Harbor Registry
:::info Coming soon This section will be written when this component is deployed. :::
Harbor becomes the permanent OCI registry for the enclave after initial bootstrap.
Once Harbor is running and hauler.sh push completes, Harbor replaces the ephemeral
Hauler registry as the system-default-registry for all cluster nodes.
What it provides
- Permanent OCI-compatible registry at
harbor.carbide-enclave.kubernerdes.com(VIP.99) - Helm chart proxy for cluster deployments
- Image vulnerability scanning
- OIDC authentication via Keycloak
- OCI artifact storage for LLM model weights (DGX Spark)
The Hauler → Harbor hand-off
After Harbor is running:
# Push all Hauler store contents → Harbor
bash scripts/hauler.sh push
# Update registries.yaml on each RKE2 node to point at Harbor
# (40_bootstrap-rke2.sh currently points at Hauler :5000)
After push, stop the Hauler ephemeral registry — Harbor is now authoritative.
Prerequisites
- cert-manager + StepIssuer deployed — cert-manager
- TLS cert issued for
harbor.carbide-enclave.kubernerdes.com