Infrastructure Dashboard
All components reviewed and promoted.
Current infrastructure stack fully implemented and online.
Nothing reaches a cluster by hand. Application images are signed and provenance-attested before a deployable tag exists, and Kargo gates prod on manual approval. Argo Workflows only validates infrastructure on PRs; the actual tofu apply runs from the deploy script, and ArgoCD reconciles the rendered manifests separately.
Five layers, each independent. Identity and secrets gate access, the mesh encrypts and segments every hop, supply-chain gates stop unsigned or unattested images at admission, runtime sensors watch live workloads, and every signal lands in DefectDojo for triage on an SLA.
Four independent sources back up to one S3 store. A monitor layer writes per-backup sentinels and tracks freshness, and Kanister exercises the full restore path on a schedule, so recovery is tested, not assumed.