You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: docs/docs/explanations/nkp-architecture.mdx
+36-31Lines changed: 36 additions & 31 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -66,7 +66,7 @@ This split keeps cluster work (the bottom of the stack) and pack work (the top)
66
66
67
67
## GitOps via ArgoCD
68
68
69
-
Above the cluster, NKP is **declarative and pull-based**. ArgoCD watches a Git repository (`nebari-foundational-software`) and continuously reconciles the live cluster state to match it.
69
+
ArgoCD is an open-source deployment tool for Kubernetes. It turns every cluster change into a Git commit, so updates land safely, rollbacks take seconds, and the cluster stays in sync without manual intervention.
70
70
71
71
ArgoCD uses the **app-of-apps** pattern: a top-level Application resource points to a folder of child Applications, each one a piece of foundational software with explicit dependencies.
72
72
@@ -90,36 +90,41 @@ Software Packs plug into this model from above. A pack ships its workload manife
90
90
91
91
## Terraform state and drift detection
92
92
93
-
`nic` uses a standard **Terraform state file** to track everything it provisioned. State is persisted in a remote backend matched to the provider:
-**Locking prevents concurrent writes.** Two engineers cannot accidentally apply conflicting changes at the same time; the second `nic deploy` blocks until the first releases the lock.
105
-
-**Drift detection is just `terraform plan`.** Running `nic deploy` against an unchanged config produces a diff between the state file and the live cloud, surfacing any out-of-band changes (a node group resized in the console, an IAM policy edited by hand) as proposed corrections.
106
-
107
-
State operations are exposed as first-class CLI verbs:
108
-
109
-
```bash
110
-
nic state list # list resources tracked in state
111
-
nic state show aws_eks_cluster.main # inspect one resource
112
-
nic state rm <addr># forget a resource (does not destroy it)
113
-
nic state mv <from><to># rename a resource address
114
-
```
115
-
116
-
### How this differs from Nebari Classic
117
-
118
-
Classic also used Terraform, but the platform layer above the cluster was installed imperatively at deploy time and configured per-environment. NKP splits that responsibility: `nic`'s state covers infrastructure only, while the platform layer is reconciled by ArgoCD from a Git repository. As a result:
119
-
120
-
-**Infrastructure drift** is detectable via `nic deploy` (Terraform plan).
121
-
-**Application drift** is detectable via the ArgoCD UI / CLI (sync status).
122
-
- The two surfaces never overlap, so a Terraform run cannot break an application and a pack upgrade cannot rotate a VPC.
93
+
`nic` keeps a record of everything it has built in a file called the **Terraform state file**. The file lives in shared cloud storage (S3, Cloud Storage, or Blob Storage) that matches your provider:
94
+
95
+
| Provider | Backend |
96
+
| --- | --- |
97
+
| AWS | S3 |
98
+
| GCP | Cloud Storage |
99
+
| Azure | Blob Storage |
100
+
| Local (dev only) | Local file |
101
+
102
+
This shared record gives `nic` two abilities:
103
+
104
+
-**Locking:** If two engineers run `nic deploy` at the same time, the second one waits until the first one finishes, so they can't make conflicting changes.
105
+
106
+
```mermaid
107
+
sequenceDiagram
108
+
participant E1 as Engineer 1
109
+
participant SF as State file
110
+
participant E2 as Engineer 2
111
+
E1->>SF: nic deploy (acquires lock)
112
+
Note over E1,SF: Lock held by Engineer 1
113
+
E2->>SF: nic deploy (lock busy, waits)
114
+
E1->>SF: changes applied, releases lock
115
+
SF-->>E2: lock available
116
+
E2->>SF: acquires lock, applies changes
117
+
```
118
+
119
+
-**Drift detection:** When someone makes a manual change in the cloud (resizing a node group in the console, editing an IAM policy by hand), the next `nic deploy` spots the difference and proposes a correction to bring things back in line.
120
+
121
+
```mermaid
122
+
flowchart LR
123
+
SF[State file<br/>what nic thinks exists] --> Compare{Compare}
0 commit comments