# Architecture

![Hybrid-cloud architecture](../../docs/architecture/generated/hybrid-cloud.svg)

This public-safe visual separates deployment, data, management, monitoring, and
security planes. See the [diagram contract](../../docs/architecture/hybrid-cloud.md)
for scope, omissions, review method, and validation.

```text
Developer -> Git dev -> Gitea validation/deploy -> Firebase Hosting -> HTTPS portfolio

Local k3s -> allowlisted configuration inventory -> gzip -> age -> private Cloud Storage
     |                         |                              |
     |                         +-> structured log attempt ----+-> metrics/policies/dashboard
     +-> projected tokens -> WIF -> scoped Google service accounts
     +-> registry-auth CronJob -> projected token + WIF -> short-lived OAuth token
                                                     +-> Kubernetes imagePullSecret
     +-> kubelet + imagePullSecret -> private Artifact Registry -> pinned backup image
```

Firebase serves the static site without continuously running application
compute. k3s remains local, while federation exchanges, private image pulls,
encrypted inventories, and low-volume status logs cross the cloud boundary.
Terraform and Kustomize divide ownership between Google Cloud and Kubernetes.

An external check on 24 July 2026 received HTTP 200 and Firebase Hosting headers
from the apex; `www` redirected to it, the catalogue and a case-study route
returned HTTP 200, and an unknown route returned HTTP 404. The label
"sanitized backup" in the
diagram means the script allowlists resource kinds and namespaces and does not
query Secret objects or export ConfigMap values. Selected workload specs are
preserved, so inline values in environment variables, arguments, or annotations
are not independently scrubbed. Treat every encrypted archive as sensitive; it
is not a complete cluster or application backup.