# nutcas3/openshift architecture

> Architecture diagram of the GitHub repository nutcas3/openshift, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-29). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/nutcas3/openshift
- Repository: https://github.com/nutcas3/openshift

## Overview

This repository is a declarative OpenShift platform portfolio, not one application. Its main workflow is developer self-service scaffolding, followed by GitOps-managed environment promotion and policy-controlled deployment. The graph also captures documented security, operations, and specialized platform capabilities. Evidence is primarily the top-level README and file tree; sampled application source only confirms the behavior of service templates, so uncertain implementation-level wiring is omitted.

Main entry points: [`multi-cluster-gitops/argocd/applicationsets`](https://github.com/nutcas3/openshift/tree/main/multi-cluster-gitops/argocd/applicationsets) (ArgoCD Applications), [`multi-cluster-gitops/fleet-workloads`](https://github.com/nutcas3/openshift/tree/main/multi-cluster-gitops/fleet-workloads) (Fleet Workloads), [`dev-ex/rhdh`](https://github.com/nutcas3/openshift/tree/main/dev-ex/rhdh) (Developer Portal), [`dev-ex/templates`](https://github.com/nutcas3/openshift/tree/main/dev-ex/templates) (Service Templates)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_developer["Developer Experience"]
  node_portal["Developer Portal"]
  node_templates["Service Templates"]
end

subgraph group_delivery["Delivery and Security"]
  node_tenant_gitops["Tenant GitOps"]
  node_argocd["ArgoCD Applications"]
  node_fleet["Fleet Workloads"]
  node_pipeline["Secure CI Pipeline<br/>[pipeline.yaml]"]
  node_scans_signing["Scans and Signing"]
  node_admission["Admission Policies"]
end

subgraph group_governance["Tenancy and Governance"]
  node_policy_engine["Cluster Policies"]
  node_tenancy["Tenant Isolation"]
  node_vault[("Vault Secret Store")]
  node_external_secrets["External Secrets"]
  node_sealed_secrets["Sealed Secrets"]
end

subgraph group_operations["Operations and Resilience"]
  node_observability["Monitoring and Costs"]
  node_grafana["Grafana<br/>[instance.yaml]"]
  node_chaos["Chaos SLO Gate"]
  node_mesh["Service Mesh"]
  node_dr["Disaster Recovery"]
  node_edge["Edge Fleet"]
end

subgraph group_platforms["Platform Workloads"]
  node_ai["AI and LLM Serving"]
  node_virtualization["Virtual Machines"]
  node_serverless["Serverless Workloads"]
end

node_engineer(("Engineer"))
node_clusters(("OpenShift Clusters"))

node_engineer -->|"uses"| node_portal
node_portal -->|"offers"| node_templates
node_templates -->|"scaffolds PRs"| node_tenant_gitops
node_argocd -->|"syncs overlays"| node_fleet
node_argocd -->|"onboards namespaces"| node_tenancy
node_fleet -->|"deploys workloads"| node_clusters
node_pipeline -->|"builds and verifies"| node_scans_signing
node_policy_engine -->|"enforces signatures"| node_admission
node_admission -->|"guards admission"| node_clusters
node_external_secrets -->|"reads secrets"| node_vault
node_sealed_secrets -->|"supplies credentials"| node_fleet
node_observability -->|"scrapes metrics"| node_tenancy
node_grafana -->|"visualizes"| node_observability
node_chaos -->|"gates promotion"| node_argocd
node_mesh -->|"adds mTLS and canary"| node_clusters
node_dr -->|"manages failover"| node_clusters
node_edge -->|"extends fleet"| node_clusters
node_ai -->|"hosts AI workloads"| node_clusters
node_virtualization -->|"hosts VMs"| node_clusters
node_serverless -->|"runs event workloads"| node_clusters

