Service Catalog & Lifecycle
Purpose: For platform engineers, provides the complete list of services with versions, namespaces, dependencies, and lifecycle information.
Service Catalog
Networking
| Service | Chart Version | Namespace | Default |
|---|
| Calico | v3.31.3 | calico-system | ✅ |
| MetalLB | 0.15.2 | metallb-system | ✅ |
| Gateway API | latest | envoy-gateway-system | ✅ |
| Istio | 1.28.3 | istio-system | ❌ |
Security
| Service | Chart Version | Namespace | Default |
|---|
| cert-manager | v1.18.2 | cert-manager | ✅ |
| Kyverno | 3.6.0 | kyverno | ✅ |
| Sealed Secrets | 2.17.3 | sealed-secrets | ❌ |
Identity & Access
| Service | Chart Version | Namespace | Default |
|---|
| Keycloak | 26.4.2 | keycloak | ✅ |
| RBAC Manager | 1.21.1 | rbac-manager | ✅ |
Storage
| Service | Chart Version | Namespace | Default |
|---|
| Longhorn | 1.11.0 | longhorn-system | ✅ |
| vSphere CSI | 3.8.1 | vmware-system-csi | Provider |
| OpenStack CSI | 2.33.1 | openstack-csi | Provider |
| External Snapshotter | v8.2.1 | external-snapshotter | ✅ |
Observability
| Service | Chart Version | Namespace | Default |
|---|
| kube-prometheus-stack | 77.6.0 | observability | ✅ |
| Loki | 6.45.2 | observability | ✅ |
| Tempo | 1.55.0 | observability | ✅ |
| Mimir | 6.0.3 | observability | ❌ |
| OpenTelemetry Kube Stack | 0.11.1 | observability | ❌ |
Data
| Service | Chart Version | Namespace | Default |
|---|
| PostgreSQL Operator | 1.14.0 | postgres-operator | ❌ |
| Strimzi Kafka Operator | 0.50.0 | kafka-system | ❌ |
Backup & Recovery
| Service | Chart Version | Namespace | Default |
|---|
| Velero | 10.1.1 | velero | ✅ |
Management & UI
| Service | Chart Version | Namespace | Default |
|---|
| Headlamp | 0.35.0 | headlamp | ✅ |
| OLM | v0.34.0 | olm | ❌ |
| Harbor | 1.17.2 | harbor | ❌ |
Cloud Provider Integration
| Service | Chart Version | Namespace | Default |
|---|
| OpenStack CCM | 2.33.1 | openstack-ccm | Provider |
Enterprise-Only (Managed Services)
| Service | Chart Version | Namespace | Delivery |
|---|
| Alert Proxy | 0.0.1 | alert-proxy | Enterprise |
Service Lifecycle
- Onboarding: New service added to
openCenter-gitops-base with hardened base values
- Versioning: Pinned to specific Helm chart versions in
helmrelease.yaml
- Upgrade: Version bumps via gitops-base tag releases
- Deprecation: Announced with migration path, removed after grace period
Delivery Models
| Model | Source Repository | Use Case |
|---|
| Community | openCenter-gitops-base | Direct upstream Helm charts |
| Enterprise | opencenter-gitops-enterprise | Private OCI charts, hardened values, enterprise overlays |
| Managed | opencenter-gitops-enterprise | Enterprise-only services with no base counterpart |
Values Layering
Services support three-tier values layering (merged in order, later wins):
- Chart defaults — from upstream Helm chart
- Base values — hardened defaults in
openCenter-gitops-base (helm-values/values-v<version>.yaml)
- Enterprise values — private enterprise values (optional, from
opencenter-gitops-enterprise)
- Cluster override — cluster-specific values via Secret in consuming cluster repo
Kyverno Default Policies (17 ClusterPolicies)
The Kyverno service deploys a default ruleset enforcing pod security best practices:
- disallow-privileged-containers
- disallow-host-namespaces
- disallow-host-ports
- disallow-host-path
- disallow-host-process
- disallow-privilege-escalation
- disallow-proc-mount
- disallow-selinux
- disallow-capabilities
- disallow-capabilities-strict
- require-run-as-nonroot
- require-run-as-non-root-user
- restrict-apparmor-profiles
- restrict-seccomp
- restrict-seccomp-strict
- restrict-sysctls
- restrict-volume-types