InferaDB Deployment

GitOps deployment for multi-region, multi-cloud Kubernetes

Important

Under active development. Not production-ready.

Architecture Overview

• OS: Talos Linux (immutable, API-driven)
• Orchestration: Kubernetes
• GitOps: Flux CD
• IaC: Terraform + OpenTofu
• CNI: Cilium (with WireGuard encryption)
• Networking: Tailscale mesh
• Secret Management: External Secrets Operator + SOPS

Directory Structure

deploy/
├── terraform/          # Infrastructure provisioning
│   ├── modules/        # Reusable Terraform modules
│   ├── environments/   # Environment-specific configs (dev, staging, production)
│   └── regions/        # Regional cluster definitions
├── flux/               # GitOps configurations
│   ├── clusters/       # Cluster-specific Flux configs
│   ├── infrastructure/ # Cluster infrastructure (CNI, operators, etc.)
│   └── apps/           # Application deployments
├── talos/              # Talos Linux configurations
├── policies/           # Kyverno and network policies
├── scripts/            # Deployment automation scripts
├── runbooks/           # Operational runbooks
├── alerts/             # Prometheus alerting rules
├── slos/               # Service Level Objectives
└── docs/               # Documentation and ADRs

Quick Start

Local Development

Use the InferaDB CLI for local development:

# Create local cluster and deploy InferaDB stack
inferadb dev start

# Show cluster status
inferadb dev status

# Tear down cluster
inferadb dev stop --destroy

The dev environment deploys:

• FoundationDB: Single-node cluster
• Engine: Authorization policy engine
• Control: Control plane API
• Dashboard: Web console

Access services:

kubectl port-forward -n inferadb svc/inferadb-engine 8080:8080
kubectl port-forward -n inferadb svc/inferadb-control 9090:9090
kubectl port-forward -n inferadb svc/inferadb-dashboard 3000:3000

Staging/Production Deployment

# Bootstrap a cluster
./scripts/bootstrap-cluster.sh <environment> <region> <provider>

# Example: staging NYC1 on AWS
./scripts/bootstrap-cluster.sh staging nyc1 aws

Environments

Environment	Regions	Purpose
Development	Local (Docker)	Development and testing
Staging	NYC1 + monthly drills	Pre-production validation
Production	NYC1, SFO1	Live workloads

Key Components

Terraform Modules

• talos-cluster: Abstract Talos K8s cluster provisioning
• provider-aws: AWS-specific resources (VPC, EC2, etc.)
• provider-gcp: GCP-specific resources
• provider-digitalocean: DigitalOcean-specific resources
• fdb-backup: FoundationDB backup infrastructure
• dns: Multi-provider DNS management

Flux Kustomizations

• infrastructure/base: Shared controllers and operators
• apps/base: Application deployments (engine, control, dashboard)

Security

• Pod Security Standards (namespace-level)
• Cilium NetworkPolicies (default deny)
• Image signing via Kyverno
• WireGuard pod-to-pod encryption
• Trivy vulnerability scanning

Documentation

• Getting Started
• Adding Regions
• Disaster Recovery
• Security Model
• Cost Estimation

Runbooks

• FDB Cluster Recovery
• Node Replacement
• Full Region Failover
• Break-Glass Procedures

Development Setup

Enable git hooks:

git config core.hooksPath .githooks

Required tools (via .mise.toml or manual install):

• terraform - formatting
• yamllint - YAML linting (pip install yamllint)
• shellcheck - shell linting

Contributing

All changes require PR review. CI runs on push/PR:

• Terraform: Format and validate checks
• Kubernetes: YAML lint and Kustomize build validation
• Security: Trivy, Checkov, and KICS scans

Community

Join us on Discord for questions, discussions, and contributions.

License

Dual-licensed under MIT or Apache 2.0.