click node_portal "https://github.com/nutcas3/openshift/tree/main/dev-ex/rhdh"
click node_templates "https://github.com/nutcas3/openshift/tree/main/dev-ex/templates"
click node_tenant_gitops "https://github.com/nutcas3/openshift/tree/main/multi-cluster-gitops/tenants"
click node_argocd "https://github.com/nutcas3/openshift/tree/main/multi-cluster-gitops/argocd/applicationsets"
click node_fleet "https://github.com/nutcas3/openshift/tree/main/multi-cluster-gitops/fleet-workloads"
click node_pipeline "https://github.com/nutcas3/openshift/blob/main/trusted-supply-chain/ci/pipeline.yaml"
click node_scans_signing "https://github.com/nutcas3/openshift/tree/main/trusted-supply-chain/ci"
click node_admission "https://github.com/nutcas3/openshift/blob/main/trusted-supply-chain/policy/clusterpolicy-require-signature.yaml"
click node_policy_engine "https://github.com/nutcas3/openshift/tree/main/policy-engine/cluster-policies"
click node_tenancy "https://github.com/nutcas3/openshift/tree/main/multi-tenancy/base"
click node_vault "https://github.com/nutcas3/openshift/blob/main/secret-management/vault/cluster-secret-store.yaml"
click node_external_secrets "https://github.com/nutcas3/openshift/blob/main/secret-management/vault/external-secret.yaml"
click node_sealed_secrets "https://github.com/nutcas3/openshift/tree/main/multi-cluster-gitops/fleet-workloads/secrets"
click node_observability "https://github.com/nutcas3/openshift/tree/main/observability-finops/monitoring"
click node_grafana "https://github.com/nutcas3/openshift/blob/main/observability-finops/grafana/instance.yaml"
click node_chaos "https://github.com/nutcas3/openshift/blob/main/chaos-engineering/chaos/chaos-slo-gate.yaml"
click node_mesh "https://github.com/nutcas3/openshift/tree/main/service-mesh/mesh"
click node_dr "https://github.com/nutcas3/openshift/tree/main/disaster-recovery/acm"
click node_edge "https://github.com/nutcas3/openshift/blob/main/edge-fleet/edge/edge-node-fleet.yaml"
click node_ai "https://github.com/nutcas3/openshift/tree/main/ai-ml-platform/ai"
click node_virtualization "https://github.com/nutcas3/openshift/tree/main/vm-modernization/vms"
click node_serverless "https://github.com/nutcas3/openshift/tree/main/serverless/knative"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_portal,node_templates toneBlue
class node_tenant_gitops,node_argocd,node_fleet,node_pipeline,node_scans_signing,node_admission toneAmber
class node_policy_engine,node_tenancy,node_vault,node_external_secrets,node_sealed_secrets toneMint
class node_observability,node_grafana,node_chaos,node_mesh,node_dr,node_edge toneRose
class node_ai,node_virtualization,node_serverless,node_engineer,node_clusters toneIndigo
```

## Components

### Developer Experience

- [Developer Portal](https://github.com/nutcas3/openshift/tree/main/dev-ex/rhdh): `dev-ex/rhdh`
- [Service Templates](https://github.com/nutcas3/openshift/tree/main/dev-ex/templates): `dev-ex/templates`

### Delivery and Security

- [Tenant GitOps](https://github.com/nutcas3/openshift/tree/main/multi-cluster-gitops/tenants): `multi-cluster-gitops/tenants`
- [ArgoCD Applications](https://github.com/nutcas3/openshift/tree/main/multi-cluster-gitops/argocd/applicationsets): `multi-cluster-gitops/argocd/applicationsets`
- [Fleet Workloads](https://github.com/nutcas3/openshift/tree/main/multi-cluster-gitops/fleet-workloads): `multi-cluster-gitops/fleet-workloads`
- [Secure CI Pipeline](https://github.com/nutcas3/openshift/blob/main/trusted-supply-chain/ci/pipeline.yaml): `trusted-supply-chain/ci/pipeline.yaml`
