Registry Security and Access Controls

Registry Security (Ops View)

• Separate repos for dev/staging/prod or enforce strict promotion rules.
• Prefer digest-based deployments; use tags only as human pointers.
• Limit who can push, who can delete, and who can mutate tags.

Controls to Implement

1. Least-privilege registry roles per pipeline.
2. Immutable tags for prod (or disallow retagging).
3. Retention policies and protected repositories.
4. Require signed artifacts for prod repos.

Operational Checks

# Always resolve tag to digest before deploy (concept)
1) pull manifest
2) extract digest
3) deploy digest

# Investigations: track exactly what ran
kubectl -n app get pods -o jsonpath='{$.items[*].spec.containers[*].image}'

Failure Modes

• Tag confusion during incident: “prod:latest” means nothing.
• Delete rights too broad: evidence lost and rollbacks harder.