Beyond ImagePullBackOff: A Stateless, Secret-less Distributed Registry for Edge
summary
Harbor Satellite presents a stateless, secret-less registry that pushes image material to edge nodes via a central Ground Control which emits OCI state and config artifacts; satellites use hardware-backed attestation (SPIRE/“spiffy” with TPM-style identity) to fetch only policy-authorized images, removing per-node imagePullSecrets. It uses a lightweight in-node registry (zregistry by default), supports air-gapped operation and GitOps-style policy, and in a live demo a Raspberry Pi satellite successfully attests, mirrors and runs an nginx image.
AI-written summary · about
chapters (12)
- 0:00Introduction
- 2:12Speaker and project
- 3:17Edge registry problems
- 8:10Harbor Satellite solves them
- 10:21Harbor Satellite architecture
- 12:27Live demo setup
- 15:00Registering the satellite
- 17:13Deploying app and replication
- 18:40Q&A on registries
- 19:22Open source and Harbor
- 20:03Production readiness
- 21:04Roadmap and community
related talks
29mPull Once, Scale Everywhere: Fixing Image Pull Bottlenecks With Dragonfly
07mProject Lightning Talk: Harbor Project Update: Gitless GitOps, Satellite at the E...
31mBlind Trust is Broken: Securing Your Cluster Against Untrusted Containers
37mCache Me If You Can: P2P Image Sharing in Kubernetes with Spegel
28mRegistries After Dark
48mImproving Container Image Registry Availability with Kube Image Keeper
34mApplication Configuration Management at the Edge: Taming Thousands of Deployment Targets
30mHarbor Maintainers Talk - Role of Harbor in AI, IOT Edge and the Future