Platform EngineeringGolden PathGitOps-Native

The Golden Path
to Modern Development

An Internal Developer Portal built around one identity, one catalog, and a working golden path — self-hosted, open source, and MVP live today.

Try It With Me
Fit Check

Who This Is For

An honest read on where W'xOps fits today — and where it doesn't, yet.

Who this is for

  • Teams already committed to Kubernetes + GitOps
  • Teams that want zero plugin/runtime overhead
  • Teams comfortable with an opinionated stack (Gitea, ArgoCD, Crossplane, Vault, Kyverno) today

Who this isn't for (yet)

  • Non-Kubernetes or hybrid VM/serverless workloads
  • Teams needing a large existing plugin ecosystem
  • Teams needing enterprise SLAs / support contracts
Platform Engineering

The Golden Path

A pre-paved, opinionated path from developer idea to production. Zero boilerplate, zero ops tickets, zero guesswork.

1

Write Code

Developer

Day 0
2

Pick Template

Service Catalog

Golden Path
3

CI/CD Pipeline

Auto-triggered

Automated
4

Security Gate

Policy as Code

0 Manual Steps
5

Deploy

Kubernetes / Cloud

< 5 min
6

Observe

Logs + Metrics + Traces

Built-in
Platform ticket + hand-edited YAML→One portal form

New service bootstrap

Second login for kubectl→One Pinniped token

Cluster access

Chase approvals in Slack→Role-gated promotion panel

Staging & production promotion

Core Principles

Paved Road, Not a Cage

Golden Paths are the easiest path — not the only one. Teams can deviate when justified, but the default keeps everyone productive and safe.

Platform as a Product

Built by treating internal developers as the customer — feedback shapes what ships next.

Self-Service by Default

Developers provision services, add team members, rotate secrets — all without filing tickets or waiting on platform team's approval.

Shift-Left Everything

Security, compliance, observability — baked in from day one, not bolted on after the fact. Less panic, smoother audits.

IDP Capabilities

Everything a Developer Needs

Six core capabilities — each grounded in how the platform actually works, not marketing math.

Universal Identity

Architecture Win

One Pinniped-issued OIDC token works for the portal, kubectl, and CI — no second login, no separate kubeconfig ceremony, no service accounts to rotate. Access control is native Kubernetes RBAC, derived straight from your identity provider's groups.

  • Pinniped — Kubernetes-native OIDC
  • One token: portal + kubectl + CI
  • RBAC derived from IdP groups
  • Nothing stored, nothing to drift
No portal permission system — Kubernetes RBAC is the source of truth

One-Click Onboarding

Speed Win

Fill in an app name, pick a Golden Path template, and the portal creates your Gitea repo, writes empty Vault secrets, and opens a gitops-infra pull request. Merge it and ArgoCD + Crossplane take it from there.

  • Gitea repo + CI pipeline scaffolded
  • Vault secrets pre-provisioned
  • gitops-infra PR opened automatically
  • ArgoCD sync → Crossplane provisions the app
No platform ticket, no YAML hand-editing

Service Catalog

Productivity Win

A searchable registry of every service, API, and resource — read straight from Backstage-compatible YAML in your gitops-infra repo. No database, no plugin server: the portal caches for five minutes and invalidates instantly on a Gitea push webhook.

  • Backstage-compatible entity schema
  • Client-side FlexSearch — no round-trip
  • Owner, lifecycle & dependency graph per entity
  • Webhook-driven cache invalidation
  • RFC / ADR / Runbook docs entities, rendered from Gitea Markdown
No Backstage runtime — Git is the catalog

Automated Pipelines

Velocity Win

Push to Gitea and the pipeline runs on self-hosted Gitea Actions. ArgoCD syncs the GitOps overlay, Crossplane expands the tenant app, and the ArgoCD Image Updater keeps image tags current — dev auto-syncs, staging and production wait on a manual gate.

