People enter at the ingress. Argo CD is what places each app. SQL, search, and metrics are the three stores the report reads.
Every browser address
Names are https://<app>.kendops.io. They resolve from this machine's hosts file to the ingress load balancer. The certificate is issued by the KendOps local CA until a public DNS zone exists. Keycloak signs in Argo CD, Grafana, GitLab, Harbor, and Mattermost. Each of those still has its local admin. Products that cannot keep both stay on their own login.
Nothing in the inventory matches that filter.
Longhorn is in the catalog. This staging copy uses local-path, so that address is not the volume provider. There is no sign-in proxy. NVIDIA NeMo is not installed: these instances have no GPU.
Services that stay inside the cluster
These are installed and have no browser of their own. Addresses are cluster DNS.
| Service | Address |
|---|---|
| Data | |
| PostgreSQL | postgresql.postgresql.svc:5432 |
| Cassandra | cassandra.cassandra.svc:9042 |
| Kafka brokers | kafka-0.kafka.kafka.svc:9092 |
| Elasticsearch | https://elasticsearch-es-http.elastic.svc:9200 |
| OpenSearch | https://opensearch-cluster-master.opensearch.svc:9200 |
| Platform | |
| ingress-nginx | RKE2 host ports 80 and 443 |
| cert-manager | cert-manager.cert-manager.svc |
| CoreDNS | kube-dns.kube-system.svc:53 |
| Cilium | kube-system |
| Envoy Gateway | envoy-gateway.envoy-gateway-system.svc |
| Istiod | istiod.istio-system.svc:15014 |
| Dex | argocd-dex-server.argocd.svc |
| GitLab runner | gitlab-runner.gitlab.svc |
| GitLab agent | gitlab-agent.gitlab.svc |
| Volcano | volcano-scheduler.volcano-system.svc |
| k6 operator | k6-operator.k6.svc |
| KEDA | keda-operator.keda.svc |
| Karpenter | karpenter.karpenter.svc. The pool cap is 0 CPUs, so it does not buy servers. |
| Cluster healer | cluster-healer.monitoring.svc. Restarts a crash-looping stateless pod after three crashes, then waits 15 minutes. |
| Velero | velero.velero.svc |
| BuildKit | buildkit.buildkit.svc:1234 |
| Security | |
| Gatekeeper | gatekeeper-webhook-service.gatekeeper-system.svc |
| Kyverno | kyverno-svc.kyverno.svc |
| Trivy | trivy-operator.trivy.svc:80 |
| Observability | |
| Grafana Alloy | alloy.monitoring.svc |
| OpenTelemetry collector | otel-collector.monitoring.svc:4317 |
| Filebeat | filebeat.elastic.svc |
| Logstash | logstash-logstash.elastic.svc:5044 |
| Fluent Bit | fluent-bit.monitoring.svc |
| Fluentd | fluentd.opensearch.svc |
| Vector | vector.monitoring.svc |
| Data Prepper | data-prepper.opensearch.svc:2021 |
What an executive opens
These boards are installed with the cluster. Drop another JSON file in platform/modules/gitops/dashboards and the next apply publishes it. No dashboard is edited by hand in the UI.
| Board | Question it answers | URL |
|---|---|---|
| Executive overview | Are nodes up, is capacity healthy, how much of the mesh is mTLS, are users seeing 5xx? | grafana.kendops.io/d/kendops-executive |
| Service mesh | Request rate, p95 latency, error ratio, TCP connections, mTLS versus plaintext, Istio access log. | grafana.kendops.io/d/kendops-mesh |
| GitLab and runner | GitLab CPU and memory, runner job metrics, and every GitLab log line. | grafana.kendops.io/d/kendops-gitlab |
| Access and central logs | Who is connecting, ingress latency, and the log stream for any namespace. | grafana.kendops.io/d/kendops-access |
Kiali shows the mesh graph at kiali.kendops.io. Kibana remains the Elasticsearch view. Grafana is the single pane for metrics, Loki logs, and Tempo traces.
How the signals meet
| Signal | Path | Where it is read |
|---|---|---|
| CPU, memory, disk, network | node-exporter, kube-state-metrics, cAdvisor | Executive overview |
| Every pod log, including GitLab and the runner | Grafana Alloy to Loki | GitLab board and central log stream |
| Search index | Filebeat to the Elasticsearch ingest pipeline logs-kendops | Kibana application operations |
| Service calls | Istio sidecar metrics, scraped by Prometheus | Service mesh board and Kiali |
| Access connections | ingress-nginx metrics and Istio JSON access logs | Access board |
| Traces | Istio samples 10 percent to the OpenTelemetry collector, then Tempo | Tempo data source in Grafana |
| GitLab process and runner metrics | Prometheus scrapes GitLab ports and the runner ServiceMonitor | GitLab board |
What Istio is doing
Application namespaces, including Atlas, Remnant, the command center, campus, and this inventory, join the mesh. Istio writes a JSON access log on every meshed call, exports request and TCP metrics for Prometheus, and sends a sample of traces to Tempo. Alloy and Filebeat already read every pod log, and the Elasticsearch pipeline names each application. Monitoring, OpenSearch, and Elastic stay out of the mesh so the collectors are not scraping themselves through a sidecar. Peer authentication is PERMISSIVE so those collectors can still reach meshed applications.
Controls this stack actually implements
This page is an architecture evidence package. It is not an authorization to operate, and it does not claim a federal accreditation.
| Family | What is in the platform |
|---|---|
| Access control | Keycloak realm kendops is the identity provider. Argo CD, Grafana, GitLab, Harbor, and Mattermost use it and still keep a local admin. Products that cannot keep both, including SonarQube, Jira, Confluence, and the static sites, stay on their own login. |
| Audit | Alloy keeps a central log in Loki. Filebeat keeps a second copy in Elasticsearch. Istio access logs record meshed connections. Ingress metrics record every published request. |
| Configuration management | Terragrunt builds the network and the cluster. Argo CD is the only deployer. Dashboards and mesh policy are files in Git. |
| System integrity | OPA Gatekeeper audits privileged containers. Falco watches runtime behavior. Trivy scans workloads. Kyverno can audit image signatures when a cosign key is set. |
| System and communications protection | TLS on every ingress. Istio mutual TLS for meshed traffic. Encrypted volumes. IMDSv2 on the nodes. |
| Contingency | Velero backs cluster state up to S3. Longhorn keeps two volume replicas when it is the storage class. This staging copy uses local-path. |
Capacity of this staging copy
Staging is one control plane and four workers, each an m7i-flex.large, which is the largest x86 size this account will launch. Jira and Confluence use the standalone PostgreSQL service in the cluster, not a database bundled inside either chart. Draw at draw.kendops.io is the diagram editor. The same modules run production. Production changes the instance size, the server count, and the data replica count in platform/live/prod/env.hcl.
A public name still has to be registered outside this account. Until the Route 53 zone id is set, the ingress load balancer address is the way to reach the boards.
Ask the inventory
Questions are answered from the rows on this page. The browser's on-device model is used when it exists. Otherwise the answer is the matching published rows.