Components¶
Mirantis Secure Registry (MSR) is a containerized application that runs on a Kubernetes cluster. After deploying MSR, you can use your Docker CLI client to log in, push images, and pull images. For high availability, you can horizontally scale your MSR workloads across multiple Kubernetes worker nodes.
Workloads¶
Descriptions for each of the workloads that MSR creates during installation are available in the table below.
Caution
Do not use these components in your applications, as they are for internal MSR use only.
Name |
Name on Kubernetes |
Name on Swarm |
Description |
---|---|---|---|
API |
|
|
Executes the MSR business logic, serving the MSR web application and API. |
Garant |
|
|
Manages MSR authentication. |
Jobrunner |
|
|
Runs asynchronous background jobs, including garbage collection and image vulnerability scans. |
NGINX |
|
|
Receives HTTP and HTTPS requests and proxies those requests to other MSR components. |
Notary server |
|
|
Provides signing and verification for images that are pushed to or pulled from the secure registry. |
Notary signer |
|
|
Performs server-side timestamp and snapshot signing for Content Trust metadata. |
Registry |
|
|
Implements pull and push functionality for Docker images and manages how images are stored. |
RethinkDB |
|
|
Stores persisting repository metadata. |
Scanningstore |
|
|
Stores security scanning data. |
eNZi |
|
|
Authenticates and authorizes MSR users. |
Name |
Name on Kubernetes |
Description |
---|---|---|
PostgreSQL |
|
Manages the security scanning database. |
cert-manager |
|
Manages certificates for all MSR components. |
Note
Third-party components are present only in Kubernetes deployments. Swarm-based installations include only the components listed in the MSR installation workloads table.
The communication flow between MSR workloads is illustrated below:
Note
The third-party cert-manager component interacts with all of the components displayed in the above diagram.
JobRunner¶
Descriptions for each of the job types that are run by MSR are available in the table below.
Job type |
Description |
---|---|
|
Uploads an analytics report to Mirantis. |
|
Lints a Helm chart. |
|
Lints all charts in all repositories. |
|
Performs garbage collection for all types of MSR data and metadata. |
|
Performs garbage collection of orphaned image layer data. |
|
Performs auto-deletion of repository events. |
|
Performs auto-deletion of job logs. |
|
Performs garbage collection of image metadata. |
|
Performs garbage collection of security scan results for deleted layers. |
|
Pulls tags from remote repositories as determined by mirroring policies. |
|
Pushes image tags to remote repositories as determined by mirroring policies. |
|
Scans image by digest. |
|
Rescans all previously scanned images. |
|
Scans single layer of the image. |
|
Deletes tags from remote repositories, as determined by the pruning policies of the repositories. |
|
Updates vulnerability database (CVE list). |
|
Sends a webhook. |