Kratix Ep 12: Production Reference Architecture

1. The Complete Reference Architecture

#

Below is the definitive reference architecture for a highly secure, massively scalable, multi-cluster IDP using the Kratix ecosystem.

graph TD
    %% Personas
    Developer["('Application Developer')"]
    PlatformTeam["('Platform Team')"]

    %% Frontend
    subgraph "Frontend / Portal"
        Backstage["Backstage (Web UI)"]
    end

    %% Hub Cluster
    subgraph "Platform Cluster (The Hub)"
        Kratix["Kratix Controller"]
        Promises["Promises (APIs)"]
        Pipelines["Pipeline Containers (Docker)"]
        PrometheusHub["Central Prometheus & Grafana"]
        
        Promises --> Pipelines
        Kratix --> Promises
    end

    %% Side Channels
    subgraph "Security & State"
        Vault["HashiCorp Vault"]
        GitState["Git State Store (GitHub)"]
    end

    %% Worker Clusters
    subgraph "Worker Cluster (The Spoke)"
        ArgoCD["ArgoCD / Flux"]
        ESO["External Secrets Operator"]
        Crossplane["Crossplane Controller"]
        RedisPod["Redis (Software Pod)"]
        PrometheusAgent["Prometheus Agent"]
        
        ArgoCD --> RedisPod
        ArgoCD --> Crossplane
        ESO --> RedisPod
    end

    %% Cloud Provider
    subgraph "AWS / GCP"
        RDSDatabase["Managed RDS / ElastiCache"]
    end

    %% Interactions
    Developer -- "1. Fills Web Form" --> Backstage
    Backstage -- "2. Generates YAML Claim" --> Kratix
    Pipelines -- "3. Writes Password" --> Vault
    Pipelines -- "4. Commits generated YAML" --> GitState
    ArgoCD -- "5. Pulls YAML via GitOps" --> GitState
    ESO -- "6. Fetches Password" --> Vault
    Crossplane -- "7. Provisions Cloud Hardware" --> RDSDatabase
    PrometheusAgent -- "8. Pushes Metrics" --> PrometheusHub
    PlatformTeam -- "Builds & Maintains" --> Promises

2. Tracing the Data Flow (The Grand Summary)

#

Let’s trace the data flow one final time through our complete system diagram:

1. The Request: An Application Developer logs into Backstage and fills out a web form requesting a Database.
2. The API: Backstage translates that form into a Kubernetes YAML Claim and applies it to the Platform Cluster.
3. The Orchestration: Kratix detects the Claim. It boots a Pipeline Container.
4. The Security: The script inside the Pipeline connects to HashiCorp Vault, generates a password, and stores it securely.
5. The Generation: The Pipeline script generates Kubernetes YAML (for the software) and Crossplane YAML (for the AWS hardware), and writes a pointer for the Vault secret.
6. The State Push: Kratix commits all of this YAML to the Git State Store.
7. The GitOps Pull: ArgoCD, running on the isolated Worker Cluster, pulls the YAML down and applies it locally.
8. The Execution: Crossplane reads the YAML and provisions the physical AWS database. ESO reads the pointer, logs into Vault, and injects the password into the cluster.
9. The Observability: The Prometheus Agent on the Worker cluster scrapes the status of all these components and pushes the data back to the central Grafana dashboard on the Platform Cluster.

3. Why This Architecture Wins

#

If you present this architecture to your CTO or Security Team, they will approve it for three undeniable reasons:

1. Impenetrable Security: The Platform Cluster has no SSH or API access to the Worker Clusters. The Worker Clusters pull their workloads via Git. Passwords are never committed to Git, eliminating credential leaks.
2. Infinite Scalability: Kratix is entirely asynchronous. If you need to deploy workloads to 1,000 edge clusters in retail stores across the country, Kratix simply commits 1,000 files to Git. The edge clusters pull them down when they have an internet connection.
3. Ultimate Developer Experience: The Application Developers never touch a terminal. They never learn Terraform. They simply click a button in Backstage, and months of complex Platform Engineering infrastructure magically assembles itself.

Conclusion

#

Thank you for completing the Kratix series. You are now equipped with the architectural knowledge to build an enterprise-grade Internal Developer Platform.

Platform Engineering is not about forcing developers to learn operations. It is about building intelligent vending machines. Kratix, combined with GitOps and Crossplane, provides the ultimate framework to build those machines. Happy building!