Harbor Image Mirror List — ASK Platform¶

Harbor registry: harbor.cl1.sq4.aegis.internal
Mirror tool: mirror-images.py — config at scripts/harbor-mirror/mirror-config.yaml
Source for app images: ai71uaenprodask71acr01.azurecr.io (ACR)

Harbor Projects Required¶

Harbor Project	Source Registry	Contents
`ask`	Azure ACR	All ASK application images
`gitlab`	`registry.gitlab.com`	GitLab CNG platform images
`dockerhub`	`docker.io`	Official base images, HashiCorp, Redis, Weaviate
`bitnamilegacy`	`docker.io`	Bitnami legacy images (PostgreSQL, Redis, RabbitMQ)
`ghcr`	`ghcr.io`	Hatchet, cert-manager tools, Zitadel, Reloader, DEX
`quay`	`quay.io`	cert-manager, ArgoCD, kube-rbac-proxy
`helm-charts`	upstream Helm repos	Helm charts (OCI)

⚠️ Pre-create gitlab and quay projects in Harbor before running the mirror (Admin → New Project → set as Private).

Status Key¶

Symbol	Meaning
✅	In `mirror-config.yaml`
🔴	Missing — needs to be added
💤	Commented out (planned, not yet active)

`ask` Project — Application Images (source: ACR)¶

These are the ASK application images built by CI and stored in Azure ACR. Fill in Tag and Digest from Azure Portal → Container Registry → Repositories, or from a running deployment.

Image	Tag (git SHA)	Digest	Status
`core-service`			🔴 Pending
`core-service-bulk-operations-worker`			🔴 Pending
`core-service-billing-metering-worker`			🔴 Pending
`core-service-cron-scheduler-worker`			🔴 Pending
`core-service-job-run-worker`			🔴 Pending
`assistant-service`			🔴 Pending
`assistant-service-mcp-gateway`			🔴 Pending
`ask-knowledge-management-service`			🔴 Pending
`frontend`			🔴 Pending
`frontend-dev`			🔴 Pending
`frontend-stg`			🔴 Pending
`hatchet-base`	`e3b0c44298fc`	`sha256:ad09df904720350811ff4e2e6157954a4ed2742e723e1fa3d8057bfc32bf9753`	✅
`hatchet-base-datagen`	`e3b0c44298fc`	`sha256:3e54f96eceb199240da13d6d86d8e3e3c1ca4988613e49fdfbbfac574fb6dcb2`	✅
`hatchet-base-ml`	`e3b0c44298fc`	`sha256:3aa5ebf75c6770da4b11f4294b61092c211ec2e40cdb81b72f62e8e61e2266b9`	✅

How to get Tag + Digest

# From bastion — once proxy allows ACR or from a machine with direct ACR access
ACR_USER=$(python3 -c "import json; d=json.load(open('acr-creds.json')); print(d['username'])")
ACR_PASS=$(python3 -c "import json; d=json.load(open('acr-creds.json')); print(d['password'])")

for img in core-service assistant-service ask-knowledge-management-service frontend; do
  echo "=== ${img} ==="
  skopeo inspect \
    --creds="${ACR_USER}:${ACR_PASS}" \
    docker://ai71uaenprodask71acr01.azurecr.io/${img}:<tag> \
    | python3 -c "import sys,json; d=json.load(sys.stdin); print('Digest:', d['Digest'])"
done

mirror-config.yaml entry format (tag + digest pinned):

