Kubernetes

Kubernetes add-on modules for service mesh, certificate management, policy enforcement, and cluster-level observability. These modules run on the GKE clusters provisioned by Pneuma.

Modules

pt-arche-kubernetes-istio

OpenTofu module that deploys the Istio service mesh on GKE using Helm charts with optional ingress gateway, Cloud Armor WAF with adaptive protection and rate limiting, and cert-manager integration for ingress gateway TLS

pt-arche-kubernetes-cert-manager

OpenTofu module that generates a self-signed ECDSA root CA and deploys cert-manager via Helm; the regional subdirectory deploys istio-csr to replace istiod's Citadel CA for Kubernetes workload certificate signing

pt-arche-kubernetes-datadog-operator

OpenTofu module that deploys the Datadog Operator via Helm and manages a DatadogAgent custom resource. Platform invariants — Admission Controller, Workload Autoscaling, log collection, NPM, Orchestrator Explorer, SBOM, CSPM, and CWS — are always enabled. APM and Universal Service Monitoring are opt-in per team via the Logos schema.

pt-arche-kubernetes-opa-gatekeeper

OpenTofu module that deploys OPA Gatekeeper via Helm and manages ConstraintTemplate and Constraint resources for admission-time policy enforcement across GKE clusters

Components

These modules cover the Kubernetes layer of Arche. All are deployed by Pneuma onto GKE clusters.

Module	Consumed By	Purpose
pt-arche-kubernetes-istio	Pneuma	Istio service mesh with ingress gateway and Cloud Armor WAF
pt-arche-kubernetes-cert-manager	Pneuma	cert-manager with Let's Encrypt ACME issuance
pt-arche-kubernetes-datadog-operator	Pneuma	Datadog Operator and Agent DaemonSet
pt-arche-kubernetes-opa-gatekeeper	Pneuma	OPA Gatekeeper with constraint templates