Kubernetes Platform

This is the substrate everything else here runs on: a bare-metal cluster built up from load balancing, ingress, certificate management, a container registry, and persistent storage, each an upstream component wired together declaratively with Helm and Kustomize.

How it works

The discipline is that nothing is configured by hand. Each overlay pulls an upstream Helm chart through Kustomize and layers environment-specific patches on top; scripting is confined to env-var substitution, never deployment logic. The whole tree is reconciled continuously from git by a GitOps controller, so the cluster can be reasoned about, and rebuilt, from its manifests alone. It’s the boring, dependable base that makes the more interesting projects above it possible.

Key decisions

• Kustomize over upstream Helm charts, not bespoke manifests: helmCharts: overlays let me track upstream releases while keeping every environment difference as a reviewable patch, so upgrades are a version bump rather than a hand-merge.
• GitOps reconciliation as the only deploy path: desired state lives in git and a controller converges the cluster to it; there is no out-of-band kubectl apply in the normal loop, so drift is visible and the cluster is rebuildable.
• Secrets stay out of git: an external secrets operator pulls from a dedicated secret store at runtime, so manifests are fully shareable and no credential is ever committed.
• Upstream images only, no repackaged vendor images: official charts or minimal bases, which keeps the supply chain legible and the registry scannable.