Skip to main content

Environment map

This page is the canonical map of the Fedshi reference instance — customer #1 of DevsPortal. It lists every public hostname, what serves it, which plane and namespace it lives in, the TLS secret that terminates it, and the DNS strategy that ties them together.

note

DevsPortal is built on the Control Plane Operator engine. The internal namespace names (openchoreo-control-plane, etc.), the chart coordinates, and the CRD API group are upstream identifiers and are kept unchanged — they are internal and never exposed to users. Only the public hostnames under {fedshi.dnsZone} are branded.

Cluster context​

Everything runs in a single GKE cluster. The four Control Plane Operator planes (control, data, workflow, observability) plus the shared infrastructure all live in one cluster:

PropertyValue
Kube-context{fedshi.cluster}
Regioneurope-north2
Kubernetes{versions.kubernetes}
DNS zone{fedshi.dnsZone} (Cloudflare)
Public rootidp.{fedshi.dnsZone}

Public hostnames​

Every hostname below serves a real, trusted Let's Encrypt certificate (issued via Cloudflare DNS-01). No skip-TLS or insecure flags are set anywhere.

HostnameServesPlaneNamespaceTLS secret
console.idp.fedshi.comDeveloper portal (branded Backstage)Controlopenchoreo-control-planecp-gateway-tls
api.idp.fedshi.comControl Plane Operator API serverControlopenchoreo-control-planecp-gateway-tls
auth.idp.fedshi.comThunderID OAuth2 / OIDCIdentitythundercp-gateway-tls
{fedshi.apps}Deployed workload endpoints (wildcard)Dataopenchoreo-data-planedp-gateway-tls
registry.idp.fedshi.comHarbor container registryRegistryharborharbor-tls
observer.idp.fedshi.comObserver API (logs / metrics / traces)Observabilityopenchoreo-observability-planeobs-gateway-tls

Notes:

  • console, api, and auth share the control-plane gateway (gateway-default in openchoreo-control-plane) and therefore the same cp-gateway-tls SAN cert. The ThunderID identity provider lives in its own thunder namespace but is fronted by the control-plane gateway, so it is reachable at auth over that listener.
  • The workflow plane (openchoreo-workflow-plane, Argo Workflows) has no public hostname — it builds images internally and pushes them to Harbor.
  • dp-gateway-tls is a wildcard (*.apps.idp.{fedshi.dnsZone} + apps.idp.{fedshi.dnsZone}). Deployed component endpoints look like <env>-<namespace>.apps.idp.{fedshi.dnsZone}.

Namespaces​

NamespaceContains
openchoreo-control-planeAPI server, portal, controllers, cluster-gateway, kgateway
openchoreo-data-planeWorkload runtime + app-traffic gateway
openchoreo-workflow-planeBuild workflows (Argo Workflows)
openchoreo-observability-planeObserver + OpenSearch + Prometheus
thunderThunderID identity provider
harborHarbor container registry
openbaoOpenBao secret backend
cert-managercert-manager (TLS issuance)
external-secretsExternal Secrets Operator

DNS and LoadBalancer strategy​

DNS is served from the {fedshi.dnsZone} Cloudflare zone. Every record is an A record, DNS-only (grey cloud, NOT proxied). The platform gateways terminate TLS themselves; enabling the Cloudflare proxy would break SNI/host routing and wildcard TLS.

Each plane's gateway (and Harbor) is exposed as a LoadBalancer Service with its own GKE regional external IP. The DNS strategy is a broad wildcard pointing at the control-plane IP, with more-specific overrides for the planes that have their own LoadBalancer:

RecordTargetResolves
*.idp.{fedshi.dnsZone} (and idp.{fedshi.dnsZone} apex)Control-plane LBconsole, api, auth (catch-all)
*.apps.idp.{fedshi.dnsZone}Data-plane LBApp endpoints (wildcard)
registry.idp.{fedshi.dnsZone}Harbor LBRegistry
observer.idp.{fedshi.dnsZone}Observability LBObserver API

Cloudflare resolves most-specific-first, so the *.apps, registry, and observer records override the broad *.idp wildcard.

tip

LoadBalancer IPs are GKE regional L4 addresses tied to each plane's gateway-default (and Harbor) Service. If a Service is recreated the IP can change — re-check with kubectl get svc <svc> -n <ns> and update the corresponding DNS record.