Onboarding path

These are the steps to implement our principles and land an application on Kubernetes. Work through them in order. Each one assumes the previous is done.

1. Add a tenant on a Kubernetes cluster

   You have a namespace prefix you are allowed to create namespaces under, a resource quota, and a Vault-backed secret store.

2. Containerize your application

   Every sub-system of your application builds to a small, pinned, non-root image, published to Harbor.

3. Make your application Kubernetes ready

   Your application is packaged as a documented Helm chart and reports its own state through health probes.

4. Handle secrets the FLOW way

   No secret lives in your repository. External Secrets Operator injects them at runtime, and Reloader restarts pods when they change.

5. Connect to central Identity and Access Management

   Your tenant is registered with the central Keycloak instance.

6. Arrange your data storage

   You have chosen a database approach, and where you need shared volumes, NFS-backed storage is in place.

7. Instrument for observability

   Your application emits metrics, logs and traces through OpenTelemetry into the platform stack, with alerts routed to your team.

8. Add automated tests

   Your functional and performance tests run locally and in the pipeline, and ship as deliverables with your release.