# Okustera - The Open Cloud for the GitOps Era (Full Context)

> Okustera is an open-standard, sovereign cloud platform (OMC Tier-2) engineered for upstream Kubernetes, true VPC networking with OVN, and distributed Ceph NVMe storage, managed declaratively with Terraform.

---

## 1. Platform Overview & Endpoints

- Platform Name: Okustera Open Cloud (OMC)
- Host Node: `ns570036` (RegionOne)
- Dedicated Bare-Metal Compute & Storage: 10Gbps bonded redundant network uplinks
- Primary Web Domain: https://okustera.com
- Cloud Web Console: https://portal.okustera.com
- Keystone Identity & OpenStack API Endpoint: `https://api.okustera.com:5000/v3`
- Kubernetes Control Plane Endpoint: `https://k8s.regionone.okustera.com:6443`
- Ceph RADOS Gateway (RGW) S3 Endpoint: `http://ceph-rgw.okustera-system.svc:8080` (or public gateway)
- Apache APISIX Ingress Gateway: `http://apisix-gateway.apisix.svc/api/v1`

---

## 2. Core Infrastructure Architecture (IaaS)

### 2.1 Compute Virtualization (Nova & KVM)
- Powered by OpenStack Nova with hardware-accelerated Linux KVM (Kernel-based Virtual Machine) and QEMU.
- Full support for live VM migration, NUMA topology awareness, and CPU pinning for deterministic low-latency workloads.
- Ephemeral root disks backed by local high-speed NVMe or persistent boot-from-volume backed by Ceph RBD.

### 2.2 Software-Defined Networking (Neutron & OVN)
- Distributed Software-Defined Networking using OpenStack Neutron and Open Virtual Network (OVN).
- Geneve encapsulated overlay tunnels isolate tenant Virtual Private Clouds (VPCs).
- Distributed Virtual Routing (DVR) with East-West traffic routed directly on compute nodes without network bottlenecks.
- External connectivity via provider bridge (`br-ex`) with floating IP mapping.
- High-availability Layer 4 and Layer 7 load balancing powered by OpenStack Octavia with dedicated amphora instances.

### 2.3 Distributed NVMe Storage (Ceph Reef)
- Ceph RADOS Block Device (RBD): Delivers enterprise distributed block storage across NVMe OSDs with triple-replication redundancy, thin provisioning, and instant snapshot capabilities. Serves both Nova VM instances and Kubernetes PersistentVolumes.
- Ceph RADOS Gateway (RGW): Provides high-throughput, multi-tenant, S3-compatible object storage with bucket versioning, lifecycles, and Keystone authentication integration.

### 2.4 Identity, Secrets, and Security (Keystone & Barbican)
- OpenStack Keystone Identity service providing multi-tenancy boundaries (tenants/projects), hierarchical domains, fine-grained RBAC roles (`admin`, `member`, `reader`), and optional TOTP 2FA.
- OpenStack Barbican provides secret escrow, Key Management Service (KMS), TLS certificate lifecycle storage, and database credential encryption.

---

## 3. Managed Kubernetes (CaaS)

- **Orchestration**: Managed Kubernetes clusters provisioned via OpenStack Magnum and Kubernetes Cluster API (CAPI).
- **CNI**: Project Calico provides high-performance container networking, BGP peering, and network policy enforcement.
- **CSI**: Ceph CSI driver dynamically allocates Ceph RBD persistent volumes (`storageClassName: ceph-rbd`) with read-write-once (RWO) and CephFS for read-write-many (RWX).
- **Zero Lock-In**: Upstream CNCF-certified Kubernetes binaries, standard kubeconfig access, and full compatibility with Helm, ArgoCD, Flux, and standard cloud-native tooling.

