Application Team · Design & Onboarding

Application onboarding

How an application is designed, secured, and delivered — from a Git commit to a running, exposed, observed app, riding a paved road that wires TLS, mesh, observability, and policy automatically.

Design

Principles

🚀 GitOps self-service

The app's desired state lives in Git; Argo CD syncs it into the tenant namespace. No kubectl by humans.

🛣️ Paved road

Ingress+TLS, mesh mTLS, tracing, metrics, and policy are provided by the platform — the app declares intent.

✅ Compliant by construction

The recommended manifests already satisfy the guardrails, so the easy way is the compliant way.

🔭 Observability built-in

Traces and metrics appear without instrumenting the app — mesh sidecars + ServiceMonitor.

🧩 Tier-aware

Stateless tiers scale; stateful tiers get stable identity + storage; batch runs as Jobs/CronJobs.

🔒 Least privilege at the edge

The app team operates only inside their namespace, under their scoped AppProject / kubeconfig.

Design

The paved road — provided automatically

🔐
Public URL + TLSnginx ingress + cert-manager — declare an Ingress, get an HTTPS URL with a valid cert.
🛡️
mTLS between servicesIstio sidecars (istio-cni) — be in a mesh-enabled namespace, get zero-trust east-west.
🔭
Distributed tracingIstio → OTel Collector → Jaeger — spans with no application instrumentation.
📈
Metrics & autoscalingPrometheus Operator + metrics-server — emit a ServiceMonitor, declare an HPA.
💾
StorageLonghorn (RWO + RWX) — declare a PVC with storageClassName: longhorn.
⚖️
Policy guardrailsKyverno enforces limits, non-root, no-privileged, approved registry at admission.
Design

Architecture tiers → Kubernetes primitives

Web / API
Stateless, scalable → Deployment · HPA · PDB · Service · Ingress
WordPress (2 replicas, RWX content, HPA 2→4)
Database
Stateful, stable identity → StatefulSet · headless Service · PVC (RWO)
MySQL StatefulSet + Longhorn PVC
Config & secrets
Externalised → ConfigMap · Secret (+ Sealed/External in prod)
my.cnf, php uploads.ini, DB creds
Batch
One-off & scheduled → Job · CronJob · initContainer
wp-install Job · mysqldump backup CronJob · wait-for-mysql
Mesh
Security + telemetry → sidecar · PeerAuthentication · DestinationRule
STRICT mTLS, distributed traces
How

Deployment steps — from one commit

Author

Write manifests/values under apps/<name>/ — the golden-path chart for a simple service, or a kustomize/Helm bundle for a multi-tier app.

Commit

git commit && git push. Argo CD detects the change and syncs it under the tenant's scoped AppProject.

Platform wires it

cert-manager issues TLS; Istio injects sidecars (mTLS + traces); Prometheus discovers the ServiceMonitor; Kyverno admits it.

Live

Open https://<app>.<domain> — running, TLS-terminated, mesh-secured, observed. The app team never ran kubectl.

# the whole full-stack app — web + db + storage + jobs + mesh — from one commit
git add apps/wordpress && git commit -m "deploy wordpress" && git push
# Argo CD reconciles; the platform layers on TLS, mTLS, tracing, metrics, policy.
Tenant onboarding → Full design blueprint ← Portal