8. Pilot Scope (v1)
This section narrows the full Inari architecture to the first shippable milestone: a single pilot client on AWS with an EKS control plane.
8.1 Pilot Definition
| Attribute |
Choice |
| Cloud provider |
AWS |
| Client control plane |
EKS cluster |
| Cluster provisioning |
Crossplane running in management plane |
| Management plane hosting |
Self-hosted Kubernetes on bare metal |
| Identity provider |
Google Workspace |
| Fallback identity |
Keycloak (7KGroup internal) |
| Alloy authentication |
mTLS via Vault PKI |
| Backstage database |
PostgreSQL via Hiroba claim |
| Cost model |
Direct (client pays AWS) |
| Client kubectl access |
Read-only via ServiceAccount kubeconfig |
| Client read experience |
Backstage |
| Client GitOps |
Client-local ArgoCD pulling from github.com/7kgroup/7k-inari |
8.2 In Scope for v1
| Layer |
Components |
| Client control plane |
Single EKS cluster |
| Cluster provisioning |
Management-plane Crossplane creates AWS account boundary, VPC, EKS, IAM, node groups, ArgoCD install, and initial Application in client AWS account |
| Client bootstrap |
7KGroup injects ESO bootstrap secret into new client cluster |
| Identity |
Dex with Google Workspace connector + Keycloak fallback |
| Observability |
Alloy → Mimir + Loki over mTLS via Vault PKI |
| Catalog |
Hiroba catalog: PostgreSQL, Redis, S3 bucket XRDs |
| Backstage |
PostgreSQL-backed (via Hiroba RDS claim) with basic templates |
| Fleet hub |
Mimir, Loki, Grafana fleet dashboards, Keycloak, Vault, management-plane ArgoCD, management-plane Crossplane |
| Client-local GitOps |
Client ArgoCD (installed by mgmt plane) pulling from 7k-inari |
| Security |
Required labels, resource limits, allowed repos |
8.3 Out of Scope for v1
| Capability |
Deferred To |
| GCP and Azure client clusters |
Post-v1 |
| Cluster API fallback |
Post-v1 if Crossplane limitations arise |
| Microsoft Entra, GitHub, Okta, SAML Dex connectors |
Post-v1 |
| Tempo / distributed tracing |
Future enhancement |
| Cloud spend dashboards |
Post-v1 |
| Cloud Factory account provisioning |
Post-v1 (manual account setup for pilot) |
| Custom Backstage plugins |
Post-v1 |
| Automated onboarding CLI |
Post-v1 |
| Full OPA policy suite |
Post-v1 |
| Security audit / pen-test |
Post-v1 |
8.4 Success Criteria
- Pilot client EKS cluster is provisioned by Crossplane from the management plane.
- Backstage is accessible via Google Workspace SSO.
- A developer can create a Hiroba claim from a Backstage template and see the cloud resource reach
Ready.
- Alloy ships metrics and logs to Mimir/Loki over mTLS.
- 7KGroup operators can view the client in a fleet Grafana dashboard.
- Client receives read-only ServiceAccount kubeconfig.
- Client read experience is functional in Backstage.
8.5 v1 Roadmap
| Phase |
Weeks |
Focus |
| Phase 1: Foundation |
1–4 |
Management plane on bare metal, Mimir/Loki/Grafana, Keycloak, Vault, management-plane Crossplane, client overlay template, client-local ArgoCD bootstrap |
| Phase 2: Pilot |
5–8 |
Onboard pilot client, EKS via management-plane Crossplane, ESO bootstrap, client ArgoCD from 7k-inari, Dex + Google SSO, Alloy mTLS, Backstage templates |
| Phase 3: Hardening |
9–12 |
OPA suite, cert rotation, backup/DR, runbooks |
| Phase 4: Scale |
13–16 |
Multi-cloud, onboarding automation, custom plugins |
Resolved open decisions are recorded in ADR-009: Resolved Open Decisions. See also ADR-011: mTLS CA Strategy and ADR-012: Management-Plane Crossplane for Client Cluster Provisioning.