---

## 4. Cloud-Native PaaS & DBaaS

### 4.1 PostgreSQL HA (CloudNativePG)
- Production-ready PostgreSQL 16 clusters managed by the CloudNativePG Operator.
- Triple-instance quorum with automated leader election, continuous WAL archiving, streaming replication, and sub-10s automated failover.
- Continuous physical backups via Barman directly integrated with Ceph S3 object storage.

### 4.2 Redis Sentinel (Spotahome)
- In-memory caching and queuing managed by the Spotahome RedisFailover Operator.
- 3-node Sentinel quorum architecture providing automated master failover in under 10 seconds.
- Persistent data backed by Ceph RBD block storage.

### 4.3 MySQL HA (Percona XtraDB Cluster)
- Clustered MySQL with synchronous multi-master Galera replication.
- Zero data loss (RPO=0) failover and integrated backup automation.

### 4.4 Document DB (MongoDB Community Operator)
- Scalable MongoDB replica sets with automated node recovery and TLS encryption.

### 4.5 Messaging (RabbitMQ Cluster Operator)
- Enterprise distributed message broker with quorum queues and native Kubernetes Secret integration.

### 4.6 Serverless Functions (OpenFaaS + gVisor)
- Event-driven serverless computing powered by OpenFaaS.
- Hardened multi-tenant isolation using Google gVisor (`runsc`) user-space kernel virtualization, ensuring untrusted tenant code cannot escape to the host node.

### 4.7 API Gateway & Ingress (Apache APISIX)
- High-performance, cloud-native API gateway built on NGINX and LuaJIT.
- Dynamic route dispatch, rate limiting, CORS configuration, JWT validation, and upstream health checks.

### 4.8 Workload Identity & Pod IAM
- Pod-level zero-static-secrets authentication.
- Kubernetes ServiceAccounts project cryptographically signed OIDC JWT tokens (`/var/run/secrets/okustera/token`, audience `okustera-platform`).
- APISIX and Okustera STS broker validate JWT signatures against Kubernetes JWKS and authorize requests based on `OkusteraIAMRole` definitions.

### 4.9 FinOps & Observability
- Prometheus metrics scraping, Grafana dashboards, and Loki log streaming.
- OpenStack CloudKitty rating engine continuously meters compute, RAM, storage, and networking usage for real-time cost calculation and monthly tenant budget cap alerts.

---

## 5. Automation & Infrastructure as Code (Terraform)

Okustera is designed for 100% declarative GitOps workflows using two complementary Terraform providers:
1. **OpenStack Terraform Provider** (`terraform-provider-openstack`): Manages foundational IaaS resources.
2. **Okustera Terraform Provider** (`okustera/okustera` / `terraform-provider-okustera`): Manages platform-native PaaS services.

### 5.1 Provider: OpenStack (`terraform-provider-openstack`)
Manages lower-level cloud primitives:
- Compute: `openstack_compute_instance_v2`, `openstack_compute_keypair_v2`
- Networking: `openstack_networking_network_v2`, `openstack_networking_subnet_v2`, `openstack_networking_router_v2`, `openstack_networking_router_interface_v2`, `openstack_networking_secgroup_v2`
- Block Storage: `openstack_blockstorage_volume_v3`
- Kubernetes: `openstack_containerinfra_cluster_v1`

#### OpenStack Provider Example:
```hcl
terraform {
  required_providers {
    openstack = {
      source  = "terraform-provider-openstack/openstack"
      version = "~> 1.54.0"
    }
  }
}

provider "openstack" {
  auth_url    = "https://api.okustera.com:5000/v3"
  region      = "RegionOne"
  user_name   = var.os_username
  password    = var.os_password
  tenant_name = "tenant-prod"
  domain_name = "Default"
}

# Provision a private VPC Network
resource "openstack_networking_network_v2" "vpc_network" {
  name           = "production-vpc"
  admin_state_up = true
}

resource "openstack_networking_subnet_v2" "vpc_subnet" {
  name       = "production-subnet"
  network_id = openstack_networking_network_v2.vpc_network.id
  cidr       = "10.100.0.0/24"
  ip_version = 4
}
```

