Skip to main content

Architect / Evaluator Learning Path

Purpose: For architects and evaluators, provides a guided reading order focused on architecture decisions, trade-offs, and deployment models.

Reading Order

#PhaseTopicLinkTime
1OverviewWhat is openCenterOverview5 min
2OverviewPlatform architectureArchitecture10 min
3OverviewEcosystem (5 repos, how they connect)Ecosystem10 min
4OverviewEditions & pricingEditions10 min
5DesignDeployment models (connected vs air-gapped)Models10 min
6DesignReference topologiesTopologies10 min
7DesignCapacity sizingSizing10 min
8SecurityDefense in depth (5 layers)Defense15 min
9SecurityKyverno policies (17 ClusterPolicies)Kyverno10 min
10SecuritySOPS secrets lifecycle (90-day Age, 180-day SSH)Secrets10 min
11GitOpsThree-repo layering (base → enterprise → cluster)GitOps10 min
12GitOpsService delivery model (Kustomize overlays)Delivery10 min
13ServicesPlatform service catalog (20+ services, versions)Catalog10 min
14OperationsLifecycle model (init → validate → generate → deploy)Lifecycle5 min
15OperationsDrift detection & reconciliationDrift10 min
16Air-gapThree-zone architecture (Factory → Airlock → Field)Air-gap10 min
17ScaleMulti-cluster fleet managementFleet10 min

Architecture at a Glance

openCenter-cli (configuration + generation)
↓ generates
Customer GitOps Repository (infrastructure + applications)
↓ references
openCenter-gitops-base (20+ platform services, Kyverno policies)
↑ imported by (Enterprise/Regulated editions)
openCenter-gitops-enterprise (private sources, hardened values, managed services)
↓ deployed by
FluxCD → Production Kubernetes Cluster

Evaluation Checklist

After completing this path, you should be able to answer:

  • Does openCenter's provider model fit our infrastructure (OpenStack, VMware, Bare Metal)?
  • Does the GitOps workflow align with our change management process?
  • Are the security controls sufficient (Kyverno policies, PSA, SOPS, Keycloak RBAC)?
  • Can the platform scale to our projected cluster count and node density?
  • Do we need Enterprise edition (private chart sources, 24×7 support) or Regulated (FIPS, air-gap, evidence automation)?
  • What is the operational burden compared to our current tooling?

Key Differentiators

  • 100% open-source core — no proprietary APIs, no vendor lock-in
  • Configuration-first: single YAML file → complete cluster with GitOps
  • Three-repo layering: base (community), enterprise (private hardened), cluster (local overrides)
  • Defense-in-depth security: PSA + Kyverno + SOPS + Keycloak RBAC + NetworkPolicies
  • Air-gap capable: Zarf-based packaging with SBOM and cryptographic signatures