Nubenetes

Enterprise GitOps architecture for Red Hat Build of Keycloak on OpenShift 4.20+ on AWS with Microsoft Entra ID & Active Directory federation, OAuth 2.1 PKCE/BFF flows, Jenkins CI/CD, External Secrets Operator, and Day 0/1/2 automation.

Enterprise Immutable CI/CD & Multi-Cluster GitOps on Red Hat OpenShift 4.20+ with Jenkins JCasC, Job DSL, Buildah, Skopeo, and ArgoCD

A curated list of awesome references collected since 2018.

GKE Golden-Path IDP + Backstage portal, all-IaC (GHA + keyless WIF). Pluggable CI — 4 engines (Jenkins · Tekton · GitHub Actions/ARC · Argo Workflows) & secrets (imperative | Secret Manager+ESO); OTel → 4 Grafana backends (Cloud/OSS/Azure/AWS); ArgoCD + Argo Rollouts; Spot CI; Gateway+IAP SSO; HA CNPG + dev tier; Dataplane V2+WireGuard; DevSecOps

GitOps target-state for the GKE Golden-Path IDP, synced by ArgoCD: Helm chart for the JHipster microservices + parameterized CNPG Postgres — stable HA (3 + PgBouncer + backups) or optional lean develop tier — zero-trust NetworkPolicies, OTel auto-instrumentation, ArgoCD App/AppSet manifests. Any of the 4 CI engines write the image tags.

Portable Helm chart: Traefik v3.7.6 + Keycloak-protected dashboard (oauth2-proxy/ForwardAuth) for OpenShift, RKE2, k3s, kubeadm & Tanzu. Feature-flag driven — MetalLB/NSX ALB/kube-vip/Cilium LB, External Secrets+Vault, optional NetworkPolicies, air-gap. Fail-fast validation. AI-generated, not yet tested on a live cluster.

On-prem, air-gapped OpenShift (OCP 4.20+) reference: official Traefik ingress via MetalLB with its dashboard secured by Keycloak SSO (oauth2-proxy + ForwardAuth, role-restricted). GitOps via ArgoCD App-of-Apps (Helm + Kustomize). Secrets from HashiCorp Vault (External Secrets). AI-generated, not yet tested on a live cluster.

Vision 2026: Azure/Terraform Blueprint (AKS, App Service, Entra ID). Zero-trust & OIDC. Human-crafted code base with AI-enhanced documentation (NotebookLM/Docs).