  - { name: core-service,                        source: acr, project: ask, tags: ["<git-sha>"], digest: "sha256:<digest>" }
  - { name: core-service-bulk-operations-worker,  source: acr, project: ask, tags: ["<git-sha>"], digest: "sha256:<digest>" }
  - { name: core-service-billing-metering-worker, source: acr, project: ask, tags: ["<git-sha>"], digest: "sha256:<digest>" }
  - { name: core-service-cron-scheduler-worker,   source: acr, project: ask, tags: ["<git-sha>"], digest: "sha256:<digest>" }
  - { name: core-service-job-run-worker,          source: acr, project: ask, tags: ["<git-sha>"], digest: "sha256:<digest>" }
  - { name: assistant-service,                    source: acr, project: ask, tags: ["<git-sha>"], digest: "sha256:<digest>" }
  - { name: assistant-service-mcp-gateway,        source: acr, project: ask, tags: ["<git-sha>"], digest: "sha256:<digest>" }
  - { name: ask-knowledge-management-service,     source: acr, project: ask, tags: ["<git-sha>"], digest: "sha256:<digest>" }
  - { name: frontend,                             source: acr, project: ask, tags: ["<git-sha>"], digest: "sha256:<digest>" }
  - { name: frontend-dev,                         source: acr, project: ask, tags: ["<git-sha>"], digest: "sha256:<digest>" }
  - { name: frontend-stg,                         source: acr, project: ask, tags: ["<git-sha>"], digest: "sha256:<digest>" }

`gitlab` Project — GitLab CNG Images (source: `registry.gitlab.com`)¶

GitLab 18.11.4 / chart 9.11.5. All ✅ present in manifest.

Image	Tag	Status
`gitlab-org/build/cng/gitaly`	`v18.11.4`	✅
`gitlab-org/build/cng/gitlab-base`	`v18.11.4`	✅
`gitlab-org/build/cng/gitlab-container-registry`	`v4.39.0-gitlab`	✅
`gitlab-org/build/cng/gitlab-exporter`	`16.7.0`	✅
`gitlab-org/build/cng/gitlab-kas`	`v18.11.4`	✅
`gitlab-org/build/cng/gitlab-shell`	`v14.50.0`	✅
`gitlab-org/build/cng/gitlab-sidekiq-ee`	`v18.11.4`	✅
`gitlab-org/build/cng/gitlab-toolbox-ee`	`v18.11.4`	✅
`gitlab-org/build/cng/gitlab-webservice-ee`	`v18.11.4`	✅
`gitlab-org/build/cng/gitlab-workhorse-ee`	`v18.11.4`	✅
`gitlab-org/build/cng/kubectl`	`v18.11.4`	✅
`gitlab-org/build/cng/certificates`	`v18.11.4`	✅
`gitlab-org/cloud-native/mirror/images/minio/mc`	`RELEASE.2018-07-13T00-53-22Z`	✅

`dockerhub` Project — Docker Hub Images (source: `docker.io`)¶

Image	Tag(s)	Status	Used By
`postgres`	`16-alpine`	✅	Hatchet init job
`python`	`3.12`, `3.12-slim`	✅	Core Service builder/runtime
`python`	`3.12-trixie`, `3.12-slim-trixie`	🔴 Missing	Assistant Service + KMS builder/runtime
`node`	`22-alpine`	🔴 Missing	Frontend builder + runtime
`weaviate/weaviate`	`1.34.0`	🔴 Missing	Vector database
`alpine`	`3.20`	🔴 Missing	Weaviate `sysctlInitContainer`
`hashicorp/vault`	`1.21.2`	✅	Vault app image
`hashicorp/vault-k8s`	`1.7.2`	✅	Vault agent injector
`hashicorp/vault-secrets-operator`	`0.9.1`	✅	VSO controller
`redis`	`8.2.3-alpine`	✅	ArgoCD Redis dependency

YAML to add:

  # ── additional dockerhub images ───────────────────────────────────────────
  - { name: python,          source: docker.io, project: dockerhub, tags: ["3.12-trixie", "3.12-slim-trixie"] }
  - { name: node,            source: docker.io, project: dockerhub, tags: ["22-alpine"] }
  - { name: weaviate/weaviate, source: docker.io, project: dockerhub, tags: ["1.34.0"] }
  - { name: alpine,          source: docker.io, project: dockerhub, tags: ["3.20"] }

