Skip to main content

Platform Overview

Orchestr8 is a comprehensive enterprise-grade GitOps platform designed for modern Kubernetes orchestration. This overview provides a high-level view of the complete platform architecture, component relationships, and data flows.

Complete Platform Architecture​

Platform Components​

🚪 Ingress & Load Balancing​

  • Cloud Load Balancer: High-availability entry point with health checks
  • Istio Gateway: Service mesh ingress with advanced traffic management
  • Cert-Manager: Automated TLS certificate provisioning and renewal

🔐 Identity & Access Management​

  • Keycloak: Centralized identity provider with OIDC/SAML support
  • OAuth2 Proxy: Authentication proxy for service-to-service communication
  • Vault: Secure secret storage and management
  • External Secrets: Kubernetes secret synchronization from external sources

🤖 GitOps & Configuration​

  • ArgoCD: Declarative GitOps continuous delivery
  • Git Repositories: Single source of truth for all configurations
  • CUE Engine: Type-safe configuration generation and validation
  • Kustomize: Environment-specific configuration overlays

🕸️ Service Mesh​

  • Istio Control Plane: Traffic management, security, and observability
  • Envoy Sidecars: Data plane proxies for microservice communication
  • Service Discovery: DNS-based service registry and load balancing

⚙️ Core Platform Services​

  • Data Services: PostgreSQL (CNPG), Redis, ClickHouse for various data needs
  • AI/ML Services: Langfuse for LLM ops, Ollama for local LLM serving, Jupyter for ML development
  • Application Services: Frontend apps, backend APIs, and background workers

📊 Observability Stack​

  • Prometheus: Metrics collection and alerting rules
  • Grafana: Dashboards and data visualization
  • Loki: Log aggregation and querying
  • Jaeger: Distributed tracing for microservices
  • AlertManager: Alert routing and notification management

🔒 Security & Policy​

  • OPA Gatekeeper: Admission control and policy enforcement
  • Falco: Runtime security monitoring and threat detection
  • Trivy: Container and configuration vulnerability scanning
  • Network Policies: Kubernetes network traffic filtering

🏗️ Infrastructure Management​

  • Kubernetes: Container orchestration and workload management
  • CSI Storage: Persistent volume management with cloud providers
  • Node Pools: Compute resource provisioning and management
  • Cluster Autoscaler: Dynamic cluster scaling based on demand

🏠 Multi-Tenancy​

  • Tenant Isolation: Namespace-based tenant separation
  • Resource Quotas: Per-tenant resource usage limits
  • RBAC Boundaries: Fine-grained access control per tenant
  • Network Isolation: Traffic segmentation between tenants

Data Flow Patterns​

🔄 Request Flow​

  1. User Request → Cloud Load Balancer → Istio Gateway
  2. Authentication → OAuth2 Proxy → Keycloak verification
  3. Service Routing → Istio traffic management → Target service
  4. Response → Reverse path with observability collection

📝 Configuration Flow​

  1. Git Commit → CUE validation and generation
  2. Resource Generation → Kustomize environment overlays
  3. GitOps Sync → ArgoCD deployment to Kubernetes
  4. Health Monitoring → Continuous reconciliation

📊 Observability Flow​

  1. Metrics → Prometheus collection → Grafana visualization
  2. Logs → Loki aggregation → Centralized querying
  3. Traces → Jaeger collection → Distributed request tracking
  4. Alerts → AlertManager routing → Notification channels

🔐 Security Flow​

  1. Image Scanning → Trivy vulnerability detection
  2. Policy Enforcement → OPA Gatekeeper admission control
  3. Runtime Monitoring → Falco threat detection
  4. Network Filtering → Kubernetes Network Policies

Multi-Environment Support​

The platform supports multiple environments with consistent architecture:

  • 🧪 Development: Rapid iteration with relaxed security policies
  • 🔧 Integration: Service integration testing with production-like setup
  • 🎭 Staging: Full production simulation for final validation
  • 🏭 Production: High-availability with strict security and monitoring

Each environment maintains the same architectural patterns while allowing for environment-specific configurations through Kustomize overlays.

Benefits​

🚀 Operational Excellence​

  • GitOps-driven: All changes tracked and reversible
  • Automated deployments: Reduced manual intervention and errors
  • Infrastructure as code: Consistent and repeatable deployments
  • Self-healing: Automatic detection and correction of configuration drift

🔒 Security First​

  • Zero trust architecture: Every component authenticated and authorized
  • Defense in depth: Multiple security layers and controls
  • Compliance ready: Built-in controls for SOC2, GDPR, HIPAA
  • Continuous security: Runtime monitoring and vulnerability management

📈 Scalability & Performance​

  • Horizontal scaling: Auto-scaling at application and cluster levels
  • Multi-tenant: Efficient resource sharing with strong isolation
  • Service mesh: Advanced traffic management and load balancing
  • Observability: Comprehensive monitoring and alerting

👥 Developer Experience​

  • Self-service: Developers can deploy and manage their applications
  • Consistent environments: Development to production parity
  • Fast feedback: Rapid iteration and testing cycles
  • Rich tooling: Comprehensive CLI and web interfaces

Getting Started​

  1. Platform Setup: Deploy core infrastructure and platform services
  2. Identity Configuration: Set up Keycloak realms and user management
  3. GitOps Repository: Initialize configuration repository structure
  4. First Application: Deploy a sample application through the GitOps workflow
  5. Monitoring Setup: Configure dashboards and alerting rules
  6. Security Hardening: Apply security policies and network restrictions

For detailed setup instructions, see our Azure Setup Guide and Concepts Documentation.