Registry / pull-through cache options
registry.marshal.codes is rate-limited across every customer — a pull-through cache is required for real usage, not just an optimization. How you get one depends entirely on target.
| Target | Default posture | Cache option | Who provisions it |
|---|---|---|---|
| single-node k3s | Direct pull | image_cache_registry → your own external mirror | You (not this repo) |
| GKE | Self-provisioned cache (default on) | create_registry_cache — GCP Artifact Registry REMOTE_REPOSITORY | Terraform, automatically |
| EKS | Direct pull | create_harbor_cache (opt-in fallback) or image_cache_registry (BYO, reuse path) | Terraform (Harbor) or you (BYO) |
| ArgoCD (any cloud) | Whatever you set global.registry to | Bring your own — this path provisions nothing | You |
Why not ECR. AWS’s native ECR pull-through cache can never mirror
registry.marshal.codes — confirmed live that CreatePullThroughCacheRule only accepts a
hardcoded enum of known upstream registries and validates the URL server-side against each
one’s real hostname. This is a hard AWS product limitation, not a missing feature — hence
EKS’s Harbor fallback instead.
Shared, not per-deployment. Wherever image_cache_registry applies
(single-node k3s, EKS reuse path), it’s a
customer-level resource — set up once, reused across every install you run (prod,
staging, …), never provisioned per-deployment.