1"use strict";(self.webpackChunkcnoe=self.webpackChunkcnoe||[]).push([[412],{28453:(e,n,t)=>{t.d(n,{R:()=>a,x:()=>i});var o=t(96540);const r={},s=o.createContext(r);function a(e){const n=o.useContext(s);return o.useMemo(function(){return"function"==typeof e?e(n):{...n,...e}},[n,e])}function i(e){let n;return n=e.disableParentContext?"function"==typeof e.components?e.components(r):e.components||r:a(e.components),o.createElement(s.Provider,{value:n},e.children)}},57265:(e,n,t)=>{t.r(n),t.d(n,{assets:()=>c,contentTitle:()=>i,default:()=>p,frontMatter:()=>a,metadata:()=>o,toc:()=>l});const o=JSON.parse('{"id":"reference-implementation/local/control-plane","title":"Infrastructure Control Plane","description":"CNOE control plane","source":"@site/docs/reference-implementation/local/control-plane.md","sourceDirName":"reference-implementation/local","slug":"/reference-implementation/local/control-plane","permalink":"/docs/reference-implementation/local/control-plane","draft":false,"unlisted":false,"tags":[],"version":"current","sidebarPosition":1,"frontMatter":{"sidebar_position":1,"description":"CNOE control plane","title":"Infrastructure Control Plane"},"sidebar":"tutorialSidebar","previous":{"title":"Access Management","permalink":"/docs/reference-implementation/local/access-management"},"next":{"title":"Secret Management","permalink":"/docs/reference-implementation/local/secrets"}}');var r=t(74848),s=t(28453);const a={sidebar_position:1,description:"CNOE control plane",title:"Infrastructure Control Plane"},i=void 0,c={},l=[];function u(e){const n={a:"a",p:"p",...(0,s.R)(),...e.components};return(0,r.jsxs)(r.Fragment,{children:[(0,r.jsxs)(n.p,{children:["In the reference implementation, ",(0,r.jsx)(n.a,{href:"https://www.crossplane.io/",children:"Crossplane"})," is used as the control plane for AWS resources and manifests are synced to the cluster using ",(0,r.jsx)(n.a,{href:"https://argo-cd.readthedocs.io/en/stable/",children:"ArgoCD"}),". This pattern is quite powerful because it allows you to combine the power of GitOps and the flexibility of Crossplane compositions. It is not limited to just provisioning external resources through Kubernetes APIs. You can also bake security and governance requirements into compositions."]}),"\n",(0,r.jsx)(n.p,{children:"For example, you can create a composition for S3 buckets for use with applications. In the composition, we can enforce certain configuration options such as tagging requirements and encryption key choices.\nOnce a bucket is created through Crossplane, it continuously enforces these configuration options.\nEven if an end user updates configuration manually through API calls or the console, the changes are reverted back automatically because Kubernetes operators continuously work to
1sync external resources with the specifications stored in the cluster."}),"\n",(0,r.jsx)(n.p,{children:"Kubernetes CD solutions like ArgoCD is a great companion for this. It allows you to automatically sync resources from a Git repository with many flexible options. With ArgoCD and Crossplane, many application infrastructure needs can be condensed to a YAML file that developers can self-service through a developer portal."}),"\n",(0,r.jsxs)(n.p,{children:["This pattern is not limited to Crossplane. There are other Kubernetes Controllers for Infrastructure as code toolings. Take ",(0,r.jsx)(n.a,{href:"https://github.com/weaveworks/tf-controller",children:"Terraform controller"})," for example.\nThis controller allows you to run Terraform modules in Kubernetes and exposes commonly used Terraform features as fields in the CRD. In the terraform module you can enforce your organizational requirements."]}),"\n",(0,r.jsx)(n.p,{children:"Whichever tool you choose to use, use of a policy engine such as Kyverno and OPA Gatekeeper is essential in securing your cluster and external resources. We will include more example of this pattern in the future."})]})}function p(e={}){const{wrapper:n}={...(0,s.R)(),...e.components};return n?(0,r.jsx)(n,{...e,children:(0,r.jsx)(u,{...e})}):u(e)}}}]);
Line numbers count LF bytes from the start of the resource, as the search results do. Vendor segments are library code the classifier recognised; they are stored but not indexed. Bytes are shown as Latin1 characters, one per byte.