Cloud Native Platform Reference

An opinionated, production-ready Kubernetes platform using GitOps principles.

A reference implementation of a complete cloud-native platform on AWS EKS: infrastructure as code with OpenTofu and Crossplane, continuous delivery with Flux, a private PKI and zero-trust networking, a full observability stack, and a developer-facing abstraction that turns one small YAML claim into a whole application.

📖 Full documentation: cnref.ogenki.io

Architecture

Editable source: docs/architecture/platform-overview.drawio

Three bands: AWS managed services on the left (Route 53, ELB, IAM via EKS Pod Identity, S3, KMS), the EKS cluster in the centre in four tiers (GitOps & composition, compute & networking, security & identity, observability), and applications & data on the right. Flux reconciles the repository; Tailscale provides private access; OpenBao holds the secrets and the PKI. The self-hosted LLM platform is opt-in and off by default.

Every subsystem is explained at cnref.ogenki.io/docs/platform.

Quickstart

Roughly 30 minutes end to end. You need an AWS account with admin permissions, a registered domain in Route53, a Tailscale account, and a GitHub App or token for Flux. Full prerequisites and the annotated walkthrough are in Get Started.

# 1. Point the platform at your environment
$EDITOR opentofu/config.tm.hcl        # region, cluster name, domains, chart versions

# 2. Provide the one secret that is not in AWS Secrets Manager
export TF_VAR_tailscale_api_key=<your-tailscale-api-key>

# 3. Network, then OpenBao (~15 min)
cd opentofu && terramate script run deploy

# 4. EKS — two stages: cluster on a temporary CNI, then Cilium + Flux (~15 min)
cd eks/init && terramate script run deploy

# 5. Get a kubeconfig
aws eks update-kubeconfig --region eu-west-3 --name mycluster-0

# 6. Watch Flux build the rest of the platform
flux get all

Flux takes over from there: security (External Secrets, cert-manager, Kyverno), infrastructure (Cilium, Gateway API, ExternalDNS, Karpenter), observability (VictoriaMetrics, VictoriaLogs, Grafana) and tooling (Harbor, Headlamp, Homepage).

Documentation

Full documentation — deploy guides, platform internals, concepts, and the architecture decision records — is published at cnref.ogenki.io.

• Get Started — deploy the platform in about 30 minutes
• Platform — every domain, what runs and why
• Concepts — the ideas the platform is built on
• Guides — fork and adapt, add an application, troubleshoot
• Reference — technology stack, commands, repository layout
• Decisions — what was chosen, and what over

The blog posts that explain several of these components in long form are collected under Further reading.

Repository Structure

.
├── opentofu/                      # 🔧 Infrastructure as Code
│   ├── network/                   # VPC, Tailscale VPN
│   ├── openbao/                   # Secrets management and PKI
│   └── eks/                       # Kubernetes cluster (two-stage)
│       ├── init/                  # Stage 1: EKS + bootstrap addons
│       └── configure/             # Stage 2: Cilium + Flux
├── flux/                          # 🚀 Flux operator and configuration
├── clusters/mycluster-0/          # Cluster-specific Kustomizations
├── infrastructure/                # 🏗️ Platform infrastructure
├── security/                      # 🔒 Security components
├── observability/                 # 👁️ Monitoring and logging
├── tooling/                       # 🛠️ Platform tools
├── apps/                          # 📦 Applications, as App claims
├── crds/                          # Custom Resource Definitions
├── website/                       # 📚 The documentation site (Hugo + Hextra)
├── docs/                          # Architecture diagrams, specs, design artifacts
└── scripts/                       # Automation and validation

AI-Assisted Development

This repository leverages a coding agent for code generation, troubleshooting, and documentation. CLAUDE.md provides project context and platform-specific knowledge. Non-trivial changes go through the Superpowers workflow — a design document is brainstormed and approved, turned into an implementation plan, then executed task by task, with every artifact committed under docs/superpowers/. A platform constitution states the non-negotiable rules every design is checked against. The agent also integrates with observability tools via MCP servers (VictoriaMetrics, VictoriaLogs, Flux) for real-time debugging directly from the development environment.

Contributing and Community

We welcome contributions, feedback, and questions!

• 🗨️ Slack Channel: Chat with the community
• 💬 Discussions: Ideas, questions, roadmap
• 🐛 Issues: Bug reports and feature requests
• 📅 Project Board: Task tracking and priorities

Before contributing: Review SECURITY.md for security policy and CLAUDE.md for development guidelines.

License

This project is provided as a reference implementation. Please review individual component licenses.

Acknowledgments

This platform builds on the excellent work of many open-source projects:

• Crossplane team and community
• Flux maintainers and CNCF
• Cilium and eBPF ecosystem
• VictoriaMetrics developers
• OpenBao and Linux Foundation
• All the maintainers of the tools in this stack

---

Ready to get started? → cnref.ogenki.io/docs/get-started

Questions? → Join our Slack