# Platform layers

## Shared platform services

This architecture view connects the services that provide ingress, certificate
management, secret delivery, persistent storage, metrics, traces, and logs for
Kubernetes workloads.

<a class="archify-open"
   href="../_static/archify/kubernetes/layers/shared-services.html"
   target="_blank" rel="noopener">Open the interactive shared-services architecture</a>

<iframe
  class="archify-frame archify-frame--architecture"
  src="../_static/archify/kubernetes/layers/shared-services.html"
  title="Kubernetes shared platform services architecture"
  loading="lazy"
  allowfullscreen>
</iframe>

The diagram reflects the service description and the current declarative
repositories. Two findings remain explicit rather than being inferred away:

- the service description names Loki but does not define the downstream log
  backend topology;
- the current Fluent Bit repository credential points to the Cert Manager
  repository URL and should be reviewed.

## Observability

The Prometheus production architecture covers metric discovery and scraping,
Prometheus persistence, Alertmanager routing, Grafana access and LDAP,
Vault-sourced secrets, and the additional Tempo, staging, and Kasten data
sources used by Grafana.

<a class="archify-open"
   href="../_static/archify/kubernetes/layers/observability/prometheus-production.html"
   target="_blank" rel="noopener">Open the interactive Prometheus production architecture</a>

<iframe
  class="archify-frame archify-frame--architecture"
  src="../_static/archify/kubernetes/layers/observability/prometheus-production.html"
  title="Prometheus production observability architecture"
  loading="lazy"
  allowfullscreen>
</iframe>

The production stack uses `kube-prometheus-stack` and Ceph RBD persistence for
Prometheus and Alertmanager.

## Storage

The production storage view follows persistent claims through the Ceph RBD and
NFS CSI drivers to their external data systems. It also shows the CSI snapshot
API, snapshot controller, Kasten-enabled snapshot classes, and Vault-backed
Ceph credentials.

<a class="archify-open"
   href="../_static/archify/kubernetes/layers/storage/production-storage.html"
   target="_blank" rel="noopener">Open the interactive production storage architecture</a>

<iframe
  class="archify-frame archify-frame--architecture"
  src="../_static/archify/kubernetes/layers/storage/production-storage.html"
  title="Kubernetes production storage architecture"
  loading="lazy"
  allowfullscreen>
</iframe>

Ceph RBD is the default production class with `Delete` reclaim policy; NFS
provides retained shared storage.