CI/CD
To make pipelines more maintainable, a set of Gitlab common jobs are developed. Next to that, for Continuous Deployment we deploy an ArgoCD instance.
More flow in development, less friction in maintenance
FLOW is the development and deployment platform of the Watermanagement department within Rijkswaterstaat. It is a set of architectural principles, best practices and tools that help us to streamline development and operational workflows.
Simplicity
Provide a robust, simple and scalable environment for building, testing, and deploying applications.
Consistency
Make the deployment and operation of our applications consistent, so application maintainers can easily switch between applications.
Self-service
Let teams provision and manage what they need on their own, without waiting for a ticket or a handover.
Standardization
Provide standard solutions for common operational concerns.
Platform capabilities
What FLOW provides out of the box
Secrets Management
Application deployments rely on secret information — tokens, passwords, certificates — while, for security reasons, you cannot store secrets in your code repository. FLOW solves this by using external-secrets-operator.
Policy Management
FLOW deploys and maintains a set of common Kyverno policies concerning for example image signatures, egress variables and running as non-root.
Observability
Alerting, monitoring, logging and tracing through a Grafana stack implementation based on the OpenTelemetry standards.
Multi-tenancy
Teams share the same platform without getting in each other’s way. Every tenant gets its own isolated namespaces, access rights and resource boundaries, so workloads stay separated while the platform is operated and upgraded as one.
Self-service PostgreSQL
CNPG-deployed databases gain the ability to back up and restore to an external S3 service, provided via s3Proxy with NFS as a storage backend. The Barman Cloud CNPG-I Plugin handles base and WAL archiving, giving you full point-in-time recovery (PITR).
Open source
The open source tooling we build on
FLOW does not reinvent what the community has already solved well. The platform is assembled from established open source projects, so teams work with tools they can learn anywhere and take with them, and we can contribute back what we improve.
- KubernetesRuns every workload
- HelmPackages every release
- GitLab CIPipelines from common jobs
- Argo CDGitOps delivery from Git
- RenovateAutomated dependency updates
- HarborRegistry for images, charts
- Sigstore CosignSigns and verifies images
- TrivyScans images for CVEs
- KyvernoCluster policies as code
- External Secrets OperatorSecrets injected at runtime
- OpenTelemetryMetrics, logs and traces
- GrafanaDashboards and alerting
- CloudNativePGPostgreSQL, Kubernetes-native
- Barman CloudS3 archiving for PITR
Our own platform components are open source as well. They are published on code.overheid.nl and mirrored to Codeberg, both running the open source forge Forgejo.
A platform is never finished
FLOW is a living platform that will evolve over time. By employing iterative design and development we continuously strive to improve. Together with our users, we will shape the future of the platform. We aim to keep the platform as simple as possible, but no simpler.