Skip to main content

Platform components and services

These components and services are part of the platform-base helm chart installation.

  • Manager

    • Admin backend for the developer portal and orchestrating deployments
    • Handles creating pipeline-runs, authorization policies, user access roles, etc.
    • All writes to the master DB (both user and application writes) are handled by this service

  • Realtime

    • Listen/notify implementation for the master DB
    • The developer portal and deployed services subscribe to updates for the services they have access to

  • Admin Portal

    • Admin user interface for managing the Platform
    • Non-admin users see an "AppStore" like grid-view of the end-user applications they have access to

  • CI/CD (Tekton + Kaniko)

    • Currently, resources (pipelines, tasks, etc.) are deployed to the "default" namespace
    • Tekton core stack in the "tekton-pipelines" namespace
    • Allows building and deploying services from source code or image registry. It is used for all of our internal services and images, and for deploying services from the manager.
    • If you make custom changes to pipelines or tasks, you have to run helm upgrade platform-base before changes take effect
    • A separate helm chart is used to define the infrastructure needed for services deployed by the CI/CD

  • Traffic management and authz (Istio)

    • Istio provides a service mesh for internal and external traffic management, security, and observability.
    • For external communication, it's used for JWT token checks, mapping traffic to correct services, and handling TLS certs together with cert-manager.
    • For internal communication, Istio provides mutual TLS and service discovery inside the Platform
    • "istio-system" namespace for Istio base resources deployment
    • "istio-ingress" namespace for gateway deployment
    • All namespaces with Istio-sidecar enabled will have Istio Envoy sidecar automatically deployed to enforce mTLS

  • User management and authentication (Keycloak)

    • Keycloak provides a full user management and authentication service
    • It uses CNPG Postgre cluster as its database
    • Initialized with realm-export.json to create correct realms and clients on install

  • Reverse Proxy (oauth proxy)

    • Reverse proxy for outfacing services that don't implement their own login flow (tools namespace)
    • Used in combination with a custom Istio Envoy filter to provide UMA token authorization

  • Databases (Cloud Native Postgre - CNPG)

    • Platform uses CNPG operator that manages the deployment of Postgre clusters
    • Both the master database and Keycloak database are deployed as part of the platform-base helm chart using the operator
    • Capability to deploy separate Postgre clusters for applications with pg-vector and other extensions

  • Logging, monitoring, and tracing

    • Kiali (Istio traffic monitoring web UI)
      • Operator at "kiali-operator" namespace (manages Kiali deployment)
      • Kiali components deployed to "istio-system" namespace
    • Prometheus (logging, alerts, etc.)
      • Currently installed to "default" namespace
      • Kiali configured to track traffic using Prometheus

  • Cert Management (cert-manager)

    • Allows automatic cert management using LetsEncrypt
      • For this, the Platform needs a public IP and correct DNS setup
    • Providing certificates manually is also possible