How we save cost
Keep spend on fabric capacity you own — not perpetual control-plane rent, WAN egress on every pull, or a second ops estate per concern.
What's inside
- One platform path from day-0 through tenant clusters and managed packs
- Dense Kamaji control planes instead of a dedicated CP farm per cluster
- Local registry VIP so CRI pulls stay on-site after seed
Talos OS
Run every tenant guest on immutable Linux built for Kubernetes — upgraded as images, not patched over SSH.
What's inside
- Talos metal gold bases materialized via Image Factory on fabric hosts
- Standard (vanilla) and official-extension schematics
- Cloud Images UI to ensure, update, and delete bases across hosts
Virtual machines
Inventory every Tart guest on the fabric — filter by status, clean CapA orphans, and inspect detail beside Talos gold.
What's inside
- Cloud /vms inventory of Tart VMs registered in aanjaleyad
- Status filters including orphan (no matching CapA Machine)
- Select + terminate orphans — destroy FSM record and Tart guest
Managed Kubernetes
Create and operate Prime, Tenant, and Imported clusters — CapA, Kamaji, Cilium, Talos — with scale and upgrade wizards in Cloud.
What's inside
- Prime / Tenant / Imported inventory with topology glyphs
- Create tenant wizard (Image Factory, k8s version, CapA pools)
- Import existing kubeconfigs without CapA ownership
Air-gapped platform
Bring up and run the platform so CRI stays on your network — host seed, in-cluster VIP, no public fallback.
What's inside
- Host Zot as bootstrap seed only
- Managed Registries Prime on a durable registry VIP
- RequireTags gates before workload proceeds
GitOps
Apply platform and site desired state with Flux — clear ownership between daemon fabric phases and GitOps manifests.
What's inside
- Platform Flux (GOTK) always on
- hiranyagarbha as Flux SoT with literal image pins
- karanodaka for site feature/SSO intent as PRs
Managed Argo CD
Install and operate Argo CD from Cloud or GitOps ManagedArgoCD — placement, tunnel endpoint, SSO — on the same fabric and IAM as other packs.
What's inside
- managedArgoCD platform pack toggle
- List / create / delete via Cloud or ManagedArgoCD CR
- cluster-local, Cilium VIP, or Cloudflare tunnel endpoints
Managed Argo Workflows
Install the Argo Workflows control plane from Cloud or GitOps ManagedArgoWorkflows. v1 is lifecycle — not Workflow authoring in Cloud.
What's inside
- managedArgoWorkflows platform pack
- List / create / delete via Cloud or ManagedArgoWorkflows CR
- Optional SSOProvider binding
Managed Tekton
Install Tekton Pipelines with lite / basic / all profiles from Cloud or GitOps ManagedTekton.
What's inside
- managedTekton platform pack
- Profiles lite, basic, and all
- Placement workload or tenant; Cilium VIP when profile all on workload
Managed Kargo
Install Kargo for progressive delivery from Cloud or GitOps ManagedKargo, with optional SSO.
What's inside
- managedKargo platform pack
- List / create / delete via Cloud or ManagedKargo CR
- Optional SSOProvider binding
Block storage (ABS)
Pool fabric disks and attach CSI volumes over NBD without restarting VMs.
What's inside
- CSI driver block.csi.aanjaleya.io · StorageClass abs-rwo
- Claim extra pools from Cloud (marker .aanjaleyad-pool)
- Create/attach/expand via fabric control plane
Aanjaleya Container Registry
On-fabric OCI registry built on a custom Zot fork — images, upstream mirrors with pull-through, CVE scan schedules and reports — operated from Cloud, creatable in one click or via GitOps.
What's inside
- Managed Registries Prime: in-cluster Zot behind a durable registry VIP
- Cloud list of registries with endpoint, consumers, and Ready status
- Images tab: catalog search, dual-arch tags, per-image Scan / Refresh
Managed Valkey
Operate Valkey Cluster from Cloud or GitOps — placement, endpoint, shards, replicas, persistence — on the same fabric and IAM as registries and packs.
What's inside
- Cloud list of Managed Valkey with placement, endpoint, topology, address/VIP, Ready
- Create: workload or tenant placement, cluster-local or Cilium VIP, shards × replicas, optional abs-rwo persistence
- GitOps: enable managedValkey on AanjaleyaPlatform; declare ManagedValkey CRs
Managed Postgres
Operate CloudNativePG Postgres from Cloud or GitOps — placement, endpoint, HA instances, major version, database and user — on the same fabric and IAM as other packs.