- [Scans and Signing](https://github.com/nutcas3/openshift/tree/main/trusted-supply-chain/ci): `trusted-supply-chain/ci`
- [Admission Policies](https://github.com/nutcas3/openshift/blob/main/trusted-supply-chain/policy/clusterpolicy-require-signature.yaml): `trusted-supply-chain/policy/clusterpolicy-require-signature.yaml`

### Tenancy and Governance

- [Cluster Policies](https://github.com/nutcas3/openshift/tree/main/policy-engine/cluster-policies): `policy-engine/cluster-policies`
- [Tenant Isolation](https://github.com/nutcas3/openshift/tree/main/multi-tenancy/base): `multi-tenancy/base`
- [Vault Secret Store](https://github.com/nutcas3/openshift/blob/main/secret-management/vault/cluster-secret-store.yaml): `secret-management/vault/cluster-secret-store.yaml`
- [External Secrets](https://github.com/nutcas3/openshift/blob/main/secret-management/vault/external-secret.yaml): `secret-management/vault/external-secret.yaml`
- [Sealed Secrets](https://github.com/nutcas3/openshift/tree/main/multi-cluster-gitops/fleet-workloads/secrets): `multi-cluster-gitops/fleet-workloads/secrets`

### Operations and Resilience

- [Monitoring and Costs](https://github.com/nutcas3/openshift/tree/main/observability-finops/monitoring): `observability-finops/monitoring`
- [Grafana](https://github.com/nutcas3/openshift/blob/main/observability-finops/grafana/instance.yaml): `observability-finops/grafana/instance.yaml`
- [Chaos SLO Gate](https://github.com/nutcas3/openshift/blob/main/chaos-engineering/chaos/chaos-slo-gate.yaml): `chaos-engineering/chaos/chaos-slo-gate.yaml`
- [Service Mesh](https://github.com/nutcas3/openshift/tree/main/service-mesh/mesh): `service-mesh/mesh`
- [Disaster Recovery](https://github.com/nutcas3/openshift/tree/main/disaster-recovery/acm): `disaster-recovery/acm`
- [Edge Fleet](https://github.com/nutcas3/openshift/blob/main/edge-fleet/edge/edge-node-fleet.yaml): `edge-fleet/edge/edge-node-fleet.yaml`

### Platform Workloads

- [AI and LLM Serving](https://github.com/nutcas3/openshift/tree/main/ai-ml-platform/ai): `ai-ml-platform/ai`
- [Virtual Machines](https://github.com/nutcas3/openshift/tree/main/vm-modernization/vms): `vm-modernization/vms`
- [Serverless Workloads](https://github.com/nutcas3/openshift/tree/main/serverless/knative): `serverless/knative`

### Other components

- **Engineer**
- **OpenShift Clusters**

## Connections

- Engineer → Developer Portal: uses
- Developer Portal → Service Templates: offers
- Service Templates → Tenant GitOps: scaffolds PRs
- ArgoCD Applications → Fleet Workloads: syncs overlays
- ArgoCD Applications → Tenant Isolation: onboards namespaces
- Fleet Workloads → OpenShift Clusters: deploys workloads
- Secure CI Pipeline → Scans and Signing: builds and verifies
- Cluster Policies → Admission Policies: enforces signatures
- Admission Policies → OpenShift Clusters: guards admission
- External Secrets → Vault Secret Store: reads secrets
- Sealed Secrets → Fleet Workloads: supplies credentials
- Monitoring and Costs → Tenant Isolation: scrapes metrics
- Grafana → Monitoring and Costs: visualizes
- Chaos SLO Gate → ArgoCD Applications: gates promotion
- Service Mesh → OpenShift Clusters: adds mTLS and canary
- Disaster Recovery → OpenShift Clusters: manages failover
- Edge Fleet → OpenShift Clusters: extends fleet
- AI and LLM Serving → OpenShift Clusters: hosts AI workloads
- Virtual Machines → OpenShift Clusters: hosts VMs
- Serverless Workloads → OpenShift Clusters: runs event workloads