Aether — Kubernetes workload dashboard

Aether — Kubernetes workload dashboard An architecture diagram generated by Archify. Git · Forgejo + GitHub · Architecture component · source + deploy Git Forgejo + GitHub source + deploy GHCR · image + Helm chart · Architecture component · public GHCR image + Helm chart public Argo CD · prune + selfHeal · Kubernetes cluster Argo CD prune + selfHeal Users · Browser · Architecture component Users Browser Traefik · Ingress · TLS · Kubernetes cluster · MetalLB Traefik Ingress · TLS MetalLB Aether · Axum + Leptos/WASM · Kubernetes cluster · :3000 Aether Axum + Leptos/WASM :3000 Launched workloads · JupyterLab · RStudio · vLLM · Kubernetes cluster · ClusterIP Launched workloads JupyterLab · RStudio · vLLM ClusterIP cert-manager · ClusterIssuer internal-ca · Kubernetes cluster cert-manager ClusterIssuer internal-ca PostgreSQL · CloudNativePG :5432 · Kubernetes cluster PostgreSQL CloudNativePG :5432 Kubernetes API · namespace-scoped Role · Kubernetes cluster Kubernetes API namespace-scoped Role HTTPS Host routing reverse proxy deploys SQL aether-tls created by Aether CI publishes chart + image Kubernetes cluster Legend Backend Database Cloud Security External

Origin isolation

  • • Each app is served from <name>.proxy.<base>
  • • A separate origin keeps its JS away from /api/*

Control plane

  • • Namespace-scoped Role, never a ClusterRole
  • • Ownership enforced on every read and write

Supply chain

  • • CI holds no cluster credentials at all
  • • Argo CD is the only writer, running in-cluster