Warning

This Repository is under development and not ready for productive use. It is in an alpha stage. That means APIs and concepts may change on short notice including breaking changes or complete removal of apis.

Platform Mesh

Description

Platform Mesh is an open, multi-tenant developer platform built on kcp. It provides account-based tenancy, relationship-based authorization (ReBAC via OpenFGA), search, and UI extensibility on top of a Kubernetes-like control plane.

This repository is the Platform Mesh monorepo: it consolidates the shared libraries, operators, services, and tooling that make up the platform. Each component is its own Go module, linked together through the repository-root go.work workspace, and released independently via component-scoped tags.

Components

Libraries

Module	Description
apis	Shared CRD Go types, deepcopy, and scheme for the *.platform-mesh.io API groups.
golang-commons	Reusable Go libraries (JWT, context, error handling, logging, controllers) shared across components.
subroutines	Lifecycle engine for Kubernetes/kcp controllers with Result-based flow control, conditions, and observability.

Operators

Operator	Description
account-operator	Manages the core Account grouping resource and its owned namespace.
backup-operator	Orchestrates Velero, CloudNativePG, and etcd-druid to back up and restore a Platform Mesh deployment.
extension-manager-operator	Lifecycle management of ContentConfiguration resources for Micro Frontends.
kcp-migration-operator	Synchronizes custom resources from existing Kubernetes clusters into kcp workspaces.
resource-sharding-operator	Assigns resources to shards via labels so downstream operator replicas filter their watches by shard.
search-operator	Indexes kcp workspaces and accounts into OpenSearch together with OpenFGA permission tuples.
security-operator	Manages security-related configuration (authorization models, identity providers, tuples, stores, invites).
terminal-controller-manager	Manages browser-based terminal sessions (ephemeral pods) to kcp workspaces.

Services

Service	Description
iam-service	GraphQL API for user and role management, driving OpenFGA and the identity provider (Keycloak).
search-service	REST API to query OpenSearch-indexed resources with OpenFGA post-filtering.
virtual-workspaces	Custom kcp-based virtual workspaces that expose tailored data to UIs.
rebac-authz-webhook	Kubernetes authorization webhook backed by OpenFGA (ReBAC).
kubernetes-graphql-gateway	Exposes Kubernetes resources as a GraphQL API for UIs and tools.

Tooling

Repository tooling lives under cmd/ — including release, which cuts component-scoped release tags for the monorepo.

Getting started

Each module can be built and tested on its own, or through the repository-root Taskfile, which fans out to every component:

task build      # build all components
task test       # test all components
task lint       # lint all components
task verify     # lint + test

Target a single component with the <target>-<component> pattern:

task build-iam-service
task test-account-operator
task images-search-service VERSION=v0.1.0 PUSH=false

The modules are linked through the root go.work, so cross-module changes resolve against local source during development.

Development

For the inner loop, Tilt replaces the OCM/Flux delivery pipeline: static infrastructure is deployed once into a kind cluster, and the components you are working on hot-reload in seconds.

# the cluster MUST be named platform-mesh — the Tiltfile refuses any kube
# context other than kind-platform-mesh, so a stray `tilt up` cannot hit a
# shared cluster. Override with TILT_ALLOWED_CONTEXT.
kind create cluster --name platform-mesh
tilt up -f contrib/tilt/Tiltfile -- --profile=core,auth

The -- matters: everything after it is parsed by the Tiltfile, not by Tilt itself.

Profiles

Profiles are independent feature layers, not an ordered ladder — each only ever adds resources, so several can be requested at once (--profile=core,auth, --profile=core --profile=auth, or --profile=full for all of them). An unknown profile fails the Tiltfile rather than being silently ignored, so a typo cannot quietly give you a smaller environment than you asked for.

Profile	Adds
infra	the base environment — namespace, cert-manager issuer, envoy Gateway, a mutual-TLS etcd, dex, and kcp, which platform-mesh-deployer builds from a PlatformMesh. Always on; naming it is allowed but redundant
core	nothing yet (reserved)
auth	the ReBAC authorization webhook secret on kcp (L3)
full	shorthand for all of the above

Working against local checkouts

The Helm charts are fetched remotely by default. Point them at a local clone to work offline or to hack on them:

export HELM_CHARTS_DIR=$HOME/go/src/github.com/platform-mesh/helm-charts

kcp needs no such override: it is built in-cluster from a PlatformMesh rather than fetched, so there is nothing external to pin.

Validating manifests without a cluster

TILT_NO_INFRA=1 tilt alpha tiltfile-result -f contrib/tilt/Tiltfile -- --profile=full

This renders the local manifests and the PlatformMesh and topology templates kcp is built from, with every substitution applied — no cluster and no remote fetches — so gateway wiring, OIDC issuer and the authorization webhook can be confirmed before deploying.

See contrib/tilt/README.md for the full environment: what each resource is, how kcp gets built, and how to poke at it.

Releasing

Releases are component-scoped: tagging <component>/vX.Y.Z triggers that component's GitHub Actions workflow to build and sign its image, cut a GitHub release, bump its chart, and publish a signed OCM component. The release tool (task release) manages the tag registry and ordering.

Requirements

Building Platform Mesh requires an installation of Go. Checkout each module's go.mod for the required Go version and dependencies.

Contributing

Please refer to the CONTRIBUTING.md file in this repository for instructions on how to contribute to Platform Mesh.

Code of Conduct

Please refer to our Code of Conduct for information on the expected conduct for contributing to Platform Mesh.

Licensing

Please see our LICENSE for copyright and license information. Detailed information including third-party components and their licensing/copyright information is available via the REUSE tool.