Self-hosted platform engineering lab: Kubernetes infrastructure, a GitOps platform, and the applications that run on it.
The lab is run to the standard a paying customer's workloads would need: bare-metal provisioning, GitOps delivery, and application services, built and operated with the same rigor as a production shop.
What "done" means here:
- Every change ships through a reviewed, green-CI pull request. Nothing is pushed directly to
main. - A GitOps change isn't done at green CI; it's done when ArgoCD reports the workload Synced + Healthy against the live cluster.
- Docs are code: paths and structure claimed in a README must resolve in the repo, or it's a bug, not a typo to shrug off.
The org-wide code standards spell out the full contract this repo map exists to enforce.
The lab is split into four layers. Each has one job, and a layer can change without the layers above it noticing.
flowchart TD
subgraph tenants["Per tenant: jdwlabs · jdwillmsen · dotablaze-tech"]
apps["<b>Applications</b>\nthe software being built"]
delivery["<b>Delivery</b>\neach tenant's GitOps desired state"]
end
platform["<b>Platform</b>\nsecurity baseline every tenant inherits, plus shared services"]
infra["<b>Infrastructure</b>\ncontrol plane that provisions compute and clusters on any hardware"]
apps -->|"images"| delivery
delivery -->|"runs on"| platform
platform -->|"runs on"| infra
| Layer | Job | Repo |
|---|---|---|
| Infrastructure | The lab's own cloud provider: provisions compute and clusters on whatever hardware is underneath | infrastructure |
| Platform | The managed layer, comparable to a managed Kubernetes service: a security baseline every tenant inherits (scoped access, pod security, network policy, quotas) plus shared services such as databases, storage, certificates, secrets, monitoring and alerting | platform |
| Delivery | What a tenant runs, declared in Git and kept apart from application code | deployments for the jdwlabs tenant |
| Applications | The software being built; it produces images and never deploys itself | apps for the jdwlabs tenant |
The platform hosts other tenants alongside jdwlabs, each with its own delivery and application repos: jdwillmsen and dotablaze-tech.
The apps repo also holds the AI SRE relay, a Go service that runs an LLM investigation on each Alertmanager alert and tracks the alert as a ticket until it resolves.
Maintainer: Jake Willmsen