`bitnamilegacy` Project — Bitnami Images (source: `docker.io`)¶

Source Image	Harbor dest_name	Tag	Status	Used By
`bitnamilegacy/postgresql`	`postgresql`	`16.6.0`	✅	GitLab bundled PostgreSQL
`bitnamilegacy/postgresql`	`postgresql`	`17.6.0-debian-12-r4`	🔴 Missing	Hatchet PostgreSQL subchart (PP)
`bitnami/postgresql`	`postgresql`	`18.1.0`	🔴 Missing	KMS PostgreSQL subchart (PP)
`bitnamilegacy/redis`	`redis`	`7.2.4-debian-12-r9`	✅	GitLab bundled Redis
`bitnamilegacy/redis`	`redis`	`8.2.1-debian-12-r0`	🔴 Missing	Assistant Service Redis subchart (PP)
`bitnamilegacy/rabbitmq`	`rabbitmq`	`4.1.3-debian-12-r1`	🔴 Missing	Hatchet RabbitMQ subchart (PP)
`bitnamilegacy/postgres-exporter`	`postgres-exporter`	`0.15.0-debian-11-r7`	✅	Metrics
`bitnamilegacy/redis-exporter`	`redis-exporter`	`1.58.0-debian-12-r4`	✅	Metrics

YAML to add:

  # ── additional bitnami images ─────────────────────────────────────────────
  - { name: bitnamilegacy/postgresql, dest_name: postgresql, source: docker.io, project: bitnamilegacy, tags: ["17.6.0-debian-12-r4"] }
  - { name: bitnami/postgresql,       dest_name: postgresql, source: docker.io, project: bitnamilegacy, tags: ["18.1.0"] }
  - { name: bitnamilegacy/redis,      dest_name: redis,      source: docker.io, project: bitnamilegacy, tags: ["8.2.1-debian-12-r0"] }
  - { name: bitnamilegacy/rabbitmq,   dest_name: rabbitmq,   source: docker.io, project: bitnamilegacy, tags: ["4.1.3-debian-12-r1"] }

`ghcr` Project — GitHub Container Registry (source: `ghcr.io`)¶

Image	Tag	Status	Used By
`cloudnative-pg/cloudnative-pg`	`1.24.1`	✅	CNPG operator
`stakater/reloader`	`v1.4.17`	✅	Stakater Reloader
`dexidp/dex`	`v2.45.1`	✅	ArgoCD OIDC (DEX)
`hatchet/hatchet-api`	`v0.71.0`	🔴 Missing	Hatchet API server (PP)
`hatchet/hatchet-engine`	`v0.71.0`	🔴 Missing	Hatchet workflow engine (PP)
`hatchet/hatchet-frontend`	`v0.71.0`	🔴 Missing	Hatchet web UI (PP)
`hatchet/hatchet-migrate`	`v0.71.0`	🔴 Missing	Hatchet migration job (PP)
`hatchet/hatchet-admin`	`v0.71.0`	🔴 Missing	Hatchet setup/seed jobs (PP)
`zitadel/zitadel`	`v4.5.0`	💤 Commented	IAM — uncomment to enable
`zitadel/zitadel-login`	`v4.5.0`	💤 Commented	IAM login UI — uncomment to enable
`astral-sh/uv`	`0.10.2-python3.12-trixie`	🔴 Missing	KMS Dockerfile builder stage
`astral-sh/uv`	`0.11.8`	🔴 Missing	MCP Gateway uv binary copy

YAML to add:

  # ── Hatchet images (PP) ───────────────────────────────────────────────────
  - { name: hatchet/hatchet-api,      source: ghcr.io, project: ghcr, tags: ["v0.71.0"] }
  - { name: hatchet/hatchet-engine,   source: ghcr.io, project: ghcr, tags: ["v0.71.0"] }
  - { name: hatchet/hatchet-frontend, source: ghcr.io, project: ghcr, tags: ["v0.71.0"] }
  - { name: hatchet/hatchet-migrate,  source: ghcr.io, project: ghcr, tags: ["v0.71.0"] }
  - { name: hatchet/hatchet-admin,    source: ghcr.io, project: ghcr, tags: ["v0.71.0"] }
  # ── Zitadel (uncomment when enabling) ────────────────────────────────────
  # - { name: zitadel/zitadel,       source: ghcr.io, project: ghcr, tags: ["v4.5.0"] }
  # - { name: zitadel/zitadel-login, source: ghcr.io, project: ghcr, tags: ["v4.5.0"] }
  # ── uv (KMS builder + MCP gateway) ───────────────────────────────────────
  - { name: astral-sh/uv, source: ghcr.io, project: ghcr, tags: ["0.10.2-python3.12-trixie", "0.11.8"] }

`quay` Project — Quay.io Images (source: `quay.io`)¶

All ✅ present in manifest.

