A subjective reference architecture for a production ready Kubernetes-based application platform.
Within each layer items are ordered chronologically. We recommend you fullfill items at the top of the list before making your way down, you may wish to skip some items at the end of each list depending on your own requirements.
Next to each list item we recommend between parenthesis "()" our goto
technology to implement this item, but it is a matter of preference, there are
multiple tools that can fullfill each requirement (the blessing and the curse of
the cloud-native landscape).
GoogleCloudPlatform/microservices-demo
- VPC
- Subnets
- IAM
- DNS
- Cluster
- NAT
- Gateway/Ingress
(
Ingress Nginx) - Secret Management
(
External Secret Operator) - Certificate Management (
Cert Manager) - Continous Delivery (
Argo CD) - Cluster Autoscaling
- Visualization (
Grafana) - Logging (
Grafana Loki) - Metrics (
Prometheus) - Auto-instrumented Tracing (
Pixie) - Tracing (
Grafana Tempo&Open Telemetry)
- Event-driven Autoscaling (
KEDA) - Optimized Cluster Autoscaling (
AWS:Karpenter) - Cost Monitoring (
OpenCost)
- Configuration Security (
Kyverno) - Image Security (
Trivy) - Cloud Security Posture
(
Prowler) - CIS Benchmarks (
Trivy) - Service Mesh (
Cilium) - Runtime Monitoring (
Falco) - MicroVM Isolation (
Firecracker)
- Workflows & Runbooks
(
Argo Workflows) - Service Catalog
- Cloud Resources (
Crossplane) - DNS (
External DNS) - Cluster Fleet (
Cluster APIorGardener)
- AWS (
Bottlerocket) - Anywhere (
Fedora CoreOS)