Portal Architecture
In Development
This feature is currently in development. Architecture described here is subject to change.
Purpose: For platform engineers and architects, explains the portal's technical architecture — how requests flow from UI to running infrastructure through GitOps.
Architecture Overview
Components
| Component | Role | Technology |
|---|---|---|
| Portal UI | Web interface for developers | React + Headlamp plugin |
| Portal API | Request validation and Git operations | Go service |
| Policy Engine | Quota checks, approval routing | Kyverno + custom admission |
| Git Backend | Source of truth for all provisioned resources | Customer GitOps repo |
| FluxCD | Reconciles Git state to cluster | Standard openCenter FluxCD |
Request Lifecycle
- Authenticate — User authenticates via Keycloak OIDC
- Authorize — Portal checks team membership and RBAC permissions
- Validate — Request checked against quotas and policy constraints
- Approve (if required) — Elevated requests route to approvers
- Commit — Portal writes CRD manifest to team's Git repository
- Reconcile — FluxCD detects change and creates Kubernetes resources
- Notify — Portal reports provisioning status to the requester
Integration Points
- Keycloak: SSO, team membership, role-based access
- Kyverno: Resource validation at admission time
- FluxCD: GitOps reconciliation (no direct API calls to cluster)
- Prometheus: Usage metrics for quota enforcement
- Headlamp: Portal UI embedded as Headlamp plugin