The Problem

Enterprise teams struggle to maintain a consistent, end‑to‑end platform stack that spans developer self‑service, GitOps, secure supply chain, tenancy, observability, and AI workloads. Without a single source of truth, teams duplicate effort and risk misconfiguration.

What This Does

The repo holds a full declarative OpenShift platform portfolio.

  • dev-ex/ contains Backstage, Dev Spaces, and application templates (templates/go‑service, templates/python‑service, templates/java‑service, templates/quarkus‑service).
  • multi‑cluster‑gitops/ provides Argo CD ApplicationSets and per‑environment overlays (fleet‑workloads).
  • trusted‑supply‑chain/ defines Tekton pipelines, Chains, and policy for image signing.
  • multi‑tenancy/ supplies RBAC, NetworkPolicy, and quota CRs.
  • observability‑finops/ bundles the Cluster Observability Operator, Grafana, and cost‑management CRs.
  • ai‑ml‑platform/ includes NVIDIA GPU operator, OpenShift AI, and KServe manifests.
  • secret‑management/ deploys the External Secrets Operator and Vault CRs.
  • chaos‑engineering/, disaster‑recovery/, edge‑fleet/, and service‑mesh/ add reliability, HA, edge, and mTLS layers.

Each directory has a README.md that outlines install order, ensuring operators are subscribed before CRs are applied.

How It Is Wired

The repo’s entry point is not a run‑time binary but a set of manifests.

  • dev-ex/templates/go-service/skeleton/main.go contains a main() function that starts an HTTP server; it references Go modules defined in go.mod.
  • dev-ex/templates/python‑service/skeleton/app/main.py hosts a main() that launches a Flask app.
  • dev-ex/templates/java‑service/skeleton/src/main/java/org/acme/App.java defines public static void main(String[] args) for a Spring Boot app.
  • dev-ex/templates/quarkus-service/skeleton/src/main/java/org/acme/GreetingResource.java defines a REST endpoint.

These templates are meant to be copied into a feature branch. Developers commit the resulting manifests to multi‑cluster‑gitops/tenants/, where Argo CD syncs them to the target cluster. The sync triggers the creation of the service that, in turn, watches its own CRs (e.g., Deployment, Service, Route).

The supply‑chain pipeline (trusted‑supply‑chain/ci/pipeline.yaml) builds images, runs task-rox-image-scan.yaml, signs with task-cosign-sign.yaml, and pushes to the registry. Kyverno policies (policy‑engine/cluster‑policies/*.yaml) enforce these signatures on admission.

Secrets are never stored in git. Example env files (dev-ex/rhdh/secrets.example.env, trusted‑supply‑chain/ci/secrets.example.env) list the required variables for operators that reference ExternalSecret or SealedSecret resources.

How To Use It

# Clone the repo verbatim
git clone https://github.com/moses-y/Openshift

# Build a sample Go service
cd dev-ex/templates/go-service/skeleton
go mod tidy
go build -o app
./app  # starts the demo server

# Deploy to OpenShift
oc apply -f ../../../../multi-cluster-gitops/tenants/team-a/kustomization.yaml

Configuration is driven by the README.md in each directory. For example, to enable the AI platform, edit ai‑ml‑platform/ai/namespace.yaml to set your namespace and then run oc apply -k ai‑ml‑platform/. Secrets must be provided via Vault or Sealed Secrets; the example env files are placeholders.

Real‑World Use

A single development team can scaffold a new microservice by copying the Go template into a fork, editing main.go and the accompanying deployment.yaml, then committing to a feature branch. Argo CD automatically promotes the app through dev → staging → prod using the ApplicationSets defined in multi‑cluster‑gitops/argocd/applicationsets. The Tekton pipeline signs the image, and Kyverno ensures only signed images are admitted.

Code Health & Issues

  • Medium (SDLC) – No CI/CD pipeline detected – /.github/ or CI config missing.
  • Medium (SDLC) – No LICENSE file present – root.
  • Low (Risk) – Dependencies declared without lockfile – dev-ex/templates/go-service/skeleton/go.mod.
  • Low (Security) – Secret‑shaped paths present – dev-ex/rhdh/secrets.example.env, secret-management/operators/external-secrets.yaml, trusted-supply-chain/ci/secrets.example.env.
  • 5 test files located in dev-ex/templates/*/skeleton/tests/.

The static analysis did not flag any syntax errors or missing tests beyond those listed.

The Bottom Line

The repo offers a consolidated set of declarative manifests and starter templates that cover most OpenShift platform concerns. It excels at providing a repeatable bootstrap workflow, but the lack of a CI pipeline and a license file limits its use in regulated or production environments. Teams that need a reference implementation for an OpenShift‑based platform will find it valuable, provided they add their own build and security checks.