Part 1: foundation by pull request, and the plant edge

Scroll or pinch to zoom, drag to move, double-click to zoom in 100% SVG PNG Back to the post

Architecture: a pull request in the plant-monitoring repository sends a webhook to Atlantis running on GKE Standard with Dataplane V2 and Workload Identity. Atlantis runs OpenTofu with the Google provider and state in a private versioned bucket. OpenTofu applies the cloud foundation (Pub/Sub, Cloud KMS, Cloud Storage buckets, Artifact Registry, Secret Manager, Cloud DNS) and the plant VPC with an edge VM that has no inbound path, Cloud NAT and IAP access. The edge VM hosts k3s with Cilium, which runs Akri. The plant VPC reaches Pub/Sub only outbound over HTTPS.