clusters in DC-1 Clusters in DC-2 Edge Clusters async blobs ordered replication streaming regional read signed transfer Multi-Region Topology — Replicate, Cache, Isolate Interface / broker Data store Queue / topic Security / platform Risk / gap External / third party batch event / async synchronous Admission in a region reads evidence from that region. Adding a region changes no trust relationship. v 1.0 · owner Enterprise Architecture · date 2026-09 Multi-Region Topology What replicates, what caches, and what an artifact does when its evidence has not arrived yet. HTML page SVG draw.io

4 · Runtime

Build and attest, scan, admit, reconcile advisories, re-evaluate, verify offline, promote, and grant an exception that expires.
15 GitLab Tekton Pipeline SPIRE Fulcio Harbor Rekor Attestation Service 1. push event · rev abc123f 2. node + workload attest 3. JWT-SVID · 5 min 4. build from pinned base 5. push image 6. sha256:9f3c… 7. syft → CycloneDX SBOM 8. SVID → signing cert 9. cert · 10 min validity 10. log DSSE entries 11. inclusion proof 12. push referrers 13. artifact event 14. verify subject and signer 15. reject: human credential Build to Attested Push — Critical Flow Provenance signed by a developer's personal credential is refused at receipt, not at admission. v 1.0 · owner Platform Engineering · date 2026-09 Build to Attested Push How an image acquires provenance, an SBOM, a signature and an inclusion proof before anyone can deploy it. HTML page SVG draw.io
16 Trigger Push Event on every artifact Advisory Change feed driven Scheduled Recheck weekly floor Deduplicate Layer Digest Cache Redis New layers only? Prioritise Production Queue served first Staging Queue Development Queue shed first Queue age over SLO alert, never allow Scan Trivy Pool OS + language Grype Pool second opinion Normalise purl and Advisory Ids Severity Reconcile two sources Attest Sign Result cosign · OpenVEX Push Referrer subject digest Index Findings Store Component Index cached layer verdict reused Scan Pipeline — Deduplicated and Prioritised Queue / topic Application we own Data store Decision point Risk / gap Security / platform Interface / broker batch An unchanged base layer is scanned once, not once per derived image. Push to verdict p95 ≤ 10 min. v 1.0 · owner Platform Engineering · date 2026-09 Scan Pipeline How a scan stays inside ten minutes at 2,500 builds a day without scanning the same base layer 2,500 times. HTML page SVG draw.io
17 kube-apiserver Admission Controller Local Bundle Cache Local Evidence Cache Regional Evidence API Audit Ledger 1. AdmissionReview · Pod 2. extract image references 3. bundle for env=prod 4. v247 · age 42 s 5. inputs for sha256:9f3c… 6. hit · 3 s old 7. miss → fetch, 2 s cap 8. attestations + findings 9. verify signatures offline 10. evaluate rego · 12 rules 11. ALLOW / DENY + reasons 12. decision + evidence digests 13. timeout → env posture Admission Decision — Critical Flow p50 ≤ 25 ms, p99 ≤ 150 ms. The common case never leaves the cluster. v 1.0 · owner Security Architecture · date 2026-09 Admission Decision The one flow that must be fast, correct and available, and what it does when it cannot be all three. HTML page SVG draw.io
18 Fetch Normalise Reconcile Decide Publish Feed A · OSV OSV Mirror 15 min poll purl + version range Advisory record A Feed B · distro + NVD Distro and NVD Mirror hourly CPE → purl map Advisory record B Reconciler Merge by identifier CVE · GHSA Feeds agree? Advisory Store one record per id Disagreement Severity conflict not acted on Flagged for review Staleness Feed age metric Age over 6 h? Policy input + alert Advisory Ingest and Two-Feed Reconciliation External / third party Application we own Data store Decision point Risk / gap Security / platform One failing feed does not stall evaluation. A severity in one feed and absent from the other is flagged, never applied. v 1.0 · owner Security Architecture · date 2026-09 Advisory Ingest and Reconciliation Two feeds, one advisory record, and what happens when the two disagree. HTML page SVG draw.io
19 Advisory change New or Amended reconciled record Withdrawn marked, never deleted Match Component Index Lookup purl + range Affected Digests ~120 of 40,000 Fan out Re-Evaluation Jobs one per digest Running workloads first Re-evaluate Finding Set Rebuild Suppression Check expiry aware Reachability where supported Evidence update New Finding Record supersedes, appends Signed Scan Result new referrer Impact Running Workload Map cluster + workload Verdict Change Event Act Owner Notification Alert Above Severity Eviction or Drain phase 3, not automatic affected workloads Re-Evaluation When the Advisory Moves, Not the Image Queue / topic Application we own Data store Decision point Security / platform Risk / gap event / async Cost scales with affected artifacts, not stored artifacts. Advisory to re-evaluated finding set p95 ≤ 60 min. v 1.0 · owner Security Architecture · date 2026-09 Advisory-Driven Re-Evaluation What happens when the world's knowledge changes and the image does not. HTML page SVG draw.io
