Kubernetes

Kubernetes add-on modules for service mesh, certificate management, policy enforcement, and cluster-level observability. These modules run on the GKE clusters provisioned by Pneuma.

Modules

pt-arche-kubernetes-istio

OpenTofu module that deploys the Istio service mesh on GKE using Helm charts with optional ingress gateway, Cloud Armor WAF with adaptive protection and rate limiting, and cert-manager integration for ingress gateway TLS

pt-arche-kubernetes-cert-manager

OpenTofu module that generates a self-signed ECDSA root CA and deploys cert-manager via Helm; the regional subdirectory deploys istio-csr to replace istiod's Citadel CA for Kubernetes workload certificate signing

pt-arche-kubernetes-datadog-operator

OpenTofu module that deploys the Datadog Operator via Helm and manages a DatadogAgent custom resource. Platform invariants — Admission Controller, Workload Autoscaling, log collection, NPM, Orchestrator Explorer, SBOM, CSPM, and CWS — are always enabled. APM and Universal Service Monitoring are opt-in per team via the Logos schema.

pt-arche-kubernetes-opa-gatekeeper

OpenTofu module that deploys OPA Gatekeeper via Helm and manages ConstraintTemplate and Constraint resources for admission-time policy enforcement across GKE clusters

pt-arche-kubernetes-authentik

OpenTofu module that deploys Authentik on GKE via Helm and configures it as the centralized gateway identity provider, providing both an OIDC identity provider for Istio RequestAuthentication and an embedded outpost for the Istio ext_authz check endpoint