File Locations

Purpose: For platform engineers, provides paths for config files, generated output, keys, caches, and kubeconfigs.

Configuration Files

File	Description
~/.config/opencenter/clusters/<org>/.<cluster>-config.yaml	Cluster configuration
~/.config/opencenter/config.yaml	CLI settings
~/.config/opencenter/active	Active cluster pointer
~/.config/opencenter/plugins/	External plugins

The --config-dir global flag overrides the default configuration directory.

State Directory

Path	Description
~/.local/state/opencenter/	State directory (bootstrap state, audit logs, locks)
~/.local/state/opencenter/audit/	Audit log entries (HMAC-signed)
~/.local/state/opencenter/audit/audit.key	HMAC-SHA256 signing key

Generated Repository

After opencenter cluster generate, the GitOps repo is created at OPENCENTER_GITOPS_DIR:

<gitops-dir>/
├── applications/
│   └── overlays/<cluster>/
│       ├── flux-system/          # FluxCD bootstrap manifests
│       ├── services/
│       │   ├── sources/          # GitRepository CRDs
│       │   ├── fluxcd/           # Kustomization CRDs
│       │   └── <service>/        # Override values
│       └── managed-services/     # Customer applications
└── infrastructure/
    └── clusters/<cluster>/
        ├── main.tf               # Terraform/OpenTofu entry point
        ├── provider.tf           # Backend configuration
        ├── variables.tf          # Variable definitions
        ├── inventory/            # Kubespray inventory and group_vars
        └── kubeconfig.yaml       # Cluster kubeconfig (post-provision)

Encryption Keys

Path	Description
~/.config/opencenter/clusters/<org>/secrets/age/	SOPS Age keypairs
~/.config/opencenter/clusters/<org>/secrets/ssh/	SSH keypairs

These files are local-only and must not be committed to Git. The Age key is synced to the cluster as a Kubernetes Secret (sops-age in flux-system namespace) by opencenter cluster deploy.

SOPS Configuration

Path	Scope
.sops.yaml (repo root)	Organization-wide encryption rules
infrastructure/clusters/<cluster>/.sops.yaml	Infrastructure secrets
applications/overlays/<cluster>/.sops.yaml	Application secrets

Air-Gap Build Paths

After opencenter-airgap init:

Path	Description
config/versions.env	Component version pinning (source of truth)
config/components.yaml	Component manifest (auto-generated + manual additions)
config/schemas/	JSON Schema validation files
build/	Intermediate build artifacts
build/state.json	Checkpoint state for resume
dist/	Final Zarf package output
dist/artifact-manifest.json	Package checksums
assets/	Downloaded assets bundled into package
.secrets/	Cosign keys (mode 0700, gitignored)

Logs

Path	Description
~/.local/state/opencenter/audit/	CLI audit logs (30-day retention, 100 MB max)
/opt/opencenter/logs/	Air-gap deployment logs (Zone C bastion)

Kubeconfig

After infrastructure provisioning, the kubeconfig is written to:

infrastructure/clusters/<cluster>/kubeconfig.yaml

The opencenter cluster env command sets KUBECONFIG to this path automatically:

eval "$(opencenter cluster env <org/name>)"