20 Edge kube-apiserver Edge Admission Controller Local Registry Offline Evidence Bundle Offline Trust Store 1. AdmissionReview · Pod 2. resolve locally 3. sha256:9f3c… 4. attestations for digest 5. DSSE + Rekor SET 6. trust roots 7. Fulcio root + log key 8. verify chain offline 9. verify inclusion proof 10. check revocation list age 11. DENY: roots over 30 d 12. ALLOW · offline path Air-Gapped Verification — Deciding Without the Platform No call leaves the site. Verification needs the artifact, its evidence, the inclusion proof and the trust roots. v 1.0 · owner Security Architecture · date 2026-09 Air-Gapped Verification An enforcement point with the artifact, its evidence and the trust roots decides without calling the platform. HTML page SVG draw.io
21 Build output Development Repository untagged 30 d Development gate Signature valid SBOM present Staging gate Scan complete No unsuppressed critical Builder on allowlist Production gate All staging gates Base image allowlisted Finding age within limit Record Promotion Attestation signed · names both Bundle Version Recorded Production Production Repository 2 y after last deploy Immutable Tags Reverse Quarantine next admission denies Demotion signed, like promotion marks ineligible Promotion, Demotion and Retention Interface / broker Decision point Security / platform Data store Risk / gap Application we own failure / alternate Promotion is an assertion about an existing digest. Nothing is rebuilt and nothing is re-tagged. v 1.0 · owner Platform Engineering · date 2026-09 Promotion, Demotion and Retention How an artifact moves between environments without being rebuilt, re-tagged or trusted twice. HTML page SVG draw.io
22 Raise scoped request Justify reason + digest Approve approver ≠ requester Encode as Data into the bundle Evaluate same OPA engine Expire mandatory date Re-Raise Finding automatic Exceptions all expire scoped request evidence attached two-person rule bundle data decision logged clock runs out back to the queue Exceptions and Suppressions — Policy, Never Bypass Person or role Application we own Decision point Security / platform A suppression without an expiry is refused at write time. Exception ratio above threshold is an alert. v 1.0 · owner Security Architecture · date 2026-09 Exceptions and Suppressions How the platform says yes to something it would otherwise refuse, without creating a permanent hole. HTML page SVG draw.io

5 · Operations

Where it runs, how it ships itself, how a pull storm is absorbed, what is watched, and the operator's loop.
23 DC-1 — platform control plane (Kubernetes, 3 control + 12 worker) Registry pool harbor-core 6 pods harbor-registry 8 pods harbor-jobservice 4 pods Evidence pool attestation-api 6 pods indexer 8 pods Fulcio 3 pods Rekor 3 pods Stateful pool PostgreSQL Patroni · 3 ClickHouse 6 shards × 2 Kafka Strimzi · 5 DC-1 — storage and backup tier Object storage MinIO 12 nodes · EC 8+4 NVMe Write Cache Backup Offline Backup object lock Restore Drill quarterly Workload clusters — the enforcement plane is an add-on, not a service call Production admission-webhook 3 pods · fail-closed evidence-sync 2 pods Staging admission-webhook 2 pods · fail-closed Development admission-webhook 2 pods Fail-open posture stated choice DC-2 — read region Cache and replicas Proxy Cache 4 pods MinIO Replica Evidence Replica HSM Appliance PKCS#11 · not exportable HAProxy + MetalLB Prometheus + Grafana S3 API CA key operation evidence topic async replication RPO ≤ 15 min Deployment and Infrastructure — On-Premises Interface / broker Application we own Security / platform Data store Queue / topic Risk / gap synchronous event / async batch No component is a managed cloud service. Every failure domain shown is one the platform team operates. v 1.0 · owner Platform Engineering · date 2026-09 Deployment and Infrastructure What runs where, on hardware the team owns, and which failure domains that creates. HTML page SVG draw.io
24 Source Platform Monorepo GitLab Policy Repository Rego + tests Helm Charts Build Tekton self-hosted Unit and Integration Self-attest SBOM + Provenance Cosign Signature same path as tenants Gate Dry-Run Policy last 24 h traffic Bundle Diff Review 2 approvers Deliver Argo CD · development Argo CD · staging Argo CD · production digest pinned Verify Admits its own image SLO Watch 48 h rollback on deny Delivery of the Platform Itself External / third party Application we own Security / platform Decision point failure / alternate The platform is its own first customer: its images pass the same admission control as everything else. v 1.0 · owner Platform Engineering · date 2026-09 Delivery of the Platform Itself How a change to the platform reaches production, through the platform's own gates. HTML page SVG draw.io
