Swiss private registry, satellite of managed Kubernetes. Auth in the project.

Project tokens or credentials, preferably stored in Vault as a Service rather than in a US CI SaaS variable store. Runners can live in the VPC. Detail in docs.hikube.cloud. Terraform integration in preparation: today, Hikube API and console.

It is an OCI registry: the sequence is the one you know, with no bespoke command. The screens and the API reference are in docs.hikube.cloud; the order does not change.

• Create a project token in the console and put it in Vault rather than in a US CI SaaS’s variables: the secrets vault
• Authenticate the client, docker, buildah, kaniko, with that token, from a runner that can live in the VPC
• Tag the image with the registry address, then push: it is a standard OCI push, not a proprietary format
• In the cluster, reference the image and give the namespace the pull secret: without it the pod stays in ImagePullBackOff, which is the most common mistake
• Verify the pull from a cluster node, not from your laptop: it is the cluster’s network path that matters, not yours

Artefact retention is on your side, and it is real work: a CI that pushes on every commit fills a registry fast, and nobody notices before the storage bill. Decide early how many tags you keep per repository, and have your pipeline enforce it rather than a manual purge on a Friday. Hikube publishes no automatic cleanup policy and no per-repository quota on this page: if your chain depends on either, have them confirmed before building on them. Vulnerability scanning is not provided either, and that is said plainly below.

Hidora SA operates the registry, the three DCs and FR/EN support. You keep images, tags, artefact retention, CI and access secrets. Kubernetes workers pull; Hikube spreads them automatically, you do not choose the DC.

Swiss GitOps chain: cluster + registry + S3 + Vault. GPU training images. Line-of-business images that must not go to GHCR. This is not a worldwide Docker Hub mirror.

Hikube does not provide a vulnerability scan. The registry is private, authenticated, in Switzerland. Scan tools you already operate (CI, admission) stay yours. Flux CD is an optional addon on the managed cluster: the Kubernetes platform.