{"id":24638070,"url":"https://github.com/upbound/spaces-reference-architecture","last_synced_at":"2025-07-10T08:35:06.897Z","repository":{"id":225732806,"uuid":"766704565","full_name":"upbound/spaces-reference-architecture","owner":"upbound","description":"A reference architecture for deploying a Cloud Native Platform powered by Upbound Self-Hosted Spaces","archived":false,"fork":false,"pushed_at":"2024-05-26T21:56:08.000Z","size":492,"stargazers_count":3,"open_issues_count":0,"forks_count":4,"subscribers_count":18,"default_branch":"main","last_synced_at":"2025-05-08T07:41:02.169Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":null,"has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/upbound.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2024-03-04T00:42:42.000Z","updated_at":"2024-12-09T10:06:52.000Z","dependencies_parsed_at":"2025-03-21T13:35:51.191Z","dependency_job_id":null,"html_url":"https://github.com/upbound/spaces-reference-architecture","commit_stats":null,"previous_names":["upbound/spaces-reference-architecture"],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/upbound/spaces-reference-architecture","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/upbound%2Fspaces-reference-architecture","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/upbound%2Fspaces-reference-architecture/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/upbound%2Fspaces-reference-architecture/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/upbound%2Fspaces-reference-architecture/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/upbound","download_url":"https://codeload.github.com/upbound/spaces-reference-architecture/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/upbound%2Fspaces-reference-architecture/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":264551674,"owners_count":23626536,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2025-01-25T10:12:54.287Z","updated_at":"2025-07-10T08:35:06.840Z","avatar_url":"https://github.com/upbound.png","language":null,"funding_links":[],"categories":[],"sub_categories":[],"readme":"# Upbound Self-Hosted Spaces reference architecture\n\nThis repository contains a reference implementation for deploying Crossplane at scale with Upbound self-hosted Spaces. \n\n## Repository tour\n\nThis repository is a reference architecture for deploying an Upbound self-hosted Space to serve three business units: a consumers services business unit, a manufacturing services business unit, and a marketing business unit. \n\nEach business unit operates their own app teams, deploying software and infrastructure for their line of business. Each business unit deploys software into `test` and `prod` environments. This platform deploys a managed control plane mapping to a cloud account boundary. This reference architectures deploys a control plane group for each business unit, and then 2 control planes for each test and prod software environment. The result is 6 managed control planes, plus a seventh \"sandbox\" control plane which all business units can use for a sandbox environment.\n\n![an architectural diagram version of this repository](space-reference-arch.jpg)\n\n### Repository layout\n\nThe repository is composed of three folders:\n\n1. **bootstrap:** This folder contains the manifests to configure Argo CD to sync desired control plane infrastructure and configure each control plane, driven from Git.\n2. **infrastructure:** This folder contains the declaration of the desired runtime configuration of each managed control plane along with the desired external secrets to be synchronized onto each control plane.\n3. **configuration:** This folder contains the desired Crossplane configurations of each control plane.\n\nIn each of these three root folders, the resources are grouped together based on the business unit (3 groups, plus a sandbox group).\n\n## Guide\n\n### Prerequisites\n\nThis project requires the following:\n\n* You've deployed Upbound self-hosted Spaces (deployed into your preferred Kubernetes cluster). When deploying the Space, make sure to enable the [on cluster Argo CD plugin](https://docs.upbound.io/all-spaces/disconnected-spaces/helm-reference/).\n* You've deployed Argo CD on the same cluster.\n\n### Setup\n\n1. Clone this repository to your machine.\n2. Deploy a self-hosted Upbound Space using the [documentation](https://docs.upbound.io/spaces/quickstart). **Make sure to include the argocd plugin optional alpha feature in the `up space init ...` command as linked in the preceding section.**\n3. Deploy Argo CD into the same hosting Kubernetes cluster following [Argo CD documentation](https://argo-cd.readthedocs.io/en/stable/getting_started/)\n4. Configure Argo CD after installation by editing the ConfigMap `argocd-cm` in the `argocd` namespace:\n\n```yaml\napiVersion: v1\nkind: ConfigMap\ndata:\n  resource.exclusions: |\n    - apiGroups:\n      - \"*\"\n      kinds:\n      - \"*\"\n      clusters:\n      - \"controlplane-*\"\n  resource.inclusions: |\n    - apiGroups:\n      - \"*\"\n      kinds:\n      - ControlPlane\n      - Provider\n      - Configuration\n      - Application\n      clusters:\n      - \"*\"\n```\n\n5. Deploy the Applications contained in the `bootstrap` folder:\n\n```bash\nkubectl apply -f bootstrap/\n```\n\n6. Synchronize Argo.\n\n### Configure connection to secret store\n\nThis reference architecture is configured to synchronize external secrets from AWS Secret Manager. This allows you to store the `ProviderConfigs` of each control plane in a central keystore and push them onto your control plane securely. Because of this, the `SharedSecretStore` objects created in each control plane group use `awssm` as the provider.\n\nYou're encourage to configure the `SharedSecretStores` with another provider if you like. Otherwise, you should create a secret in the Space to enable each `SharedSecretStore` to access AWS Secret Manager. For simplicity, this could be providing account credentials for an AWS account with the necessary access:\n\n```yaml\nkubectl create secret generic aws-access-secret -n consumer-services --from-literal=access-key=\u003cAWS-account-key\u003e --from-literal=secret-access-key=\u003cAWS-account-secret\u003e\nkubectl create secret generic aws-access-secret -n manufacturing-services --from-literal=access-key=\u003cAWS-account-key\u003e --from-literal=secret-access-key=\u003cAWS-account-secret\u003e\nkubectl create secret generic aws-access-secret -n marketing-services --from-literal=access-key=\u003cAWS-account-key\u003e --from-literal=secret-access-key=\u003cAWS-account-secret\u003e\nkubectl create secret generic aws-access-secret -n playground --from-literal=access-key=\u003cAWS-account-key\u003e --from-literal=secret-access-key=\u003cAWS-account-secret\u003e\n```\n\nEach `SharedExternalSecret` looks for the provider config credentials to be in the form of:\n\n* **secret name:** providerconfig-creds-prod\n* **secret key-values** [`secret-access-key`, `AWS-account-secret`]\n\nFor production scenario, you'd want to configure it to assume an IAM role instead.\n\n### Configure Argo CD\n\nStep 4 of the setup guide recommends you configure Argo CD to include or exclude resource groups and kinds. If you want Argo to sync different, additional resource types to your control planes--like for example, a custom XRD you built with Crossplane--you're encouraged to make additional edits to the Argo CD configuration. For example, here's how you'd have Argo sync `XDatabase` resource types to a control plane:\n\n```yaml\napiVersion: v1\nkind: ConfigMap\ndata:\n  ...\n  resource.inclusions: |\n    - apiGroups:\n      - \"*\"\n      kinds:\n      ...\n      - XDatabase\n      ...\n      clusters:\n      - \"*\"\n```\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fupbound%2Fspaces-reference-architecture","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fupbound%2Fspaces-reference-architecture","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fupbound%2Fspaces-reference-architecture/lists"}