25 Node local — first line, survives a registry outage Per node containerd Image Cache already-pulled digests Digest-Pinned Pod Spec no tag resolution Cluster local Per cluster Registry Mirror Config hosts.toml Pre-Pull DaemonSet warms before scale-out Regional — the storm absorber Per region Harbor Proxy Cache 250k pulls/h burst NVMe Cache Tier Hit Ratio ≥ 97% measured, alerted Origin — write region Origin Harbor Origin pull ≥ 99.95% MinIO Primary Cold Digest on Scale-Out expected to fail Cross-Region Egress named cost line miss miss miss only no warm copy Pull Path — Absorbing a Regional Scale-Out Data store Application we own Interface / broker Security / platform Risk / gap synchronous failure / alternate The origin sees the misses, not the storm. A cached upstream image is a first-party artifact and acquires its own evidence. v 1.0 · owner SRE · date 2026-09 Pull Path and Storm Absorption What happens when a regional cluster scales out and 250,000 pulls an hour arrive for the same digest. HTML page SVG draw.io
26 Emit Collect Store Consume Act Admission Verdict + reason OTel Collector Prometheus Deny reason board Page on deny spike Registry Pull and push latency OTel Collector Prometheus Pull path SLO Page on error budget Evidence Attest and replicate lag OTel Collector Prometheus Freshness board Alert on lag Scanning Queue depth and age OTel Collector Prometheus Backlog board Alert, never allow Advisory feeds Ingestion lag OTel Collector Prometheus Feed health Policy denies on age Signing and keys Cert issue + key use Fluent Bit Loki + immudb Key usage review Alert on break-glass Posture and cost Violations, bytes, scans Exporter ClickHouse Team cost report Alert over share Observability and Operations Application we own Interface / broker Data store Security / platform Count of running workloads in violation of current policy is a first-class metric, not a report. v 1.0 · owner SRE · date 2026-09 Observability and Operations Which signals exist, where they go, and which of them wake somebody up. HTML page SVG draw.io
27 Measure workloads in violation Triage blocked or running? Remediate rebuild on patched base Re-Attest new evidence, new digest Adjust Policy dry-run first Report exceptions and cost Posture violations vs budget breach signal ranked work patched base image admissible again rule change monthly review The Operator Loop Security / platform Application we own Decision point Base-image owners are notified when a newer patched base exists; the fan-out is a single fact, not one ticket per image. v 1.0 · owner SRE · date 2026-09 The Operator Loop The weekly cycle that turns a violation count into a fixed image, and closes. HTML page SVG draw.io

6 · Assurance

Trust zones, credential issue, key custody, revocation, tenant isolation, and every named failure mode.
28 Untrusted — developer endpoints and upstream registries Developer Workstation Upstream Registry approved list only Compromised Builder valid signature Build zone — ephemeral, no standing credentials Tekton Runner no long-lived secret SPIRE Agent node attestation Platform zone — restricted, mTLS only Harbor robot tokens ≤ 60 min Evidence API read scoped by tenant Policy Bundle Server Key zone — isolated, no inbound from the build zone Fulcio private CA Rekor Vault per-operation audit HSM not exportable Workload zone — one enforcement point per cluster Admission Controller kubelet pull-only identity merge request only proxy cache pull revoked identity push · repo scoped SVID → cert · mTLS CA key operation PKCS#11 mTLS · read only pull only Security Architecture — Trust Zones Person or role External / third party Risk / gap Application we own Security / platform Interface / broker synchronous failure / alternate A valid signature from a revoked builder is an expected event, handled by revocation rather than deletion. v 1.0 · owner Security Architecture · date 2026-09 Security Trust Zones Where the boundaries are, what crosses them, and where an attacker actually arrives. HTML page SVG draw.io
29 Build Pod SPIRE Agent SPIRE Server Keycloak Harbor Fulcio 1. workload API 2. node attestation 3. entry match 4. SVID · 5 min 5. token exchange 6. validate issuer + claims 7. claims accepted 8. robot token · 60 min 9. SVID → signing cert 10. SAN = SPIFFE ID 11. push apps/checkout 12. 403 outside scope Workload Identity and Credential Issue No push credential exceeds 60 minutes, and no runtime identity is ever issued one. Shared credentials do not exist. v 1.0 · owner Security Architecture · date 2026-09 Workload Identity and Credentials How a build proves what it is, and how short-lived every credential it receives actually is. HTML page SVG draw.io
