Registries
Registries store and distribute the artifacts your deployments run — container images, packages, charts. The platform’s implementation is Harbor.
What it gives you
Section titled “What it gives you”| Capability | Why it matters |
|---|---|
| Whitelisting | Only verified packages are permitted, which is where supply-chain risk is actually controlled |
| Version control | Immutable, addressable versions, so a deploy is reproducible |
| Access control | Per-team and per-project permissions on push and pull |
| Revocation | Withdraw a compromised artifact from circulation |
Why it belongs in the platform
Section titled “Why it belongs in the platform”An artifact registry is the single point every deployment depends on: nothing runs that does not come through it. That makes it both the best place to enforce supply-chain policy and the worst place for an outage.
Whitelisting is the capability that justifies running your own rather than pulling from public registries. A dependency that was fine last month and is compromised today is caught at the registry boundary rather than at every service that pulls it.
Relationship to Code Quality
Section titled “Relationship to Code Quality”Code Quality scans your source and its dependencies for known vulnerabilities before you build. The registry controls what is allowed to be pulled at deploy time. They cover the same risk from opposite ends — one at authoring time, one at runtime — and neither replaces the other.
Continue with
Section titled “Continue with”- Harbor — deploying and operating the registry: publishing artifacts, licences and revocation