  • Gitea Actions — self-hosted CI
  • ArgoCD GitOps sync + Crossplane provisioning
  • Image tags managed by ArgoCD Image Updater
  • Role-gated promotion past experimental
Auto-sync in dev, manual gate for staging & prod

GitOps-Only, Read-Only by Design

Compliance Win

The portal never writes to a Kubernetes API — every configuration change is a reviewable Gitea pull request. Vault access is write-only (no reads, no deletes), deletes are platform-team-only, and Kyverno policies enforce network isolation and quotas automatically on every tenant namespace.

  • Portal never writes to any cluster API
  • Vault: create/update only — no reads, no deletes
  • Kyverno auto-provisions network policy + quotas
  • Every write logged for audit
Every change is a Git commit with a reviewer

Darlane — On-Demand Debug Pods

Inner-Loop Win

Provision a parallel debug pod alongside your live deployment — same namespace, same secrets, same environment. Stream local file changes straight into the running pod and get a real exec session, without touching the main workload.

  • Same namespace & secrets as the main pod
  • Live file sync via `wxops darlane sync`
  • Traffic split by weight or header, dev-first
  • Role-gated for staging & production
Real exec session, zero blast radius on the live pod
How Identity Actually Wires Together

One Login, Every System

This is the real request path — Pinniped as the Kubernetes-native OIDC layer, not a diagram we drew for the pitch.

W'xOps OAuth2 / OIDC request flow — Traefik, OAuth2 Proxy, Pinniped Supervisor and Concierge, Gitea as upstream identity provider
View full size
1

One redirect, one login

A request hits Traefik and gets routed through ForwardAuth / OAuth2 Proxy to the Pinniped Supervisor for an OIDC + PKCE login — no per-app credentials.

2

Gitea is the upstream IdP

The Supervisor federates to Gitea for the actual login and scopes/claims. The portal never sees a password — only the resulting identity token.

3

Per-cluster token exchange

For every spoke cluster, the portal exchanges the session token via the Pinniped Concierge (JWTAuthenticator) — cluster-scoped, audience-bound, short-lived.

4

Kubernetes RBAC decides, not the portal

The Concierge-issued identity is checked against native ClusterRoleBinding rules on the spoke. There is no separate permission system to keep in sync.

Nothing is stored, nothing can drift.See the full diagram
The Full Platform, Mapped

From Who Uses It to What Runs It

Stakeholders and developers on the left, the WxIDP tenant surface in the middle, the WxInfrastructure and WxPlatform planes on the right — this is the actual system map, not a simplified pitch version of it.

W'xOps platform landscape — stakeholders, the WxIDP tenant surface, WxInfrastructure, and the WxPlatform orchestration, data, security, ingress, monitoring, and policy planes
View full size
Technical Architecture

Built on Open Standards

A layered, open-source stack — no vendor lock-in. Everything is composable, replaceable, and cloud-agnostic.

Developer Experience Layer

What every engineer sees and touches

Portal UI

Service Catalog

Self-Service CLI

Docs as Code

Team Management

Platform Services Layer

The engines powering the Golden Path

Identity

CI/CD

Provisioning

Secret Management

Policy Engine

Registry

Infrastructure Layer

The foundation everything runs on

Kubernetes

Kustomize

Ingress

Observability

Data Layer

Full Technology Stack

PinnipedIdentity
GiteaGit / CI / Registry
ArgoCDGitOps
CrossplaneProvisioning
KyvernoPolicy
HashiCorp VaultSecrets
KubernetesRuntime
KustomizeConfig
TraefikIngress
Grafana StackObservability

Start Your Golden Path
Today

MVP live. Core golden path works end-to-end — open source, self-hosted, and actively shipping.

  • Golden-path scaffolding works end-to-end
  • wxops CLI + Darlane debug pods shipped in v0.4.x
  • Every change is a reviewable Git PR — never a direct write
  • Self-service infrastructure — no ticket queue
  • Open source, no vendor lock-in
  • Self-hosted — your data stays in your infrastructure
Try It With Me

Open source · MIT License · No vendor lock-in · Self-hosted