# chrisignat/multi-service-platform-provisioner architecture

> Architecture diagram of the GitHub repository chrisignat/multi-service-platform-provisioner, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-25). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/chrisignat/multi-service-platform-provisioner
- Repository: https://github.com/chrisignat/multi-service-platform-provisioner
- Video tour (about a minute): https://gitdiagram.com/chrisignat/multi-service-platform-provisioner/video

## Overview

This repository provisions a Kubernetes-based internal developer platform and defines a self-service PostgreSQL provisioning workflow. The main user journey is submitting that workflow in Argo Workflows, which performs the documented security scan, creates credentials, deploys a database, and produces an access card. A separate GitOps branch uses the bootstrap Root App and ArgoCD to manage platform infrastructure. The README also documents observability, secrets, backup, cost, and local AWS-compatible services. Wiring for unsampled manifests and workflow steps is shown only where documented.

Main entry points: [`infrastructure`](https://github.com/chrisignat/multi-service-platform-provisioner/tree/main/infrastructure) (Infrastructure Apps), [`golden-path/jobs/postgres-deploy-pipeline.yaml`](https://github.com/chrisignat/multi-service-platform-provisioner/blob/main/golden-path/jobs/postgres-deploy-pipeline.yaml) (Postgres Pipeline), [`infrastructure/argo-workflows`](https://github.com/chrisignat/multi-service-platform-provisioner/tree/main/infrastructure/argo-workflows) (Workflows UI), [`infrastructure/argocd/argocd-app.yaml`](https://github.com/chrisignat/multi-service-platform-provisioner/blob/main/infrastructure/argocd/argocd-app.yaml) (ArgoCD)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_provisioning["Self-Service Provisioning"]
  node_argo_workflows_ui["Workflows UI"]
  node_postgres_pipeline["Postgres Pipeline"]
  node_trivy_scan["Trivy Scan"]
  node_credential_generation["Credential Generation"]
  node_postgres_deployment["Postgres Deployment"]
  node_access_card["Access Card"]
  node_port["Port Catalog"]
end

subgraph group_gitops["GitOps Delivery"]
  node_root_app["Root App<br/>[root-app.yaml]"]
  node_argocd["ArgoCD<br/>[argocd-app.yaml]"]
  node_infrastructure_apps["Infrastructure Apps"]
end

subgraph group_platform["Platform Services"]
  node_argo_workflows["Argo Workflows"]
  node_cilium_hubble["Cilium &amp; Hubble"]
  node_monitoring["Monitoring"]
  node_kubecost["Kubecost"]
end

subgraph group_operations["Operations &amp; Storage"]
  node_secrets["Secrets Services"]
  node_vault["Vault"]
  node_external_secrets["External Secrets"]
  node_velero["Velero Backup"]
  node_localstack["LocalStack"]
  node_terraform["Terraform S3<br/>[main.tf]"]
end

node_developer(("Developer"))

node_developer -->|"submits workflow"| node_argo_workflows_ui
node_argo_workflows_ui -->|"runs workflow"| node_postgres_pipeline
node_postgres_pipeline -->|"scans first"| node_trivy_scan
node_postgres_pipeline -->|"generates credentials"| node_credential_generation
node_postgres_pipeline -->|"deploys database"| node_postgres_deployment
node_postgres_pipeline -->|"generates card"| node_access_card
node_postgres_pipeline -.->|"updates entities"| node_port
node_root_app -->|"defines root app"| node_argocd
node_argocd -->|"manages apps"| node_infrastructure_apps
node_infrastructure_apps -->|"deploys"| node_argo_workflows
node_infrastructure_apps -->|"deploys"| node_cilium_hubble
node_infrastructure_apps -->|"deploys"| node_monitoring
node_infrastructure_apps -->|"deploys"| node_kubecost
node_infrastructure_apps -->|"deploys"| node_secrets
node_infrastructure_apps -->|"deploys"| node_vault
node_infrastructure_apps -->|"deploys"| node_external_secrets
node_infrastructure_apps -->|"deploys"| node_velero
node_infrastructure_apps -->|"deploys"| node_localstack
node_terraform -->|"provisions bucket"| node_localstack