Image	Tag	Status	Used By
`jetstack/cert-manager-controller`	`v1.20.2`	✅	cert-manager
`jetstack/cert-manager-webhook`	`v1.20.2`	✅	cert-manager
`jetstack/cert-manager-cainjector`	`v1.20.2`	✅	cert-manager
`jetstack/cert-manager-acmesolver`	`v1.20.2`	✅	cert-manager
`jetstack/cert-manager-startupapicheck`	`v1.20.2`	✅	cert-manager startup check
`argoproj/argocd`	`v3.4.2`	✅	ArgoCD
`brancz/kube-rbac-proxy`	`v0.18.1`	✅	VSO sidecar

`helm-charts` Project — Helm Charts (OCI)¶

Chart	Version	Repo URL	Status	Used By
`vault`	`0.32.0`	`https://helm.releases.hashicorp.com`	✅	HashiCorp Vault
`vault-secrets-operator`	`0.9.1`	`https://helm.releases.hashicorp.com`	✅	VSO
`hatchet-stack`	`0.10.0`	`https://hatchet-dev.github.io/hatchet-charts`	🔴 Missing	Hatchet job queue (PP)
`weaviate`	`17.7.0`	`https://weaviate.github.io/weaviate-helm`	🔴 Missing	Weaviate vector DB (PP)
`postgresql`	`15.5.0`	`https://charts.bitnami.com/bitnami`	🔴 Missing	Shared PostgreSQL (PP)
`postgresql`	`16.4.1`	`https://charts.bitnami.com/bitnami`	🔴 Missing	KMS PostgreSQL subchart

YAML to add under helm_charts.charts:

    # Hatchet — chart 0.10.0 / app v0.71.0
    - { repo_name: hatchet, repo_url: "https://hatchet-dev.github.io/hatchet-charts", chart: hatchet-stack, version: "0.10.0" }
    # Weaviate — chart 17.7.0 / app 1.34.0
    - { repo_name: weaviate, repo_url: "https://weaviate.github.io/weaviate-helm", chart: weaviate, version: "17.7.0" }
    # PostgreSQL (Bitnami) — shared platform
    - { repo_name: bitnami, repo_url: "https://charts.bitnami.com/bitnami", chart: postgresql, version: "15.5.0" }
    # PostgreSQL (Bitnami) — KMS subchart
    - { repo_name: bitnami, repo_url: "https://charts.bitnami.com/bitnami", chart: postgresql, version: "16.4.1" }

Complete Missing Images — Summary¶

All images that need to be added to mirror-config.yaml to fully support the ASK application stack:

`ask` project (ACR → Harbor)¶

  - { name: core-service,                     source: acr, project: ask, tags: ["<git-sha>"] }
  - { name: assistant-service,                source: acr, project: ask, tags: ["<git-sha>"] }
  - { name: ask-knowledge-management-service, source: acr, project: ask, tags: ["<git-sha>"] }
  - { name: frontend,                         source: acr, project: ask, tags: ["<git-sha>"] }
  - { name: frontend-dev,                     source: acr, project: ask, tags: ["<git-sha>"] }
  - { name: frontend-stg,                     source: acr, project: ask, tags: ["<git-sha>"] }

`dockerhub` project (docker.io → Harbor)¶

  - { name: python,            source: docker.io, project: dockerhub, tags: ["3.12-trixie", "3.12-slim-trixie"] }
  - { name: node,              source: docker.io, project: dockerhub, tags: ["22-alpine"] }
  - { name: weaviate/weaviate, source: docker.io, project: dockerhub, tags: ["1.34.0"] }
  - { name: alpine,            source: docker.io, project: dockerhub, tags: ["3.20"] }

