# ctrl/registry.sh

## Registry modes

Registry plumbing. This is the seam — not a tool. Four modes, selected by
`REGISTRY_MODE` in the active profile:

- **none** — Tilt builds straight into the node. No registry at all, and so no
  guard against an outward push: an unqualified image name means
  `docker.io/library/<name>`, and only Tilt's kind detection stands between that
  and a real push. Throwaway use only; every profile here now defaults to `local`
  instead.
- **local** — a `registry:2` container wired into the cluster.
- **mirror** — the same container, but configured as a pull-through cache of the
  corporate registry. This is what a locked-down client actually looks like:
  images originate from corp, you don't hammer it, and you keep working when the
  VPN drops.
- **remote** — no local container; pull straight from the corporate registry
  using an imagePullSecret.

## Why a script rather than ctlptl

Deliberately a script rather than a tool. ctlptl collapses the `local` wiring
into one line, but its Registry spec only accepts name/port/image/listenAddress —
there is no way to set `REGISTRY_PROXY_REMOTEURL`, so it cannot express `mirror`
at all. Keeping the seam here is what keeps the corporate registry swappable.

## CA trust (install_ca_into_nodes)

A corporate registry is almost always fronted by an internal CA, and trust has to
reach three separate places. Nothing does this for you, and the symptom when it's
missing is an opaque:

    x509: certificate signed by unknown authority

1. the host docker daemon — `/etc/docker/certs.d/<host>/ca.crt` (needs root)
2. every kind node's containerd — nodes do NOT inherit host trust
3. anything doing HTTPS from inside the cluster, in its own trust store

`registry.sh` handles (2) because it's ours to handle. (1) is reported by
`check.sh` since it needs root. (3) belongs to the workload.