click node_argo_workflows_ui "https://github.com/chrisignat/multi-service-platform-provisioner/tree/main/infrastructure/argo-workflows"
click node_postgres_pipeline "https://github.com/chrisignat/multi-service-platform-provisioner/blob/main/golden-path/jobs/postgres-deploy-pipeline.yaml"
click node_trivy_scan "https://github.com/chrisignat/multi-service-platform-provisioner/blob/main/golden-path/jobs/postgres-deploy-pipeline.yaml"
click node_credential_generation "https://github.com/chrisignat/multi-service-platform-provisioner/blob/main/golden-path/jobs/postgres-deploy-pipeline.yaml"
click node_postgres_deployment "https://github.com/chrisignat/multi-service-platform-provisioner/blob/main/golden-path/jobs/postgres-deploy-pipeline.yaml"
click node_access_card "https://github.com/chrisignat/multi-service-platform-provisioner/blob/main/golden-path/jobs/postgres-deploy-pipeline.yaml"
click node_root_app "https://github.com/chrisignat/multi-service-platform-provisioner/blob/main/bootstrap/root-app.yaml"
click node_argocd "https://github.com/chrisignat/multi-service-platform-provisioner/blob/main/infrastructure/argocd/argocd-app.yaml"
click node_infrastructure_apps "https://github.com/chrisignat/multi-service-platform-provisioner/tree/main/infrastructure"
click node_argo_workflows "https://github.com/chrisignat/multi-service-platform-provisioner/blob/main/infrastructure/argo-workflows/argo-workflows-app-argocd.yaml"
click node_cilium_hubble "https://github.com/chrisignat/multi-service-platform-provisioner/tree/main/infrastructure/cilium"
click node_monitoring "https://github.com/chrisignat/multi-service-platform-provisioner/tree/main/infrastructure/monitoring"
click node_kubecost "https://github.com/chrisignat/multi-service-platform-provisioner/tree/main/infrastructure/kubecost"
click node_secrets "https://github.com/chrisignat/multi-service-platform-provisioner/tree/main/infrastructure/sealed-secrets"
click node_vault "https://github.com/chrisignat/multi-service-platform-provisioner/tree/main/infrastructure/vault"
click node_external_secrets "https://github.com/chrisignat/multi-service-platform-provisioner/tree/main/infrastructure/eso"
click node_velero "https://github.com/chrisignat/multi-service-platform-provisioner/tree/main/infrastructure/velero"
click node_localstack "https://github.com/chrisignat/multi-service-platform-provisioner/tree/main/infrastructure/localstack"
click node_terraform "https://github.com/chrisignat/multi-service-platform-provisioner/blob/main/terraform/main.tf"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_argo_workflows_ui,node_postgres_pipeline,node_trivy_scan,node_credential_generation,node_postgres_deployment,node_access_card,node_port toneBlue
class node_root_app,node_argocd,node_infrastructure_apps toneAmber
class node_argo_workflows,node_cilium_hubble,node_monitoring,node_kubecost toneMint
class node_secrets,node_vault,node_external_secrets,node_velero,node_localstack,node_terraform toneRose
class node_developer toneIndigo
```

## Components

### Self-Service Provisioning

- [Workflows UI](https://github.com/chrisignat/multi-service-platform-provisioner/tree/main/infrastructure/argo-workflows): `infrastructure/argo-workflows`
- [Postgres Pipeline](https://github.com/chrisignat/multi-service-platform-provisioner/blob/main/golden-path/jobs/postgres-deploy-pipeline.yaml): `golden-path/jobs/postgres-deploy-pipeline.yaml`
- [Trivy Scan](https://github.com/chrisignat/multi-service-platform-provisioner/blob/main/golden-path/jobs/postgres-deploy-pipeline.yaml): `golden-path/jobs/postgres-deploy-pipeline.yaml`
