|
| 1 | +--- |
| 2 | +title: Platform Abstractions |
| 3 | +description: Platform abstractions for managing infrastructure |
| 4 | +--- |
| 5 | + |
| 6 | +# Platform Abstractions |
| 7 | + |
| 8 | +Platform abstractions in OpenChoreo provide the foundational infrastructure layer that platform engineers use to build |
| 9 | +and manage Internal Developer Platforms. These abstractions establish organizational boundaries, manage infrastructure |
| 10 | +resources, and define the operational policies that enable developer self-service while maintaining security and |
| 11 | +compliance. |
| 12 | + |
| 13 | +## Organization |
| 14 | + |
| 15 | +The **Organization** represents the highest level of tenancy in OpenChoreo, serving as the root container for all |
| 16 | +platform resources. It establishes the fundamental isolation boundary between different business units, teams, or |
| 17 | +customers in a multi-tenant platform. |
| 18 | + |
| 19 | +Organizations provide complete resource isolation through dedicated Kubernetes namespaces, ensuring that resources, |
| 20 | +configurations, and workloads from different organizations never interact. This isolation extends beyond simple |
| 21 | +namespace separation to include network policies, RBAC rules, and resource quotas, creating a secure multi-tenant |
| 22 | +environment. |
| 23 | + |
| 24 | +Each organization maintains its own set of platform resources, application resources, and runtime configurations. This |
| 25 | +hierarchical structure enables platform teams to manage multiple independent tenants on the same OpenChoreo |
| 26 | +installation, each with their own governance policies, resource limits, and operational procedures. |
| 27 | + |
| 28 | +## Infrastructure Planes |
| 29 | + |
| 30 | +OpenChoreo separates infrastructure concerns into specialized planes, each serving a distinct purpose in the platform |
| 31 | +architecture. This separation enables independent scaling, security isolation, and operational management of different |
| 32 | +platform functions. |
| 33 | + |
| 34 | +### DataPlane |
| 35 | + |
| 36 | +A **DataPlane** represents a Kubernetes cluster where application workloads run. It abstracts the complexity of cluster |
| 37 | +management, providing a unified interface for deploying applications across multiple clusters regardless of their |
| 38 | +location or underlying infrastructure. |
| 39 | + |
| 40 | +DataPlanes encapsulate all the configuration needed to connect to and manage a Kubernetes cluster, including connection |
| 41 | +credentials, TLS certificates, and cluster-specific settings. They enable platform teams to register multiple clusters - |
| 42 | +whether on-premises, in public clouds, or at edge locations - and manage them through a single control plane. |
| 43 | + |
| 44 | +Each DataPlane can host multiple environments and projects, with OpenChoreo managing the creation of namespaces, network |
| 45 | +policies, and other cluster resources automatically. This abstraction allows platform teams to treat clusters as |
| 46 | +interchangeable infrastructure resources, enabling strategies like geographic distribution, compliance-based placement, |
| 47 | +and disaster recovery. |
| 48 | + |
| 49 | +### BuildPlane |
| 50 | + |
| 51 | +A **BuildPlane** provides dedicated infrastructure for executing continuous integration and build workloads. By |
| 52 | +separating build operations from runtime workloads, BuildPlanes ensure that resource-intensive compilation and testing |
| 53 | +processes don't impact production applications. |
| 54 | + |
| 55 | +BuildPlanes integrate with Argo Workflows to provide a scalable, Kubernetes-native CI/CD execution environment. They |
| 56 | +handle the complete build lifecycle, from source code retrieval through compilation, testing, and container image |
| 57 | +creation. This separation also provides security benefits, isolating potentially untrusted build processes from |
| 58 | +production environments. |
| 59 | + |
| 60 | +Platform engineers configure BuildPlanes with the necessary tools, credentials, and policies for building applications. |
| 61 | +This includes container registry credentials, build tool configurations, and security scanning policies. BuildPlanes can |
| 62 | +be scaled independently based on build demand and can be distributed geographically to reduce latency for development |
| 63 | +teams. |
| 64 | + |
| 65 | +### Observability Plane |
| 66 | + |
| 67 | +The **Observability Plane** provides centralized logging infrastructure for the entire platform. It collects and |
| 68 | +aggregates logs from all other planes - Control, Data, and Build - providing a unified view of platform operations and |
| 69 | +application behavior. |
| 70 | + |
| 71 | +Built on OpenSearch, the Observability Plane offers full-text search capabilities and log retention management. The |
| 72 | +Observer API provides authenticated access to log data, enabling integration with external monitoring tools and |
| 73 | +dashboards. Unlike other planes, the Observability Plane has no custom resources to manage - it operates independently |
| 74 | +after initial setup, receiving log streams from Fluentbit agents deployed across the platform. |