30 Offline root — ceremony, air-gapped, two-person TUF root root.json 5-of-9 threshold Root Key Shares HSM smartcards Superseded Roots verifiable 7 y Online signing — the keyless path CA and logs Fulcio Intermediate Vault PKI · 90 d Rekor Signing Key CT Log Key Long-lived — air-gap and release path HSM held Air-Gap Release Key never exported Policy Bundle Key Base Image Key Distribution and rotation To every verifier TUF Metadata timestamp 1 d In-Cluster Trust Bundle ≤ 30 d offline Rotation Runbook no re-signing needed HSM Appliance PKCS#11 · logged per op Root Ceremony Quorum grant ≠ use delegates signs targets polled PKCS#11 resident still verifiable Key Management and Trust Roots Security / platform Data store Application we own Person or role synchronous event / async Rotation never invalidates signatures made under the previous root. No single identity may both grant signing authority and use it. v 1.0 · owner Security Architecture · date 2026-09 Key Management and Trust Roots Which keys exist, who holds them, and what rotation does to signatures already made. HTML page SVG draw.io
31 Detect Compromise Report Log Monitor Rekor anomaly Revoke SPIRE Entry Removed Fulcio Identity Banned Robot Account Disabled Publish Revocation List signed · versioned Bundle Rebuild signer allowlist Distribute Control Topic push Bundle Poll ≤ 5 min Refresh Enforcement Points p95 ≤ 5 min Cache Invalidated p100 ≤ 15 min Effect Next Admission Denies nothing deleted Running Pods Continue eviction is separate Account Affected Artifact List by signer identity Rebuild Plan under a new identity drain when replaced Revocation — Invalidate Without Deleting Person or role Application we own Security / platform Data store Queue / topic Interface / broker Decision point Risk / gap failure / alternate The blast radius of a compromised builder is bounded by revocation, not by deletion. v 1.0 · owner Security Architecture · date 2026-09 Revocation Propagation How a compromised builder stops being trusted, in minutes, without deleting anything. HTML page SVG draw.io
32 Layer 1 — namespace and quota Harbor projects Project per Tenant Quota: count and bytes Retention per Class Layer 2 — identity One identity per principal Robot per Repository push ≤ 60 min SPIFFE ID per Builder Pull Identity per Namespace pull only Layer 3 — data Scoped server side Tenant Filter in Evidence API Index Partition per Tenant Findings Scoped to Project Layer 4 — discovery Enumeration control Catalog API Filtered Referrers Scoped Digest Enumeration Blocked disclosure risk Cross-Tenant Layer Dedup existence oracle Dedup Scoped by Tenant Class storage cost accepted defeats layer 4 mitigates Tenant Isolation — Four Layers and One Leak Interface / broker Application we own Security / platform Data store Risk / gap failure / alternate synchronous Content-addressed storage deduplicates across tenants by design; where that leaks existence, dedup is scoped and the extra bytes are paid. v 1.0 · owner Security Architecture · date 2026-09 Tenant Isolation Four layers that stop one tenant learning about another, and the one place content addressing leaks. HTML page SVG draw.io
33 Failure Detected by Degraded behaviour Residual risk Artifact read path Registry pull down Pull SLO burn rate Node and regional cache serve Cold digest scale-out fails Artifact write path Registry push down Push error rate Builds queue and back off Release-day backlog Decision point Policy service unreachable Bundle age metric Cached bundle ≤ 30 min Beyond that, env posture Transparency and keys Rekor or Vault down Signing error rate Proofs queue, verify continues Unproofed: non-prod only Intelligence Scanner backlog, feed stale Queue age and feed lag Production scanned first No scan, no production Evidence integrity Missing attestation, bit-rot Digest re-verified on read Quarantine and alert Absent evidence is a denial Time and replication Clock skew, replication lag Bounded tolerance check Distinct retryable reason Denied, never allowed Policy change Bundle misconfiguration Dry run over last 24 h Override needed over 2% Override is still human Failure Modes and Degraded Operation Risk / gap Security / platform Application we own Decision point Every degraded behaviour is a stated policy choice. None of them is a silent allow. v 1.0 · owner SRE and Security · date 2026-09 Failure Modes and Degraded Operation Every named failure class, how it is detected, what the platform does, and what risk is left over. HTML page SVG draw.io
Open svg/<view>.svg or drawio/<view>.drawio in draw.io Desktop or at app.diagrams.net to edit. The SVG carries the diagram inside it, so it is both the picture and the source. This folder is self-contained — copy it whole and every link still resolves.
Solution Architecture v1.0 · Data & AI Global Practice · 2026-09 · 33 views · open-source, on-premises33 views · HTML / SVG / draw.io