Skip to main content

Architecture

Orientation for the platform's structure. Detailed pages land here as they are written.

The two repositories​

binero-clusters owns everything below Kubernetes: OpenTofu roots per cluster (clusters/<name>/) create the OpenStack network, Talos machines, the API load balancer, S3 buckets and credentials. Talos machine configuration — including the kubelet, API server flags (OIDC) and bootstrap manifests — is declared here and pushed live with tofu apply.

binero-platform owns everything on Kubernetes. Its core invariant: rendered/ is exactly what the sources produce. CI re-renders every MR and fails on drift, so the rendered diff in review is the deployment.

Cluster anatomy​

Each cluster is three controlplanes + workers on OpenStack (Binero), Cilium as CNI with default-deny network posture (every namespace gets an isolation policy; every flow beyond it is an explicit CiliumNetworkPolicy), a single envoy gateway (kgateway) terminating TLS for all exposed hostnames, dex as the SSO hub, and the observability stack (Prometheus, Loki, Alloy, Grafana).

To be written​

  • The render pipeline in detail (fact substitution, kustomize post-processing, multi-chart apps)
  • Network policy model
  • Storage (cinder classes, NFS shared volumes, S3)