1. Overview¶
Version: 1.1
Date: 2026-06-30
Status: Draft for Review
Classification: Internal — Architecture
1.1 Executive Summary¶
7KGroup is building a Platform Team as a Service (PTaaS) offering called Inari. Each client receives a dedicated, pre-built Internal Developer Platform (IDP) running on their own Kubernetes cluster, managed by 7KGroup.
The platform is based on the CNOE (Cloud Native Operational Excellence) reference architecture, extended with 7KGroup's proprietary abstractions.
Core principle: Reusability over customization. We ship versioned platform baselines, not bespoke consulting engagements.
1.2 Hub-and-Spoke Model¶
7k-inari is the fleet hub repository. It consumes reusable artifacts from two existing repositories:
| Repository | Role | Consumption Pattern |
|---|---|---|
github.com/7kgroup/hiroba-catalog |
Golden XRDs and compositions | ArgoCD Application pinned to a release |
github.com/7kgroup/workflows |
Reusable GitHub Actions | Called from .github/workflows/ |
1.3 Target Architecture Summary¶
┌─────────────────────────────────────────────────────────────┐
│ 7k-inari Git Repository │
│ (Central source of truth: baseline + client overlays) │
│ │
│ ┌─────────────────────────────────────────────────────┐ │
│ │ clients/ │ │
│ │ ├── _templates/base/ ← shared Inari baseline │ │
│ │ └── <client-id>/ ← per-client overlay │ │
│ └─────────────────────────────────────────────────────┘ │
└─────────────────────────────────────────────────────────────┘
▲ ▲
│ pull baseline + overlay │ pull Hiroba catalog
│ │
┌───────┴─────────────────────────────────────────────────────┐
│ Client A Control Plane (Physical Cluster) │
│ │
│ ┌─────────┐ ┌─────────┐ ┌─────────┐ ┌───────────────┐ │
│ │Backstage│ │Crossplane│ │ ArgoCD │ │ Grafana │ │
│ │ (IDP UI)│ │(Workload)│ │(GitOps) │ │ Alloy │ │
│ └────┬────┘ └─────────┘ └────┬────┘ │ (DaemonSet) │ │
│ │ │ └───────────────┘ │
│ │ OIDC │ Remote Write / Log Push │
│ ▼ ▼ mTLS + X-Scope-OrgID │
│ ┌─────────┐ ┌───────────────────────────┐ │
│ │ Dex │ ← Connectors │ 7KGroup Management Plane │ │
│ └─────────┘ Client IdP │ (Self-hosted K8s on BM) │ │
│ │ │ │
│ ┌─────────┐ ┌─────────┐ │ ┌─────────┐ ┌───────────┐ │ │
│ │ Hiroba │ │ Cloud │ │ │ Crossplane│ Mimir │ │ │
│ │ Catalog │ │ Factory │ │ │(Cluster) │ │ Loki │ │ │
│ │(XRDs) │ │ (XRD) │ │ │ Vault │ │ Grafana │ │ │
│ └─────────┘ └─────────┘ │ │ Keycloak │ │ ArgoCD │ │ │
│ ▲ │ └─────────┘ └───────────┘ │ │
│ │ provisions └─────────────────────────────┘ │
│ │
│ ┌─────────┐
│ │ Cloud │
│ │ Account │
│ │(AWS/GCP/Azure)
│ └─────────┘
1.4 Component Matrix¶
| Component | Location | Purpose | Technology |
|---|---|---|---|
| Backstage | Client CP | Developer Portal / IDP UI | CNOE Backstage + 7KGroup plugins |
| Crossplane (workload) | Client CP | Workload infrastructure (RDS, S3, etc.) | Upbound providers + Hiroba compositions |
| ArgoCD | Client CP | In-cluster GitOps delivery (installed by mgmt plane, configured by overlay) | ArgoCD (CNOE baseline) |
| Dex | Client CP | SSO / OIDC federation | Dex (replaces Keycloak) |
| Alloy | Client CP | Metrics/logs/traces collection | Grafana Alloy DaemonSet |
| OPA/Gatekeeper | Client CP | Policy enforcement | Gatekeeper (CNOE baseline) |
| Hiroba Catalog | Client CP | Cloud-agnostic XRDs | Crossplane XRDs + CDK8s compositions |
| Cloud Factory | Client CP | Cloud account provisioning (target state, post-v1) | Crossplane XRD + Terraform provider |
| ProviderConfigs | Client CP | Cloud credentials | Crossplane ProviderConfig per cloud |
| Read-only access | Client CP | Client transparency / audit | ServiceAccount + kubeconfig |
| Crossplane (control plane) | Mgmt Plane | Client account, VPC, EKS, IAM, node groups, ArgoCD install | Upbound providers |
| ArgoCD | Mgmt Plane | Management-plane internal GitOps only | ArgoCD (self-managed) |
| Vault | Mgmt Plane | mTLS CA + secret store | HashiCorp Vault |
| Mimir | Mgmt Plane | Metrics aggregation | Grafana Mimir |
| Loki | Mgmt Plane | Log aggregation | Grafana Loki |
| Grafana | Mgmt Plane | Fleet dashboards | Grafana Enterprise or OSS |
| Keycloak | Mgmt Plane | Fallback identity directory | Keycloak (OIDC) |
See decisions for the full Architecture Decision Records behind this design.