Skip to content

Commit 1796592

Browse files
docs(explanations): refine NKP page wording
1 parent 76e9e61 commit 1796592

1 file changed

Lines changed: 36 additions & 31 deletions

File tree

docs/docs/explanations/nkp-architecture.mdx

Lines changed: 36 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -66,7 +66,7 @@ This split keeps cluster work (the bottom of the stack) and pack work (the top)
6666

6767
## GitOps via ArgoCD
6868

69-
Above the cluster, NKP is **declarative and pull-based**. ArgoCD watches a Git repository (`nebari-foundational-software`) and continuously reconciles the live cluster state to match it.
69+
ArgoCD is an open-source deployment tool for Kubernetes. It turns every cluster change into a Git commit, so updates land safely, rollbacks take seconds, and the cluster stays in sync without manual intervention.
7070

7171
ArgoCD uses the **app-of-apps** pattern: a top-level Application resource points to a folder of child Applications, each one a piece of foundational software with explicit dependencies.
7272

@@ -90,36 +90,41 @@ Software Packs plug into this model from above. A pack ships its workload manife
9090

9191
## Terraform state and drift detection
9292

93-
`nic` uses a standard **Terraform state file** to track everything it provisioned. State is persisted in a remote backend matched to the provider:
94-
95-
| Provider | Backend | Locking |
96-
| --- | --- | --- |
97-
| AWS | S3 | DynamoDB table |
98-
| GCP | Cloud Storage | Object generation metadata |
99-
| Azure | Blob Storage | Blob lease |
100-
| Local (dev only) | Local file | File lock |
101-
102-
Two operational properties matter here:
103-
104-
- **Locking prevents concurrent writes.** Two engineers cannot accidentally apply conflicting changes at the same time; the second `nic deploy` blocks until the first releases the lock.
105-
- **Drift detection is just `terraform plan`.** Running `nic deploy` against an unchanged config produces a diff between the state file and the live cloud, surfacing any out-of-band changes (a node group resized in the console, an IAM policy edited by hand) as proposed corrections.
106-
107-
State operations are exposed as first-class CLI verbs:
108-
109-
```bash
110-
nic state list # list resources tracked in state
111-
nic state show aws_eks_cluster.main # inspect one resource
112-
nic state rm <addr> # forget a resource (does not destroy it)
113-
nic state mv <from> <to> # rename a resource address
114-
```
115-
116-
### How this differs from Nebari Classic
117-
118-
Classic also used Terraform, but the platform layer above the cluster was installed imperatively at deploy time and configured per-environment. NKP splits that responsibility: `nic`'s state covers infrastructure only, while the platform layer is reconciled by ArgoCD from a Git repository. As a result:
119-
120-
- **Infrastructure drift** is detectable via `nic deploy` (Terraform plan).
121-
- **Application drift** is detectable via the ArgoCD UI / CLI (sync status).
122-
- The two surfaces never overlap, so a Terraform run cannot break an application and a pack upgrade cannot rotate a VPC.
93+
`nic` keeps a record of everything it has built in a file called the **Terraform state file**. The file lives in shared cloud storage (S3, Cloud Storage, or Blob Storage) that matches your provider:
94+
95+
| Provider | Backend |
96+
| --- | --- |
97+
| AWS | S3 |
98+
| GCP | Cloud Storage |
99+
| Azure | Blob Storage |
100+
| Local (dev only) | Local file |
101+
102+
This shared record gives `nic` two abilities:
103+
104+
- **Locking:** If two engineers run `nic deploy` at the same time, the second one waits until the first one finishes, so they can't make conflicting changes.
105+
106+
```mermaid
107+
sequenceDiagram
108+
participant E1 as Engineer 1
109+
participant SF as State file
110+
participant E2 as Engineer 2
111+
E1->>SF: nic deploy (acquires lock)
112+
Note over E1,SF: Lock held by Engineer 1
113+
E2->>SF: nic deploy (lock busy, waits)
114+
E1->>SF: changes applied, releases lock
115+
SF-->>E2: lock available
116+
E2->>SF: acquires lock, applies changes
117+
```
118+
119+
- **Drift detection:** When someone makes a manual change in the cloud (resizing a node group in the console, editing an IAM policy by hand), the next `nic deploy` spots the difference and proposes a correction to bring things back in line.
120+
121+
```mermaid
122+
flowchart LR
123+
SF[State file<br/>what nic thinks exists] --> Compare{Compare}
124+
Cloud[Live cloud<br/>what actually exists] --> Compare
125+
Compare -- match --> OK[Nothing to do]
126+
Compare -- differ --> Drift[Drift detected<br/>nic proposes corrections]
127+
```
123128

124129
## Separation of concerns
125130

0 commit comments

Comments
 (0)