mirror of https://github.com/hanzoai/registry.git synced 2026-10-30 18:23:19 +00:00

Files

T

zeekay 92ce9c81bf universe is the one writer of the registry Deployment

Two movers declared this workload and disagreed. Live is universe's: the
Deployment carries apps.hanzo.ai/installation-id=hanzo-cd and managed-by=Helm,
CD Application hanzo-registry is Synced/Healthy, and its env matches
charts/app/values/hanzo/registry.yaml exactly — oci.hanzo.ai, S3 storage,
config from the registry-config ConfigMap.

The k8s/ lane could not have won even if it fired. `kubectl apply -f
k8s/deployment.yaml --dry-run=server` is rejected outright:

    spec.selector: Invalid value: ... field is immutable

and the PVC it mounts, registry-data, does not exist in the cluster. It also
declared filesystem storage and a token service the live registry refuses.
So k8s/, the deploy workflow that applied it, and `make deploy` are gone.

Dockerfile and config.yml go with them: nothing builds that image and no pod
runs it — the live config is the registry-config ConfigMap. Keeping a second
copy of the config meant one live value and one that only looked live.

Fixes make status/logs, which selected app=registry — a label from the deleted
manifest that no running pod carries, so both returned nothing.

2026-08-21 09:22:06 -07:00

1.7 KiB

Raw Permalink Blame History

Hanzo Registry

The fleet OCI registry on hanzo-k8s, authenticated with Hanzo IAM tokens.

Endpoint: oci.hanzo.ai — container images and Helm charts
Image: upstream registry:2 (Docker Distribution)
Auth: token realm https://hanzo.id/v1/iam/registry/token, service oci.hanzo.ai
Storage: hanzoai/s3 at s3.hanzo.svc:9000, bucket registry

Repositories are org-namespaced — oci.hanzo.ai/<org>/<app>, never a bare name.

# Login (uses Hanzo IAM credentials)
docker login oci.hanzo.ai

# Push an image
docker tag myapp:latest oci.hanzo.ai/hanzoai/myapp:v1.0.0
docker push oci.hanzo.ai/hanzoai/myapp:v1.0.0

# Pull an image
docker pull oci.hanzo.ai/hanzoai/myapp:v1.0.0

Deployment

Declared in hanzoai/universe, applied by Hanzo CD — not from this repo. Change the workload in charts/app/values/hanzo/registry.yaml; CD reconciles it.

make status    # read the live workload
make logs
make restart   # roll the pods; CD reconciles the same spec

Setup (first time)

Generate the signing certificate: make generate-cert
Create the k8s secret: make create-secret

Structure

hanzo.yml               # CI: parse every YAML this repo tracks
Makefile                # Read the live workload, write token signing material
LLM.md                  # Deep notes: where each fact lives, auth exchange, traps

Auth flow

Docker client attempts to push/pull from oci.hanzo.ai
Registry returns 401 with the token realm in WWW-Authenticate
Client requests a token from https://hanzo.id/v1/iam/registry/token
IAM validates credentials and returns a signed JWT
Client retries with the JWT in the Authorization header
Registry validates the JWT signature against signing.crt