A GitOps-based internal developer platform on Kubernetes. Argo CD reconciles everything in this repo, Kyverno enforces admission policies, and External Secrets syncs secrets — with a Node.js service as the golden-path template.
An Argo CD root application recursively syncs
apps/, where each manifest is an Argo Application pointing at the
platform component it owns.
| Path | Purpose |
|---|---|
bootstrap/ |
Root Argo CD app that bootstraps everything else |
apps/ |
Argo Application definitions (app-of-apps) |
platform/ |
Cluster components — Kyverno policies, External Secrets |
charts/ |
Helm charts for platform services |
services/ |
Application source code (node-api) |
previews/ |
Per-PR preview environments |
examples/ |
Demo manifests for the Kyverno policies |
.github/workflows/ |
CI, preview, and cleanup pipelines |
Prerequisites: kind, kubectl, helm, and docker. Your user must be able to
reach the Docker socket — add yourself to the docker group rather than running
the script with sudo, which would write the kubeconfig to root's home.
./bootstrap/install.shThis creates the idp kind cluster, installs Argo CD, seeds the demo secret
backend, and applies the root application. Argo CD then syncs the rest of the
platform automatically.
Watch it converge:
kubectl -n argo-cd get applications -wIf you already have a cluster with Argo CD installed, apply the root application on its own instead:
kubectl apply -f bootstrap/root-application.yamlTo try the admission policies, see examples/README.md.