jwright/exploded-cluster
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

supply chain: tiered mirrors (central cloud mirror -> site mirrors) in prose, ledger card and blueprint

Browse Source
This commit is contained in:
Jonathon Wright
2026-08-17 15:50:30 +10:00
parent d0efbe0194
commit a201af9d29
3 changed files with 36 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files
assets/dist/delivery-flow.svg
Vendored
+22 -17
View File
@@ -1,4 +1,4 @@
<svg xmlns="http://www.w3.org/2000/svg" width="1180" height="660" viewBox="0 0 1180 660" role="img" aria-label="End-to-end delivery flow in four lanes converging on one running workload. Change lane: a commit lands in the GitHub repository, ArgoCD renders and diffs it against the live cluster and syncs the difference - the cluster pulls, nothing pushes. Shape lane: the Helm chart plus a per-cluster values context passes the schema gate, which refuses to render if a required value is missing, and produces the manifests ArgoCD applies. Artefact lane: CI builds once, pushes the image to Azure Container Registry, the zot pull-through mirror caches it, and the node pulls by digest so the mirror catches the traffic. Secret lane: Azure Key Vault holds the values, the External Secrets operator syncs them into the cluster, and git only ever holds the reference. The workload that runs is the sum of all four: synced state, rendered shape, digest-pinned image, injected secret.">
<svg xmlns="http://www.w3.org/2000/svg" width="1180" height="660" viewBox="0 0 1180 660" role="img" aria-label="End-to-end delivery flow in four lanes converging on one running workload. Change lane: a commit lands in the GitHub repository, ArgoCD renders and diffs it against the live cluster and syncs the difference - the cluster pulls, nothing pushes. Shape lane: the Helm chart plus a per-cluster values context passes the schema gate, which refuses to render if a required value is missing, and produces the manifests ArgoCD applies. Artefact lane: CI builds once and pushes to Azure Container Registry; a central pull-through mirror in the cloud fronts upstream, per-site mirrors pull from the centre, and each node pulls by digest - the load fans out in tiers so no thundering herd ever reaches upstream. Secret lane: Azure Key Vault holds the values, the External Secrets operator syncs them into the cluster, and git only ever holds the reference. The workload that runs is the sum of all four: synced state, rendered shape, digest-pinned image, injected secret.">
<defs>
<marker id="arr" viewBox="0 0 10 10" refX="9" refY="5" markerWidth="7" markerHeight="7" orient="auto-start-reverse">
<path d="M 0 0 L 10 5 L 0 10 z" fill="#64748b"></path>
@@ -67,26 +67,31 @@
<!-- ARTEFACT lane -->
<text x="60" y="392" font-family="ui-monospace, 'SF Mono', Menlo, monospace" font-size="11" letter-spacing="2" fill="#c026d3">ARTEFACT</text>
<g font-family="ui-monospace, 'SF Mono', Menlo, monospace" font-size="12" fill="#0e1726">
<rect x="60" y="406" width="150" height="48" rx="10" fill="none" stroke="#64748b" stroke-width="1.5"></rect>
<text x="135" y="428" text-anchor="middle">CI builds</text>
<text x="135" y="445" text-anchor="middle" font-size="10" fill="#64748b">once, only once</text>
<rect x="270" y="406" width="180" height="48" rx="10" fill="#c026d3" fill-opacity="0.04" stroke="#c026d3" stroke-width="1.5"></rect>
<text x="360" y="428" text-anchor="middle">ACR upstream</text>
<text x="360" y="445" text-anchor="middle" font-size="10" fill="#64748b">tag@sha256 minted</text>
<rect x="510" y="406" width="180" height="48" rx="10" fill="#c026d3" fill-opacity="0.04" stroke="#c026d3" stroke-width="1.5"></rect>
<text x="600" y="428" text-anchor="middle">zot mirror</text>
<text x="600" y="445" text-anchor="middle" font-size="10" fill="#64748b">the fleet pulls once</text>
<rect x="750" y="406" width="150" height="48" rx="10" fill="none" stroke="#64748b" stroke-width="1.5"></rect>
<text x="825" y="428" text-anchor="middle">node pulls</text>
<text x="825" y="445" text-anchor="middle" font-size="10" fill="#64748b">by digest</text>
<rect x="60" y="406" width="130" height="48" rx="10" fill="none" stroke="#64748b" stroke-width="1.5"></rect>
<text x="125" y="428" text-anchor="middle">CI builds</text>
<text x="125" y="445" text-anchor="middle" font-size="10" fill="#64748b">once, only once</text>
<rect x="228" y="406" width="150" height="48" rx="10" fill="#c026d3" fill-opacity="0.04" stroke="#c026d3" stroke-width="1.5"></rect>
<text x="303" y="428" text-anchor="middle">ACR upstream</text>
<text x="303" y="445" text-anchor="middle" font-size="10" fill="#64748b">tag@sha256 minted</text>
<rect x="416" y="406" width="160" height="48" rx="10" fill="#c026d3" fill-opacity="0.06" stroke="#c026d3" stroke-width="2"></rect>
<text x="496" y="428" text-anchor="middle">central mirror</text>
<text x="496" y="445" text-anchor="middle" font-size="10" fill="#64748b">one cloud cache, fronts upstream</text>
<rect x="614" y="406" width="150" height="48" rx="10" fill="#c026d3" fill-opacity="0.04" stroke="#c026d3" stroke-width="1.5"></rect>
<text x="689" y="428" text-anchor="middle">site mirror</text>
<text x="689" y="445" text-anchor="middle" font-size="10" fill="#64748b">zot at the edge</text>
<rect x="802" y="406" width="118" height="48" rx="10" fill="none" stroke="#64748b" stroke-width="1.5"></rect>
<text x="861" y="428" text-anchor="middle">node pulls</text>
<text x="861" y="445" text-anchor="middle" font-size="10" fill="#64748b">by digest</text>
</g>
<g stroke="#64748b" stroke-width="1.5" marker-end="url(#arr)">
<line x1="210" y1="430" x2="264" y2="430"></line>
<line x1="450" y1="430" x2="504" y2="430"></line>
<line x1="690" y1="430" x2="744" y2="430"></line>
<line x1="900" y1="430" x2="944" y2="430"></line>
<line x1="190" y1="430" x2="222" y2="430"></line>
<line x1="378" y1="430" x2="410" y2="430"></line>
<line x1="576" y1="430" x2="608" y2="430"></line>
<line x1="764" y1="430" x2="796" y2="430"></line>
<line x1="920" y1="430" x2="944" y2="430"></line>
</g>
<text x="60" y="480" font-family="ui-sans-serif, system-ui, -apple-system, Segoe UI, Roboto, sans-serif" font-size="11" fill="#64748b">promotion is a copy of the same digest - if the digest changed, it is a new candidate, not a promotion</text>
<text x="60" y="498" font-family="ui-sans-serif, system-ui, -apple-system, Segoe UI, Roboto, sans-serif" font-size="11" fill="#64748b">the tiers layer the load: upstream sees one consumer, each site sees one hop, nodes never leave the LAN</text>
<!-- SECRET lane -->
<text x="60" y="522" font-family="ui-monospace, 'SF Mono', Menlo, monospace" font-size="11" letter-spacing="2" fill="#8a6414">SECRET</text>
Side by Side Swipe Overlay

Before

Width:  |  Height:  |  Size: 9.4 KiB

After

Width:  |  Height:  |  Size: 10 KiB