What's inside
- Cloud list of Managed Postgres with placement, endpoint, topology, address/VIP, Ready
- Create: workload or tenant placement, cluster-local or Cilium VIP, instances 1|3, PG major, DB/user, abs-rwo storage
- GitOps: enable managedPostgres on AanjaleyaPlatform; declare ManagedPostgres CRs
Managed DocumentDB
Operate Mongo-compatible DocumentDB on Postgres 18 from Cloud or GitOps — placement, endpoint, instances — with an explicit managedPostgres pack dependency.
What's inside
- Cloud list of Managed DocumentDB with placement, endpoint, topology, address/VIP, Ready
- Create: workload or tenant placement, cluster-local or Cilium VIP, instances 1–3, PG18 track, abs-rwo storage
- GitOps: enable managedPostgres + managedDocumentDB; declare ManagedDocumentDB CRs
Managed Object Storage
Operate S3-compatible RustFS object storage on the fabric — platform and bhandaar instances, buckets, console, and STS access keys — from Cloud or GitOps.
What's inside
- Cloud list of Managed Object Storage — platform (cluster-local) and bhandaar (workload VIP)
- Pack enable + GitOps ManagedObjectStorage for bhandaar; create buckets on a selected instance
- Operate: S3 address, Console open, STS session / access-key reveal
Managed Secrets & KMS
Store product credentials in AMS (Secrets Manager–shaped) envelope-encrypted by fabric KMS — create, reveal, rotate, and operate CMKs from Cloud next to IAM.
What's inside
- AMS: create string or key/value secrets; versions with AMSCURRENT / AMSPENDING / AMSPREVIOUS
- Cloud Secrets list/detail — Reveal (60s clear), Put, Rotate, schedule deletion + restore
- KMS: AES_256 ENCRYPT_DECRYPT, RSA/ECC asymmetric, EXTERNAL BYOK import
Private CA
Own org ROOT and per-cluster Host/Cluster subordinates — ACM PCA–shaped, KMS-wrapped, Raft-replicated — for Talos, Kamaji BYO, and MintTLS managed packs.
What's inside
- Org ROOT + tagged subordinates (host, kubernetes, front-proxy, SA, etcd, managed-services)
- Cloud /private-ca — flat/hierarchy list, Ensure, Issue from CSR, Revoke, Rotate, schedule deletion
- ARNs: aanjaleya:acm-pca:::ca:… and aanjaleya:acm-pca:::certificate:…
IAM and roles
Manage product users, groups, roles, and Cedar policies — authenticate with local or SSO sessions; authorize every API with default-deny. Fabric mgmt tokens never become Cloud sessions.
What's inside
- Cloud IAM: users, groups, roles, Cedar policies, sessions
- Local users (Argon2id) with optional TOTP; access keys hashed at rest (secret shown once)
- SSO providers shared by Cloud and other consumers (Argo CD, Grafana, …)
Audit timeline
Browse a verifiable Tessera log of daemon operations and optional Kubernetes API audit events — append-only entries with inclusion proofs.
What's inside
- Cloud Audit timeline: filter by source (daemon / k8s), kind, action, actor, time range
- Append-only Tessera tree with verified size and trusted size
- Optional Kubernetes audit webhook sink — accepts, unauthorized counts, CA fingerprint
Cloudflare tunnels
Named TunnelProfile objects — platform or tenant scope — with AMS-backed connector tokens, validate to Ready, zones, and hostname bindings.
What's inside
- Platform and tenant TunnelProfile scopes
- AMS secret refs (write-only tokens)
- Validate → Ready, zones, hostname bindings
VPN
WireGuard VPNProfile objects for private site access — AMS-backed peer material, listen ports, and host attachments.
What's inside
- VPNProfile list / create / operate in Cloud
- AMS secret refs for peer material
- Listen port, peers, host attachments
Managed Observability
Turn on managed Grafana / LGTM as a platform pack — list, create, Open Grafana, and GitOps ManagedObservability — aligned with Flux, registry, and identity.
What's inside
- Managed Observability pack (Grafana / LGTM shape)
- Platform system instance plus tenant ManagedObservability
- Open Grafana when Ready; optional SSOProvider