jwright/exploded-cluster
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

supply chain: tiered mirrors (central cloud mirror -> site mirrors) in prose, ledger card and blueprint

Browse Source
This commit is contained in:
Jonathon Wright
2026-08-17 15:50:30 +10:00
parent d0efbe0194
commit a201af9d29
3 changed files with 36 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files
assets/dist/delivery-flow.svg
Vendored
+22 -17
View File
@@ -1,4 +1,4 @@
<svg xmlns="http://www.w3.org/2000/svg" width="1180" height="660" viewBox="0 0 1180 660" role="img" aria-label="End-to-end delivery flow in four lanes converging on one running workload. Change lane: a commit lands in the GitHub repository, ArgoCD renders and diffs it against the live cluster and syncs the difference - the cluster pulls, nothing pushes. Shape lane: the Helm chart plus a per-cluster values context passes the schema gate, which refuses to render if a required value is missing, and produces the manifests ArgoCD applies. Artefact lane: CI builds once, pushes the image to Azure Container Registry, the zot pull-through mirror caches it, and the node pulls by digest so the mirror catches the traffic. Secret lane: Azure Key Vault holds the values, the External Secrets operator syncs them into the cluster, and git only ever holds the reference. The workload that runs is the sum of all four: synced state, rendered shape, digest-pinned image, injected secret.">
<svg xmlns="http://www.w3.org/2000/svg" width="1180" height="660" viewBox="0 0 1180 660" role="img" aria-label="End-to-end delivery flow in four lanes converging on one running workload. Change lane: a commit lands in the GitHub repository, ArgoCD renders and diffs it against the live cluster and syncs the difference - the cluster pulls, nothing pushes. Shape lane: the Helm chart plus a per-cluster values context passes the schema gate, which refuses to render if a required value is missing, and produces the manifests ArgoCD applies. Artefact lane: CI builds once and pushes to Azure Container Registry; a central pull-through mirror in the cloud fronts upstream, per-site mirrors pull from the centre, and each node pulls by digest - the load fans out in tiers so no thundering herd ever reaches upstream. Secret lane: Azure Key Vault holds the values, the External Secrets operator syncs them into the cluster, and git only ever holds the reference. The workload that runs is the sum of all four: synced state, rendered shape, digest-pinned image, injected secret.">
<defs>
<marker id="arr" viewBox="0 0 10 10" refX="9" refY="5" markerWidth="7" markerHeight="7" orient="auto-start-reverse">
<path d="M 0 0 L 10 5 L 0 10 z" fill="#64748b"></path>
@@ -67,26 +67,31 @@
<!-- ARTEFACT lane -->
<text x="60" y="392" font-family="ui-monospace, 'SF Mono', Menlo, monospace" font-size="11" letter-spacing="2" fill="#c026d3">ARTEFACT</text>
<g font-family="ui-monospace, 'SF Mono', Menlo, monospace" font-size="12" fill="#0e1726">
<rect x="60" y="406" width="150" height="48" rx="10" fill="none" stroke="#64748b" stroke-width="1.5"></rect>
<text x="135" y="428" text-anchor="middle">CI builds</text>
<text x="135" y="445" text-anchor="middle" font-size="10" fill="#64748b">once, only once</text>
<rect x="270" y="406" width="180" height="48" rx="10" fill="#c026d3" fill-opacity="0.04" stroke="#c026d3" stroke-width="1.5"></rect>
<text x="360" y="428" text-anchor="middle">ACR upstream</text>
<text x="360" y="445" text-anchor="middle" font-size="10" fill="#64748b">tag@sha256 minted</text>
<rect x="510" y="406" width="180" height="48" rx="10" fill="#c026d3" fill-opacity="0.04" stroke="#c026d3" stroke-width="1.5"></rect>
<text x="600" y="428" text-anchor="middle">zot mirror</text>
<text x="600" y="445" text-anchor="middle" font-size="10" fill="#64748b">the fleet pulls once</text>
<rect x="750" y="406" width="150" height="48" rx="10" fill="none" stroke="#64748b" stroke-width="1.5"></rect>
<text x="825" y="428" text-anchor="middle">node pulls</text>
<text x="825" y="445" text-anchor="middle" font-size="10" fill="#64748b">by digest</text>
<rect x="60" y="406" width="130" height="48" rx="10" fill="none" stroke="#64748b" stroke-width="1.5"></rect>
<text x="125" y="428" text-anchor="middle">CI builds</text>
<text x="125" y="445" text-anchor="middle" font-size="10" fill="#64748b">once, only once</text>
<rect x="228" y="406" width="150" height="48" rx="10" fill="#c026d3" fill-opacity="0.04" stroke="#c026d3" stroke-width="1.5"></rect>
<text x="303" y="428" text-anchor="middle">ACR upstream</text>
<text x="303" y="445" text-anchor="middle" font-size="10" fill="#64748b">tag@sha256 minted</text>
<rect x="416" y="406" width="160" height="48" rx="10" fill="#c026d3" fill-opacity="0.06" stroke="#c026d3" stroke-width="2"></rect>
<text x="496" y="428" text-anchor="middle">central mirror</text>
<text x="496" y="445" text-anchor="middle" font-size="10" fill="#64748b">one cloud cache, fronts upstream</text>
<rect x="614" y="406" width="150" height="48" rx="10" fill="#c026d3" fill-opacity="0.04" stroke="#c026d3" stroke-width="1.5"></rect>
<text x="689" y="428" text-anchor="middle">site mirror</text>
<text x="689" y="445" text-anchor="middle" font-size="10" fill="#64748b">zot at the edge</text>
<rect x="802" y="406" width="118" height="48" rx="10" fill="none" stroke="#64748b" stroke-width="1.5"></rect>
<text x="861" y="428" text-anchor="middle">node pulls</text>
<text x="861" y="445" text-anchor="middle" font-size="10" fill="#64748b">by digest</text>
</g>
<g stroke="#64748b" stroke-width="1.5" marker-end="url(#arr)">
<line x1="210" y1="430" x2="264" y2="430"></line>
<line x1="450" y1="430" x2="504" y2="430"></line>
<line x1="690" y1="430" x2="744" y2="430"></line>
<line x1="900" y1="430" x2="944" y2="430"></line>
<line x1="190" y1="430" x2="222" y2="430"></line>
<line x1="378" y1="430" x2="410" y2="430"></line>
<line x1="576" y1="430" x2="608" y2="430"></line>
<line x1="764" y1="430" x2="796" y2="430"></line>
<line x1="920" y1="430" x2="944" y2="430"></line>
</g>
<text x="60" y="480" font-family="ui-sans-serif, system-ui, -apple-system, Segoe UI, Roboto, sans-serif" font-size="11" fill="#64748b">promotion is a copy of the same digest - if the digest changed, it is a new candidate, not a promotion</text>
<text x="60" y="498" font-family="ui-sans-serif, system-ui, -apple-system, Segoe UI, Roboto, sans-serif" font-size="11" fill="#64748b">the tiers layer the load: upstream sees one consumer, each site sees one hop, nodes never leave the LAN</text>
<!-- SECRET lane -->
<text x="60" y="522" font-family="ui-monospace, 'SF Mono', Menlo, monospace" font-size="11" letter-spacing="2" fill="#8a6414">SECRET</text>
Side by Side Swipe Overlay

