The mirror

The platform serves signed images from a read-through mirror. The owner's pipeline imports the pinned tag into the owner's own registry — a server-side copy, authenticated with the instance token.

The cluster

Pods pull from the owner's registry with the cluster's own identity. An estate can run with no outbound dependency at deploy time.

The instance

Watches for a newer build and hands the roll to the control instance; no portal holds a credential that changes the cluster.