Platform layers

Shared platform services

This architecture view connects the services that provide ingress, certificate management, secret delivery, persistent storage, metrics, traces, and logs for Kubernetes workloads.

Open the interactive shared-services architecture

The diagram reflects the service description and the current declarative repositories. Two findings remain explicit rather than being inferred away:

• the service description names Loki but does not define the downstream log backend topology;

• the current Fluent Bit repository credential points to the Cert Manager repository URL and should be reviewed.

Observability

The Prometheus production architecture covers metric discovery and scraping, Prometheus persistence, Alertmanager routing, Grafana access and LDAP, Vault-sourced secrets, and the additional Tempo, staging, and Kasten data sources used by Grafana.

Open the interactive Prometheus production architecture

The production stack uses kube-prometheus-stack and Ceph RBD persistence for Prometheus and Alertmanager.

Storage

The production storage view follows persistent claims through the Ceph RBD and NFS CSI drivers to their external data systems. It also shows the CSI snapshot API, snapshot controller, Kasten-enabled snapshot classes, and Vault-backed Ceph credentials.

Open the interactive production storage architecture

Ceph RBD is the default production class with Delete reclaim policy; NFS provides retained shared storage.