Architecture Documents

• Deployment
  • Some notes
    • Configuration
    • Firewall
• Requirements
  • Deployment
    • Mimick Kubeadm
    • Fully Offline
    • Fully Idempotent
    • Single-Server
    • Scale-Up from Single-Server Deployment
    • Installation == Upgrade
    • Rolling Upgrade
    • Handle CentOS Kernel Memory Accounting
    • At-Rest Encryption
    • Node Labels
    • Vagrant
  • Runtime
    • No Root
    • SELinux
    • Read-Only Containers
    • Environment
    • CRI
    • OIDC
  • Distribution
    • No Random Binaries
    • Tagged Generated Files
    • Container Images
  • Networking
    • Zero-Trust Networking: Transport
    • Zero-Trust Networking: Identity
    • Zero-Trust Networking: Certificate Scope
    • Zero-Trust Networking: Certificate TTL
    • Zero-Trust Networking: Offline Root CAs
    • Zero-Trust Networking: Host Firewall
    • Zero-Trust Networking: No Insecure Ports
    • Zero-Trust Networking: Overlay VPN (Optional)
    • DNS
    • Server Address Changes
    • Multi-Homed Servers
    • Availability of kube-apiserver
    • Provide LoadBalancer Services
    • Network Configuration: MTU
    • Network Configuration: IPIP
    • Network Configuration: BGP
    • IPv6
  • Storage
  • Batteries-Included
    • Metrics and Alerting: Prometheus
    • Node Monitoring: node_exporter
    • Node Monitoring: Platform
    • Node Monitoring: Dashboards
    • Logging
    • Container Registry
    • System Package Repository
    • Tracing Infrastructure (Optional)
    • Backups
• Continuous Testing
  • Pre-merge
  • Post-merge
    • Nightly
    • Weekly
  • Adaptive test plan