Building a GitOps Enabled SaaS Control Plane
summary
Built a GitOps SaaS control plane that provisions a dedicated tenant per vcluster using Clerk for auth, GitHub repos and PRs as the source of truth, Flux to continuously reconcile Helm charts, Crossplane (or cloud controllers) for cloud resources, and SOPS/KeyVault for secrets; workloads run with minimal privileges and a privileged Flux handles cloud provisioning. A custom tenant controller is less than 1000 lines and produces isolated control loops that are auditable, roll back via Git, and cut operational cost.
AI-written summary · about
chapters (11)
- 0:00Introduction
- 1:06Shared vs dedicated architecture
- 2:08GitOps principles and requirements
- 3:36Challenges of non-GitOps
- 7:35Isolated control loops in Kubernetes
- 9:21Tech stack for control plane
- 11:11Tenant provisioning workflow
- 13:44Security isolation with vCluster
- 15:08Crossplane for cloud provisioning
- 16:34Benefits of GitOps control plane
- 17:58Implementation tools
related talks
08mLightning Talk: GitOps and Controllers: It’s Not That Simple for Multi-cluster
26mAccelerating Application Delivery with OpenTofu Controller and GitOps
09mGitopsify Cellular Architecture
36mManaging Thousands of Clusters and Their Workloads with Flux
24mBeyond Tool Sprawl: An Event-Driven Approach to Dynamic Multi-Cloud Operations
27mGitOps Evolution Through the Lens of a Flux Maintainer
34mA New Way To Roll: Supply Chain Choreography For Enterprise Grade Kubernetes
06mLightning Talk: Unifying Hybrid Clouds: A Journey Through Multi-Control...