---

### 5.2 Provider: Okustera (`okustera/okustera`)
Manages high-level PaaS, DBaaS, and Identity services:
- **Identity**:
  - `okustera_tenant`: Manages Keystone tenant projects with quotas and isolation.
  - `okustera_user`: Manages Keystone user accounts.
  - `okustera_role_assignment`: Assigns Keystone roles (`admin`, `member`, `reader`) to users within tenant projects.
- **Databases & Cache**:
  - `okustera_database_postgresql`: Managed HA CloudNativePG PostgreSQL 16 clusters.
  - `okustera_database_redis`: Managed HA Redis Sentinel clusters with automated failover.
- **Object Storage**:
  - `okustera_s3_bucket`: S3-compatible Ceph RADOS Gateway buckets with versioning and quotas.
- **Serverless & Traffic**:
  - `okustera_function`: Sandboxed OpenFaaS functions with gVisor isolation.
  - `okustera_apisix_route`: Apache APISIX gateway routes, rate limiting, and CORS.
- **Workload Identity**:
  - `okustera_iam_role`: Declarative IAM roles with endpoint policy rules.
  - `okustera_pod_identity_binding`: Binds Kubernetes ServiceAccounts to IAM roles.
- **FinOps**:
  - `okustera_billing_budget`: Monthly budget caps and threshold alerts.
- **Data Sources**:
  - `okustera_pricing_rates`: Queries active unit pricing rate sheet across compute, storage, DBaaS, and FaaS.
  - `okustera_database_cluster`: Retrieves endpoints and status for existing database clusters.

#### Okustera Provider Example:
```hcl
terraform {
  required_providers {
    okustera = {
      source  = "okustera/okustera"
      version = "~> 1.0.0"
    }
  }
}

# Option A: Personal Access Token (CLI or CI/CD)
provider "okustera" {
  endpoint  = "https://portal.okustera.com/api/v1"
  api_token = var.okustera_api_token
  tenant_id = "tenant-prod"
}

# Option B: In-Cluster Kubernetes Pod Workload Identity (Zero Static Secrets)
# provider "okustera" {
#   endpoint = "http://apisix-gateway.apisix.svc/api/v1"
#   workload_identity = {
#     enabled    = true
#     token_file = "/var/run/secrets/okustera/token"
#     role_arn   = "arn:okustera:iam::tenant-prod:role/TerraformDeployer"
#   }
# }

# 1. High-Availability PostgreSQL 16 Cluster
resource "okustera_database_postgresql" "app_db" {
  name            = "production-core-db"
  instances       = 3
  storage_size_gb = 50
  storage_class   = "ceph-rbd"
  database_name   = "production"
  owner_username  = "db_admin"
  enable_backups  = true
}

# 2. Redis Sentinel Cache
resource "okustera_database_redis" "cache" {
  name             = "production-cache"
  replicas         = 3
  memory_limit     = "4Gi"
  sentinel_enabled = true
}

# 3. Ceph S3 Object Storage Bucket
resource "okustera_s3_bucket" "assets" {
  name       = "production-assets"
  versioning = true
  quota_gb   = 250
}

# 4. Sandboxed Serverless Worker
resource "okustera_function" "processor" {
  name         = "asset-processor"
  image        = "portal.okustera.com/artifactory/docker/asset-worker:v1.0"
  runtime      = "sandboxed" # Enforces gVisor isolation
  memory_limit = "512Mi"

  environment = {
    DB_HOST     = okustera_database_postgresql.app_db.primary_endpoint
    BUCKET_NAME = okustera_s3_bucket.assets.name
  }
}

# 5. Ingress Route on Apache APISIX
resource "okustera_apisix_route" "api" {
  name  = "production-api"
  host  = "api.okustera.com"
  paths = ["/api/v1/assets*"]

  upstream = {
    service_name = "okustera-function-asset-processor"
    port         = 8080
  }

  cors_enabled = true
}

# 6. Monthly FinOps Budget Cap
resource "okustera_billing_budget" "budget" {
  monthly_limit_usd = 250.00
  alert_thresholds  = [50, 80, 95]
}
```

