Skip to main content

Set up the platform once

Before the first app, the platform team installs five add-ons once, from the cluster's Add-ons tab. Every app then gets them with nothing to set up.

  • Ingress routes traffic into the cluster.
  • Certificates issues each app's TLS certificate and renews it before it expires.
  • DNS Automation writes each app's DNS record in your zone.
  • Vulnerability Scanning checks every running image for known CVEs.
  • Cost Visibility shows what each app and team spends. It installs its own metrics backend, or set Metrics source to Your Prometheus and enter its Prometheus endpoint to use the Prometheus you already run.

Verify your domain under Integrations > Domains, so apps can be served on it.

Open zoom view

Certificates add-on on eks-prod: Deployed, version 1.0.1 with cert-manager, 1 of 1 health check passing, issues and renews TLS certificates

Certificates add-on on eks-prod: Deployed, version 1.0.1 with cert-manager, 1 of 1 health check passing, issues and renews TLS certificatesCertificates add-on on eks-prod: Deployed, version 1.0.1 with cert-manager, 1 of 1 health check passing, issues and renews TLS certificates
Open zoom view

DNS Automation add-on on eks-prod: Deployed, version 1.0.1, 1 of 1 health check passing, keeps DNS records in sync with your apps

DNS Automation add-on on eks-prod: Deployed, version 1.0.1, 1 of 1 health check passing, keeps DNS records in sync with your appsDNS Automation add-on on eks-prod: Deployed, version 1.0.1, 1 of 1 health check passing, keeps DNS records in sync with your apps

Add your platform's own apps​

The rest of your platform is apps you deploy once with Deploy application, and they get the same versions, rollback, scanning and cost:

  • kpack builds images from your source inside the cluster, on every push, and pushes them to your registry.
  • Prometheus and Grafana for your own metrics, dashboards and alerting, from their public Helm charts.
  • Anything else your teams need, such as a developer portal.

Ready-made files for kpack, its builder and the registry policies are in the Developer platform blueprint.

What kpack needs from you​

kpack pushes images with registry access you give it. AstroPulse doesn't push for you. Before you deploy kpack-builder:

  • Set the builder's tag in resources/kpack/cluster-builder.yaml to your registry, such as ghcr.io/<YOUR_GITHUB_ORG>/kpack-builder.
  • Give kpack-service-account in the kpack namespace push access to that registry. There are many ways, from your cloud's identity to a registry Secret: see Push images from a build in the cluster. The blueprint's files use the Secret registry-credentials.
tip

Without push access, the builder can't publish its image and never becomes ready, so no build runs.

NovaNova
Install Ingress, Certificates, DNS Automation, Vulnerability Scanning and Cost Visibility on eks-prod.
Ask Nova

It shows the plan and installs them when you approve.

Next​

Bring in your teams