Open source · Apache-2.0 · runs on your own AWS or GCP account

An opinionated, production-ready Kubernetes platform, built on GitOps

Bootstrap a complete platform on your own AWS or GCP account in about thirty minutes — built entirely from open-source, cloud-native tools. It follows platform-engineering and security best practices from the first commit: everything as code and reconciled from Git, zero-trust networking, least-privilege identity, secrets never stored in the repository, and a paved road that takes developers from a few lines of YAML to a production-ready application.

Deploy in 30 minutes View on GitHub

The whole platform, on one page

Platform architecture: the cloud’s managed services on the left with their AWS and GCP equivalents, the Kubernetes cluster in four tiers, and the applications and data stores on top

What's here

Get Started

Three sequential stages — network, secrets, Kubernetes — driven by OpenTofu and Terramate. Two commands on either cloud, and the cluster comes up with Cilium and Flux already reconciling.

Platform

Cilium, Flux, Crossplane, OpenBao, VictoriaMetrics, Gateway API, Karpenter, KEDA — each with what it actually buys you here, and what it cost to adopt.

Concepts

GitOps as a dependency hierarchy rather than a slogan. Progressive complexity in a platform API. Zero trust that is enforced by policy, not asserted in a README.

Guides

Fork and adapt, add an application, add a cloud provider, troubleshoot — including what to strip out and roughly what it costs to run.

Reference

Repository layout, the technology stack and what each piece is responsible for, commands, CI, the platform constitution.

Decisions

An architecture decision record for every consequential choice — what was chosen, what it was chosen over, and the cost that came with it.

Built with

Every component, its version, and where that version is pinned: Technology Stack.

Runs on AWS EKS and GCP GKE from one repository and one Flux tree — not a fork each. The two lanes share every Kubernetes-layer component and diverge only where the clouds do; see Cloud support for the side-by-side, and ADR-0007 for where the platform refuses to pretend they are the same.