---

## 6. Strategic Advantages for Hardware Vendors & Datacenter Operators

Okustera Cloud directly addresses the primary challenge faced by bare-metal datacenter operators, hosting providers, and colocation facilities: possessing high-performance server and networking hardware without the modern multi-tenant cloud software stack to monetize it.

### 6.1 The Problem Solved
- **Escaping Commoditization**: Selling raw unmanaged dedicated servers or simple VPS yields 10–20% margins and suffers from continuous customer churn toward hyperscalers.
- **Eliminating Software R&D Barrier**: Developing a cloud software platform with multi-tenant SDN, NVMe-oF/Ceph storage clustering, upstream Kubernetes engines, managed DBaaS, and Terraform integrations requires years of development and millions in specialized engineering payroll.
- **Eliminating the VMware / Broadcom Tax**: Broadcom's drastic licensing shifts have squeezed datacenter provider profitability. Okustera offers 100% upstream open standards (Linux KVM, Ceph, OpenStack, CNCF Kubernetes) with zero hypervisor tax.

### 6.2 Key Partner Benefits
1. **Turn-Key Cloud OS in Days**: Deploys a pre-integrated, production-validated cloud control plane onto existing bare-metal servers, NVMe storage, and top-of-rack switches.
2. **10x Higher Gross Margins**: Transition from flat-fee server rentals to high-margin managed cloud services (CloudNativePG PostgreSQL HA, Redis Sentinel, S3 object storage, and serverless compute).
3. **Automated FinOps & Usage Metering**: Real-time metering of vCPU, RAM, NVMe storage, and network egress via OpenStack CloudKitty enables flexible pay-as-you-go or reserved capacity billing models.
4. **Hardware Agnostic**: Runs across heterogeneous fleets of x86_64 hardware (Dell, HPE, Supermicro, Lenovo, or white-box ODMs) with high compute density and NUMA efficiency.
5. **Native Terraform & GitOps Automation**: End users can provision infrastructure immediately using standard `terraform-provider-openstack` and `terraform-provider-okustera`.
6. **Strict Sovereign Compliance**: 100% of tenant data, telemetry, and control planes remain strictly within the physical datacenter boundary, ensuring complete GDPR and national sovereign data compliance.
7. **Official About Us & Partner Page**: https://okustera.com/about.html

---

## 7. Environment Variables Reference

| Variable | Fallback Variable | Description |
| :--- | :--- | :--- |
| `OKUSTERA_ENDPOINT` | `OMC_ENDPOINT` | Base URL of the Okustera API or APISIX Gateway |
| `OKUSTERA_API_TOKEN` | `OMC_API_TOKEN` | Personal Access Token (PAT) |
| `OKUSTERA_TENANT_ID` | `OMC_TENANT_ID` | Project or Tenant ID |
| `OKUSTERA_HOST_HEADER` | `OMC_HOST_HEADER` | Host header override for APISIX Gateway routing |
| `OKUSTERA_USERNAME` | `OMC_USERNAME` | Keystone user account username/email |
| `OKUSTERA_PASSWORD` | `OMC_PASSWORD` | Keystone user account password |
| `OKUSTERA_TOTP_CODE` | `OMC_TOTP_CODE` | 6-digit TOTP two-factor authentication code |
| `OKUSTERA_TOKEN_FILE` | `OMC_TOKEN_FILE` | Projected Kubernetes ServiceAccount JWT path |
| `OKUSTERA_INSECURE_SKIP_VERIFY` | `OMC_INSECURE_SKIP_VERIFY` | Set to `true` to bypass TLS verification |