Before

Width:  |  Height:  |  Size: 9.4 KiB

After

Width:  |  Height:  |  Size: 10 KiB

content/course-VII-supply-chain.md
+5
View File
@@ -42,6 +42,11 @@ from Move 1 is what makes the mirror actually catch the traffic.
FIELD NOTE: a mirror can also serve a STALE tag->digest mapping while upstream moved the
tag. Pin by digest and the whole chain becomes content-addressed - the mirror cannot be
wrong about a hash.
TIERING (added 2026-08-17, owner ask): at real fleet scale the mirror itself tiers - a
central pull-through in the cloud fronts upstream once; per-site mirrors pull from the
centre; nodes pull from their site over the LAN. The load fans out in layers instead of
every site hammering upstream at once. Say it: mirrors tier - the load fans out in
layers, never all at once.
## Move 3 - Build once, promote by copy
The anti-pattern: rebuild the image for each environment ("the prod build"). Every
pilot/arc.tpl.html
+9 -1
View File
@@ -237,6 +237,13 @@
image mirror rules, and carries a sharp edge: digest-mirror rules rewrite <b>digest pulls
only</b>, so a by-tag pull silently skips the mirror. The pinning habit is what makes the
mirror actually catch the traffic.</p>
<p>At real fleet scale the mirror itself tiers: a <b>central mirror in the cloud</b> fronts
upstream once, and every site's mirror pulls from the centre rather than from upstream
directly. A new image ripples outward in layers - upstream to the centre, centre to each
site as it asks, site to its nodes over the LAN - instead of every site hammering upstream
at the same moment. Upstream sees one consumer; each site sees one hop; the nodes never
leave the building.</p>
<p class="sayit">Mirrors tier: the load fans out in layers, never all at once.</p>
<h3>Build once, promote by copy</h3>
<p>Every rebuild is a different artefact - different digest, untested by the stages before it.
So build <b>once</b>, then promote the same digest through environments by copying, registry
@@ -353,7 +360,8 @@
<article class="card">
<h3>zot</h3>
<p class="what">Where the fleet pulls from - a pull-through mirror between the cluster and the
internet, and the control point for what enters.</p>
internet, and the control point for what enters. At fleet scale it tiers: one central
mirror in the cloud fans out to per-site mirrors, layering the load.</p>
<p class="leans"><b>Leans on it:</b> every image pull on every node - boot, reschedule,
scale-up, recovery.</p>
<p class="down"><b>When it is down:</b> the sharpest edge. Upstream down + mirror up = nobody