osinfra.io

🔐

Guardrails by default

Platform-managed projects include established security controls, encrypted state, audit logging, and policy enforcement. Your team owns its workload while the platform owns the shared guardrails.

📦

Built on open standards

Infrastructure automation and runtime tooling are built on CNCF and Linux Foundation open-source projects — Kubernetes, Istio, cert-manager, OPA Gatekeeper, OpenTofu, OpenBao. No proprietary abstractions, no lock-in, no black boxes.

🤖

A self-service entry point

The Nomos Agent collects team requirements, validates them, and proposes reviewed infrastructure changes through pull requests.

🤝

Innersource, not a bottleneck

Arche, Ekklesia, and Techne run as innersource repositories — any engineer can open a pull request, and platform engineers from staffed teams review. Stream-aligned teams unblock themselves by contributing fixes and new capabilities directly to the platform.

Start with one clear request

The Nomos Agent turns team requirements into validated, reviewable pull requests. Use the prompt builder to provide the information needed by Logos and any downstream platform services.

Build your agent prompt →

Onboard a new team — Fides. Team key: st-fides. Maintainers: joesmith. Admin email: joe@osinfra.io.

👋 Hi! I'm the Nomos Agent — onboarding a new team for you now.

Give me just a moment while I look you up…

✓ get_me → joesmith · joe@osinfra.io · osinfra-io member

✓ lookup_user → no existing team memberships found

Welcome! I have everything I need from your prompt. Here's what I'll create for st-fides:

📁 GCP folder — Fides with Sandbox / Non-Production / Production sub-folders
👥 Google Identity groups — admin, reader, writer per environment
🐙 GitHub parent team st-fides + 4 standard child teams
🐶 Datadog team — Fides, admin: joe@osinfra.io

Any optional features to enable — Google Cloud project, OpenTofu state management, or additional GitHub repositories?

Enable google project and workflows. Add repo st-fides-api.

✓ open_team_pr → PR #142 opened on pt-logos

Done — PR #142 is open on pt-logos. Once it merges, your team structure and access foundations will be created.

Optional cloud and Kubernetes capabilities are proposed through the owning platform repositories and follow their sandbox, non-production, and production workflows.

Everything your team needs, out of the box.

From source code management to production support — already in place.

🏭

Continuous delivery enablement

GitHub team structure with branch protection, Workload Identity and OIDC federation for keyless GCP auth, Artifact Registry, encrypted state buckets, reusable GitHub Actions called workflows, and Datadog CI Visibility and Test Optimization.

🏗️

Cloud foundation

CIS-compliant GCP projects with audit logging, billing budgets, and KMS-encrypted state across sandbox, non-production, and production — with Shared VPC networking, per-team DNS subdomain zones, Cloud NAT, managed data services (Cloud SQL, Private Services Access), and namespace provisioning with Workload Identity bindings.

🔒

Security

OpenBao for dynamic credentials, KV2 paths, and a Kubernetes secrets operator — plus Cloud Armor WAF, Istio mTLS with automated certificate rotation, OPA Gatekeeper admission control, CIS-hardened GKE clusters, GitHub secret scanning and Dependabot, and Datadog Application Security Management, SIEM, Cloud Security Posture Management, and Code Security.

🐶

Observability and incident response

Platform-managed Datadog integrations provide cluster telemetry and can enable logs, APM, security features, and cloud-cost visibility where configured.

Open source