Skip to main content
A registry is a place Celum pulls charts and images from, and pushes mirrored copies into. Registering one is what turns a public-upstream install into an internal-mirror install — for an air-gapped estate, for a restricted one, or simply to stop depending on someone else’s uptime. Registries have a page of their own, Registries in the sidebar’s global section. They are kept in Celum’s database and shared across supervisors. Which registry a given supervisor actually uses is a separate decision — see Charts & the mirror for the resolution order, and note that a supervisor’s own declaration beats every global default.

​
”Reachable” is not the check that matters

This is the one thing to take from this page.
A registry health endpoint answers for anonymous and for wrong credentials. Harbor’s does. So a credential that can only pull registers cleanly, reports healthy, lists charts, and fails the first time anything needs to be pushed — which is every mirror and every pre-pull.On one estate a credential with a non-existent username sat in place for days looking fine. The symptom when it finally bit was nothing to do with credentials: an install failed with “Unable to apply the Cilium configuration”, and the version picker marked every version as needing a fetch — including two that were physically stocked in the registry.Test does a real push probe rather than a health check: it starts a blob upload and cancels it, so nothing is committed but the actual push-scope token handshake is exercised. It reports Push OK or Pull-only (no push). Read that, not the reachability.

​
Registering one

Registries → Add registry, then Test before relying on it.

​
What the form asks

Each row then offers Test (the push probe), Check charts (which of the chart versions the platform needs are stocked; read-only, copies nothing), Mirror charts and Pre-pull images.
Registries are referenced by name, not by id. A supervisor declares which registry it uses by naming it, so the credentials stay in the catalogue Celum reads server-side rather than on a cluster-scoped resource anyone with read access could see. A name that matches no registered registry is normally rejected — because the resolver would otherwise fall back silently and a saved-but-inert choice is invisible to whoever saved it.

​
Mirroring an estate that cannot reach the internet

Two halves, and they are separate because charts and images travel differently. Charts. POST /api/registries/{id}/mirror-charts copies the platform catalogue’s charts into the registry. A chart is stocked on demand at install time too, but only when the stock check succeeded and found it missing — on a read error Celum deliberately does not push, and lets Flux pull instead. That asymmetry exists because a read failure once forced a write, and a pull-only credential then turned a recoverable “version not found” loop into a hard install failure. Images. GET /api/registries/required-images lists every image the platform needs to bring a cluster up, with a count — the list to mirror before onboarding an air-gapped supervisor. POST /api/registries/{id}/prepull pulls them into the registry, asynchronously; poll the job. Pointing the nodes at a mirror is a third thing again, configured per supervisor rather than here: the containerd mirror declaration maps each upstream to a proxy-cache project. The credential for it is matched by host against these registered registries, so register the mirror here first — an unmatched host silently yields an anonymous pull, which works on a registry whose proxy projects allow anonymous read and fails on the first one that does not.
Guest clusters inherit all of this, and nothing about it is declared twice. What a guest’s nodes and add-ons resolve to, which charts are redirected and which are deliberately withheld, and why “pull through local Harbor” being supervisor-only does not contradict any of it — Registry mirroring in depth maps every channel end to end.

​
Image buckets

The page’s second tab, Image buckets, holds the S3 / MinIO bucket connections the Image library imports disk images and ISOs from. A connection has:
  • a supervisor, which gets the connection’s credentials as a Secret in its image-library namespace;
  • a name, and optionally a site, which makes it the default bucket for supervisors on that site;
  • a content label, free text shown on the row and used to pre-filter the object picker (it enforces nothing);
  • the endpoint URL, the bucket, and an access key ID and secret key, held by the platform.
Over MCP: create_image_bucket, update_image_bucket.

​
What commonly goes wrong

Charts & the mirror

Which registry a supervisor resolves to, and the audit for releases installed before it was declared.

Platform onboarding

Where a supervisor declares its chart and image sources — the first step, before anything is installed.

App catalog

Third-party charts, which carry their own repository URL.

Image library

VM golden images — a different kind of artefact, stored as PVCs rather than in a registry.

Registry mirroring in depth

Every channel end to end — what guests inherit, what is Harbor-specific, and the two credential traps.