Skip to main content

Platform apps

The playbook for building and changing platform components. Detailed pages land here as they are written.

Anatomy of an app​

Every system component lives in apps/<name>/ in the platform repository:

  • source.yaml — the pinned upstream chart (repo + version). Renovate bumps the pin; the MR shows the rendered manifest diff.
  • values.yaml — the hardened configuration. Cluster facts are referenced as {{ .Cluster.<key> }} and substituted at render time.
  • chart/ — a local config chart for platform additions: priority class, extra manifests, anything the upstream chart cannot express.
  • policies/ — the app's CiliumNetworkPolicies: namespace isolation plus one explicit policy per flow.
  • kustomization.yaml (optional) — post-render patches, e.g. sync-wave and server-side-apply annotations on large CRDs.

Deployment identity lives in the registry (root/chart/values.yaml); which clusters run the app is each cluster's apps: map.

To be written​

  • Step-by-step: adding a new app
  • The SSO exposure pattern (oauth2-proxy + dex client registry)
  • CRD size limits and server-side apply
  • Webhook and hook-job network policy patterns