| 75 | + |
| 76 | +Platform engineers configure the Observability Plane once during initial setup, establishing log collection pipelines, |
| 77 | +retention policies, and access controls. This centralized approach ensures that all platform activity is auditable and |
| 78 | +debuggable while maintaining security boundaries between organizations. |
| 79 | + |
| 80 | +## Environment |
| 81 | + |
| 82 | +An **Environment** represents a stage in the software delivery lifecycle, such as development, staging, or production. |
| 83 | +Environments provide the context for deploying and running applications, defining the policies, configurations, and |
| 84 | +constraints that apply to workloads in that stage. |
| 85 | + |
| 86 | +Environments are not just labels or namespaces - they are first-class abstractions that define where applications |
| 87 | +should be deployed (which DataPlane) and serve as targets for deployment pipelines. This abstraction enables platform |
| 88 | +teams to organize different stages of the delivery pipeline. |
| 89 | + |
| 90 | +Each environment represents a distinct deployment target. Development environments might target smaller clusters or |
| 91 | +shared infrastructure, while production environments target dedicated, high-availability clusters. The Environment |
| 92 | +resource primarily defines the mapping to infrastructure (DataPlane) and serves as a reference point for deployments |
| 93 | +and promotion workflows. |
| 94 | + |
| 95 | +## DeploymentPipeline |
| 96 | + |
| 97 | +A **DeploymentPipeline** defines the allowed progression paths for applications moving through environments. It |
| 98 | +represents the organization's software delivery process as a declarative configuration, encoding promotion rules, |
| 99 | +approval requirements, and quality gates. |
| 100 | + |
| 101 | +DeploymentPipelines go beyond simple environment ordering to define complex promotion topologies. They can specify |
| 102 | +parallel paths for different types of releases and conditional progressions based on application characteristics. |
| 103 | +This flexibility allows organizations to implement sophisticated delivery strategies while maintaining governance and |
| 104 | +control. |
| 105 | + |
| 106 | +The pipeline abstraction also serves as an integration point for organizational processes. Manual approval gates can be |
| 107 | +configured for sensitive environments, automated testing can be triggered at promotion boundaries, and compliance checks |
| 108 | +can be enforced before production deployment. This ensures that all applications follow organizational standards |
| 109 | +regardless of which team develops them. |
| 110 | + |
| 111 | +## Class System |
| 112 | + |
| 113 | +OpenChoreo implements the standard Kubernetes Class pattern, similar to GatewayClass or StorageClass, enabling platform |
| 114 | +engineers to define platform-level abstractions that developers consume through their applications. |
| 115 | + |
| 116 | +### The Class Pattern |
| 117 | + |
| 118 | +Classes are platform-level resources that encode organizational standards, best practices, and governance policies. |
| 119 | +Platform engineers create Classes for different workload types - ServiceClass for backend services, WebApplicationClass |
| 120 | +for frontend applications, and ScheduledTaskClass for batch jobs. Each Class defines the platform standards that |
| 121 | +applications must follow when claiming these resources. |
| 122 | + |
| 123 | +Just as GatewayClass defines infrastructure capabilities that Gateway resources consume, or StorageClass defines how |
| 124 | +storage should be provisioned when a PersistentVolumeClaim is created, ServiceClass defines how services should be |
| 125 | +deployed when developers create Service resources. This pattern provides a clean separation between platform |
| 126 | +capabilities (defined by platform engineers) and application requirements (expressed by developers). |
| 127 | + |
| 128 | +### Class Consumption |
| 129 | + |
| 130 | +When developers create application resources like Service or WebApplication, they reference the appropriate Class, |
| 131 | +similar to how a PersistentVolumeClaim references a StorageClass. The platform uses the Class definition to provision |
| 132 | +the actual workload with the correct configuration, policies, and governance rules. |
| 133 | + |
| 134 | +Environment-specific Bindings act as the instantiation of this claim in a specific environment. While the Service |
| 135 | +resource expresses the developer's intent and references a ServiceClass, the ServiceBinding represents the actual |
| 136 | +deployment of that service in a particular environment with environment-specific overrides. |
| 137 | + |
| 138 | +This consumption model balances standardization with flexibility. Platform teams maintain control over critical |
| 139 | +configurations through Classes while developers express their requirements through simple resource definitions. The |
| 140 | +platform handles the complex mapping between developer intent and infrastructure reality. |
| 141 | + |
| 142 | + |
0 commit comments