`bitnamilegacy` project (docker.io → Harbor)¶

  - { name: bitnamilegacy/postgresql, dest_name: postgresql, source: docker.io, project: bitnamilegacy, tags: ["17.6.0-debian-12-r4"] }
  - { name: bitnami/postgresql,       dest_name: postgresql, source: docker.io, project: bitnamilegacy, tags: ["18.1.0"] }
  - { name: bitnamilegacy/redis,      dest_name: redis,      source: docker.io, project: bitnamilegacy, tags: ["8.2.1-debian-12-r0"] }
  - { name: bitnamilegacy/rabbitmq,   dest_name: rabbitmq,   source: docker.io, project: bitnamilegacy, tags: ["4.1.3-debian-12-r1"] }

`ghcr` project (ghcr.io → Harbor)¶

  - { name: hatchet/hatchet-api,      source: ghcr.io, project: ghcr, tags: ["v0.71.0"] }
  - { name: hatchet/hatchet-engine,   source: ghcr.io, project: ghcr, tags: ["v0.71.0"] }
  - { name: hatchet/hatchet-frontend, source: ghcr.io, project: ghcr, tags: ["v0.71.0"] }
  - { name: hatchet/hatchet-migrate,  source: ghcr.io, project: ghcr, tags: ["v0.71.0"] }
  - { name: hatchet/hatchet-admin,    source: ghcr.io, project: ghcr, tags: ["v0.71.0"] }
  - { name: astral-sh/uv,             source: ghcr.io, project: ghcr, tags: ["0.10.2-python3.12-trixie", "0.11.8"] }

`helm-charts` project¶

    - { repo_name: hatchet, repo_url: "https://hatchet-dev.github.io/hatchet-charts",  chart: hatchet-stack, version: "0.10.0" }
    - { repo_name: weaviate, repo_url: "https://weaviate.github.io/weaviate-helm",      chart: weaviate,      version: "17.7.0" }
    - { repo_name: bitnami,  repo_url: "https://charts.bitnami.com/bitnami",            chart: postgresql,    version: "15.5.0" }
    - { repo_name: bitnami,  repo_url: "https://charts.bitnami.com/bitnami",            chart: postgresql,    version: "16.4.1" }

Total Image Count¶

Project	Currently in manifest	Missing	Total needed
`ask` (ACR)	3 (hatchet-base variants) + 4 💤	6 app images	13
`gitlab`	13	0	13
`dockerhub`	7	4	11
`bitnamilegacy`	4	4	8
`ghcr`	3	7	10
`quay`	7	0	7
Helm charts	2	4	6
Total	39	25	68

Harbor Image Mirror List — ASK Platform¶

Harbor Projects Required¶

Status Key¶

ask Project — Application Images (source: ACR)¶

gitlab Project — GitLab CNG Images (source: registry.gitlab.com)¶

dockerhub Project — Docker Hub Images (source: docker.io)¶

bitnamilegacy Project — Bitnami Images (source: docker.io)¶

ghcr Project — GitHub Container Registry (source: ghcr.io)¶

quay Project — Quay.io Images (source: quay.io)¶

helm-charts Project — Helm Charts (OCI)¶

Complete Missing Images — Summary¶

ask project (ACR → Harbor)¶

dockerhub project (docker.io → Harbor)¶

bitnamilegacy project (docker.io → Harbor)¶

ghcr project (ghcr.io → Harbor)¶

helm-charts project¶

Total Image Count¶

`ask` Project — Application Images (source: ACR)¶

`gitlab` Project — GitLab CNG Images (source: `registry.gitlab.com`)¶

`dockerhub` Project — Docker Hub Images (source: `docker.io`)¶

`bitnamilegacy` Project — Bitnami Images (source: `docker.io`)¶

`ghcr` Project — GitHub Container Registry (source: `ghcr.io`)¶

`quay` Project — Quay.io Images (source: `quay.io`)¶

`helm-charts` Project — Helm Charts (OCI)¶

`ask` project (ACR → Harbor)¶

`dockerhub` project (docker.io → Harbor)¶

`bitnamilegacy` project (docker.io → Harbor)¶

`ghcr` project (ghcr.io → Harbor)¶

`helm-charts` project¶