Platform components

This page maps the supporting components around the application services. For procedures, follow the linked runbooks rather than treating this map as an operator command list.

Component	Owns	Failure effect	Authoritative detail
Kubernetes/k3s	Scheduling, namespaces, Services, volumes, and runtime isolation.	Workloads cannot schedule, route internally, or mount state.	Deployment
Helm	Portable templates and values contract for each environment.	Invalid desired manifests or mismatched runtime configuration.	Deployment model
Argo CD	GitOps reconciliation, drift display, sync waves, and manual production promotion.	Desired changes stop applying; existing workloads normally continue.	Argo CD Applications
GHCR	Immutable product container images.	New rollouts cannot pull images; running Pods continue with local images.	Deployment
GitHub Actions	Checks, image publication, version validation, and test-release dispatch.	No verified new release is produced or selected.	Deployment
Traefik	Public HTTPS ingress to API, web console, docs, Argo CD, and OpenBao.	Public traffic cannot reach an otherwise healthy Service.	Deployment
cert-manager	ACME certificate issuance and renewal.	TLS may expire or an Ingress may not become usable.	Deployment
OpenBao	Authoritative self-hosted KV-v2 values, history, policy, native audit, and Raft snapshots.	New secret synchronization pauses; existing Kubernetes Secrets remain.	Secret Management
External Secrets Operator	Reads allowed OpenBao paths through Kubernetes Auth and writes namespace-local Secrets.	New or rotated values do not reach workloads.	Secret Management
Reloader	Restarts only workloads that reference a changed synchronized Secret.	A Secret can be current while a running process still uses the old environment.	Secret Management
PostgreSQL/TimescaleDB	Authoritative relational and time-series state.	API readiness fails and raw consumer retries; no service may invent fallback state.	Data model
NATS JetStream	Bounded durable raw-event buffer and consumer delivery state.	MQTT receiver withholds completion and raw storage stops receiving.	Netmore ingestion
Prometheus NATS Exporter	Read-only stream and consumer counters from the Pod-local NATS monitoring endpoint.	JetStream queue depth becomes unavailable in external operations monitoring.	Observability model
Database migration Job	Applies versioned SQL before workloads roll forward.	Argo CD blocks later sync waves.	Database Migrations
Raw-stream bootstrap Job	Establishes compatible stream and consumer limits.	Both ingestion workers must remain unready or stopped.	Netmore ingestion
Raw-retention CronJob	Deletes expired raw records and delivered outbox events in bounded batches.	Short-lived raw evidence and delivery history grow beyond policy.	Database Migrations

Control-plane boundaries

The product repository owns application code, Dockerfiles, the Helm chart, public contracts, and these docs. The private sens-platform-infra repository owns cluster Applications, environment-specific static values, and immutable release selection. OpenBao owns application secret values. Kubernetes Secrets are runtime copies, not the source of truth.

Test and production have separate namespaces, OpenBao mounts, identities, Secrets, PVCs, release selections, and Argo CD Applications. The shared operations control plane must never collapse these data and permission boundaries.

Secret propagation

OpenBao KV-v2 mount
  -> Kubernetes Auth
  -> namespace-scoped External Secrets Operator
  -> namespace-local Kubernetes Secret
  -> Reloader
  -> selected workload restart

Release propagation

Git change -> CI checks -> immutable GHCR images -> infra release selection
           -> Argo CD -> Helm render -> migration/bootstrap waves -> workloads

Argo CD does not contain secret values, and OpenBao does not choose image versions. Keeping those responsibilities separate makes failures and audit scope explicit.