Skip to main content

W'xOps Portal v0.1.0 — Identity & Service Catalog

Xeus Nguyen
Xeus Nguyen
Platform Engineer

The first published image of W'xOps Portal — a multi-cluster Kubernetes management portal built around Pinniped Supervisor single sign-on. It ships Phase 1 (Identity & Multi-Cluster Access) and Phase 2 (Service Catalog) as complete, production-ready features.

What's included​

Phase 1 — Identity & Multi-Cluster Access​

One login covers every spoke cluster. No per-cluster popups, no credential duplication.

  • Pinniped Supervisor OIDC with PKCE — the portal federates to any upstream IdP (Dex, Gitea OAuth2, LDAP, SAML) via the Supervisor FederationDomain.
  • RFC 8693 token exchange — the Supervisor id_token is exchanged for a short-lived audience-scoped token per spoke cluster.
  • Pinniped Concierge mTLS certs — TokenCredentialRequest issues 15-minute client certificates; the portal caches them to avoid redundant requests.
  • Cluster registry — clusters are registered via K8s Secrets in production (wxops.cloud/kind=cluster label) or a local clusters.json for development.
  • Kubeconfig download — users can download a ready-to-use kubeconfig that calls the portal as a Pinniped exec-credential plugin.

Phase 2 — Service Catalog​

Browse every platform service, API, and infrastructure dependency from one place.

  • Backstage-compatible entity parser — reads catalog-info.yaml files for kinds: Component, API, System, Group, and Resource.
  • Gitea source — catalog entities are fetched from a read-only Gitea repository (gitops-infra/catalog/). A local filesystem reader is available for development and testing.
  • 5-minute TTL cache — double-checked locking prevents thundering-herd refreshes under load.
  • System relationship graph — each System entity renders a Mermaid diagram showing how its components, APIs, and resources connect.
  • Entity detail page — links to runbooks, RFCs, and ADRs are grouped and surfaced directly on the entity page.

Container​

  • Single Docker image — nginx, Go backend, and Next.js run together under supervisord. The Kubernetes Ingress is the only external entry point.
  • Port layout — nginx on :80 (public); Go backend on :8080 (internal); Next.js on :3000 (internal).

What's next​

PhaseGoal
3Service Graph + Project Scaffold — form → ProjectClaim → ArgoCD → Crossplane
4CLI — wxops binary usable in CI/CD pipelines
5Platform Intelligence — cost attribution, compliance, aggregate health

Resources​