Infrastructure Overview¶

The WebGrip platform is built on a Kubernetes-based infrastructure that provides a scalable, secure, and observable foundation for application development and deployment.

Infrastructure Philosophy¶

Our infrastructure follows these core principles:

• 🏗️ Infrastructure as Code: All infrastructure defined in version-controlled Helm charts
• 🔒 Security by Default: Security controls built into every layer of the stack
• 📊 Observable by Design: Comprehensive monitoring and logging across all components
• ⚡ Self-Service: Developers can deploy and manage applications independently
• 🔄 GitOps: All changes flow through Git workflows with proper review and automation

Platform Stack¶

Container Orchestration¶

Technology: Kubernetes Configuration: catalog/systems/kubernetes.yaml

Kubernetes provides the foundation for container orchestration, offering:

• Pod Management: Automated deployment, scaling, and health management
• Service Discovery: Built-in DNS and service mesh capabilities
• Resource Management: CPU, memory, and storage allocation and limits
• Security Isolation: Namespace-based multi-tenancy and network policies

Package Management¶

Technology: Helm Configuration: ops/helm/

Helm manages Kubernetes application deployments through templated charts:

📋 Chart Naming Convention: Charts are numbered to indicate deployment order and dependencies. Lower numbers deploy first.

Cloud Infrastructure¶

Provider: AWS (Amazon Web Services) Cluster: DigitalOcean Kubernetes (DOKS) Configuration: catalog/resources/staging-doks-cluster.yaml

The platform currently runs on a DigitalOcean Kubernetes cluster with AWS integrations for:

• Identity & Access: AWS IAM integration for access control
• Container Registry: AWS ECR for container image storage
• Backup & Recovery: AWS S3 for persistent volume backups
• External Services: AWS services for extended platform capabilities

Infrastructure Components¶

Core Platform Services¶

Component Details¶

Infrastructure Automation¶

GitOps Workflow¶

All infrastructure changes follow a GitOps workflow:

Deployment Automation¶

Workflow: .github/workflows/on_source_change.yml

Infrastructure deployments are automated through GitHub Actions:

1. Validation: Helm chart linting and security scanning
2. Staging: Deploy to staging environment for validation
3. Production: Deploy to production with manual approval gates
4. Verification: Automated health checks and rollback on failure

Secret Management¶

Technology: SOPS + Age Configuration: ops/secrets/

Secrets are encrypted at rest and managed through:

• Encryption: Age-based encryption with public key distribution
• Access Control: Role-based access to decrypt specific secret categories
• Audit Trail: All secret changes tracked in Git history
• Rotation: Structured processes for secret rotation and distribution

Secret Categories: - 007-kube-prometheus-stack-secrets: Monitoring credentials - 010-cert-manager-secrets: Certificate authority credentials
- 030-ingress-controllers: Ingress configuration secrets - 045-gha-runners-secrets: CI/CD runner credentials - 060-grafana-stack: Dashboard and alerting credentials

Infrastructure Requirements¶

Prerequisites¶

To work with this infrastructure, you need:

1
2

# Required tools (from README.md)
brew install awscli kubectl helm terraform age sops kubectx derailed/k9s/k9s

Access Requirements: - AWS CLI configured with appropriate permissions - kubectl access to the staging cluster - Age key for secret decryption (for authorized personnel) - GitHub repository access for GitOps workflows

Local Development Setup¶

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

# Configure AWS and cluster access
aws configure
aws eks update-kubeconfig --name staging-eks-cluster --region eu-west-1

# Verify cluster connectivity
kubectl get nodes

# Access platform dashboards
make view-grafana    # Grafana dashboards
make view-traefik    # Traefik dashboard

🔧 Makefile Commands: All operational commands are documented in the Makefile with targets for common tasks.

Infrastructure Monitoring¶

Health Indicators¶

The platform monitors key infrastructure health metrics:

Alerting¶

Critical infrastructure alerts are configured for:

• Cluster Resource Exhaustion: CPU, memory, and storage thresholds
• Component Health: Platform service availability and response times
• Security Events: Certificate expiry, authentication failures
• Performance Degradation: Latency and error rate thresholds

Next Steps¶

Dive deeper into specific infrastructure areas:

🏗️ Infrastructure Evolution: Infrastructure changes follow our Architecture Decision Records (ADRs). Significant infrastructure modifications require an ADR and stakeholder review.