ADR-009: Resolved Open Decisions¶
Status: Approved
Date: 2026-06-30
Context¶
The original architecture plan contained six open decisions (OD-001 through OD-006). This ADR records their final resolutions.
Resolutions¶
| ID | Decision | Resolution |
|---|---|---|
| OD-001 | Alloy auth mechanism | mTLS for GA. Bearer tokens acceptable only for pre-GA pilots with explicit exception. |
| OD-002 | Client cluster provisioning | Crossplane. Cluster API retained as a fallback if Crossplane provider limitations arise. |
| OD-003 | Management plane cloud | Bare-metal server(s) managed by 7KGroup for v1. Cloud-hosted management plane deferred to v2. |
| OD-004 | Backstage database | PostgreSQL for all environments. SQLite explicitly not supported. |
| OD-005 | Cost pass-through model | Direct payment preferred (client pays cloud/infra directly). 7KGroup may optionally act as reseller. |
| OD-006 | Client kubectl access | Read-only access granted for transparency/audit. No write access to client control plane. |
Implications¶
- Bare-metal management plane requires physical infrastructure, backup, and DR planning.
- Crossplane for cluster provisioning overlaps with Cloud Factory scope; cluster provisioning XRDs should be owned by the same catalog or clearly separated.
- mTLS for Alloy requires a certificate authority strategy (cert-manager internal CA or Vault PKI).
- Read-only client access means all mutations to the client control plane flow through GitOps, not direct kubectl.
- Keycloak as fallback identity replaces the earlier LLDAP fallback. Keycloak runs in the management plane and is exposed to client Dex instances via OIDC.