- [Credential Generation](https://github.com/chrisignat/multi-service-platform-provisioner/blob/main/golden-path/jobs/postgres-deploy-pipeline.yaml): `golden-path/jobs/postgres-deploy-pipeline.yaml`
- [Postgres Deployment](https://github.com/chrisignat/multi-service-platform-provisioner/blob/main/golden-path/jobs/postgres-deploy-pipeline.yaml): `golden-path/jobs/postgres-deploy-pipeline.yaml`
- [Access Card](https://github.com/chrisignat/multi-service-platform-provisioner/blob/main/golden-path/jobs/postgres-deploy-pipeline.yaml): `golden-path/jobs/postgres-deploy-pipeline.yaml`
- **Port Catalog**

### GitOps Delivery

- [Root App](https://github.com/chrisignat/multi-service-platform-provisioner/blob/main/bootstrap/root-app.yaml): `bootstrap/root-app.yaml`
- [ArgoCD](https://github.com/chrisignat/multi-service-platform-provisioner/blob/main/infrastructure/argocd/argocd-app.yaml): `infrastructure/argocd/argocd-app.yaml`
- [Infrastructure Apps](https://github.com/chrisignat/multi-service-platform-provisioner/tree/main/infrastructure): `infrastructure`

### Platform Services

- [Argo Workflows](https://github.com/chrisignat/multi-service-platform-provisioner/blob/main/infrastructure/argo-workflows/argo-workflows-app-argocd.yaml): `infrastructure/argo-workflows/argo-workflows-app-argocd.yaml`
- [Cilium & Hubble](https://github.com/chrisignat/multi-service-platform-provisioner/tree/main/infrastructure/cilium): `infrastructure/cilium`
- [Monitoring](https://github.com/chrisignat/multi-service-platform-provisioner/tree/main/infrastructure/monitoring): `infrastructure/monitoring`
- [Kubecost](https://github.com/chrisignat/multi-service-platform-provisioner/tree/main/infrastructure/kubecost): `infrastructure/kubecost`

### Operations & Storage

- [Secrets Services](https://github.com/chrisignat/multi-service-platform-provisioner/tree/main/infrastructure/sealed-secrets): `infrastructure/sealed-secrets`
- [Vault](https://github.com/chrisignat/multi-service-platform-provisioner/tree/main/infrastructure/vault): `infrastructure/vault`
- [External Secrets](https://github.com/chrisignat/multi-service-platform-provisioner/tree/main/infrastructure/eso): `infrastructure/eso`
- [Velero Backup](https://github.com/chrisignat/multi-service-platform-provisioner/tree/main/infrastructure/velero): `infrastructure/velero`
- [LocalStack](https://github.com/chrisignat/multi-service-platform-provisioner/tree/main/infrastructure/localstack): `infrastructure/localstack`
- [Terraform S3](https://github.com/chrisignat/multi-service-platform-provisioner/blob/main/terraform/main.tf): `terraform/main.tf`

### Other components

- **Developer**

## Connections

- Developer → Workflows UI: submits workflow
- Workflows UI → Postgres Pipeline: runs workflow
- Postgres Pipeline → Trivy Scan: scans first
- Postgres Pipeline → Credential Generation: generates credentials
- Postgres Pipeline → Postgres Deployment: deploys database
- Postgres Pipeline → Access Card: generates card
- Postgres Pipeline → Port Catalog: updates entities
- Root App → ArgoCD: defines root app
- ArgoCD → Infrastructure Apps: manages apps
- Infrastructure Apps → Argo Workflows: deploys
- Infrastructure Apps → Cilium & Hubble: deploys
- Infrastructure Apps → Monitoring: deploys
- Infrastructure Apps → Kubecost: deploys
- Infrastructure Apps → Secrets Services: deploys
- Infrastructure Apps → Vault: deploys
- Infrastructure Apps → External Secrets: deploys
- Infrastructure Apps → Velero Backup: deploys
- Infrastructure Apps → LocalStack: deploys
- Terraform S3 → LocalStack: provisions bucket