Self-Service Internal Developer Platform (IDP) with Port & OpenShift GitOps
Transforming ticket-driven platform operations into automated golden paths and declarative GitOps workflows
Senior Platform Engineer — IDP Architect & Automation Lead
Self-Service
Replaced manual ticket queues for namespace provisioning and application onboarding with automated Port IDP workflows.
100% Auditable
All tenant infrastructure and RBAC changes flow through version-controlled OpenShift GitOps repositories.
Zero Toil
Standardized golden paths eliminated repetitive day-2 platform provisioning tasks and configuration inconsistencies.
01 // Engineering Problem
Application teams faced multi-day lead times waiting on manual platform-team tickets for namespace provisioning, quota adjustments, RBAC onboarding, and environment creation—creating friction for developers and repetitive toil for platform engineers.
02 // Business & Operational Context
To scale platform adoption across dozens of engineering teams without linearly increasing platform headcount, we needed an Internal Developer Platform that offered self-service velocity while automatically enforcing enterprise security and governance guardrails.
Architecture Topology // Self-Service Internal Developer Platform (IDP) with Port & OpenShift GitOps
Port Software Catalog
Unified catalog modeling services, environments, OpenShift namespaces, owners, and production-readiness scorecards.
Standardized Golden Paths
Guided forms for namespace onboarding, quota scaling, and secret store binding with built-in schema validation.
OpenShift GitOps (Argo CD)
Declarative reconciliation of tenant namespaces, LimitRanges, ResourceQuotas, RoleBindings, and NetworkPolicies.
Production Readiness Scorecards
Automated checks verifying health probes, Vault secret externalization, backup labels, and resource limits.
Mermaid Topology Specification (Architecture-as-Code) ▼
flowchart LR
Dev["Application Engineer\n(Self-Service Request)"] --> Port["Port Internal Developer Portal\n(Catalog + Scorecards + Actions)"]
Port -->|"Webhook / Automation"| Pipeline["GitLab CI / Automation Engine\n(Policy & Quota Validation)"]
Pipeline -->|"Commit Declarative PR"| Git["GitOps Config Repository\n(Helm / Kustomize Overlays)"]
Git -->|"Continuous Reconciliation"| Argo["OpenShift GitOps (Argo CD)"]
Argo --> Tenant["Multi-Tenant OpenShift Namespace\n(RBAC + NetworkPolicy + Quota + ESO)"]
Tenant -->|"Live State Sync"| PortKey Architectural Decisions & Engineering Tradeoffs
DECISION 01
Back all Port IDP self-service actions with GitOps commits rather than direct imperative kubectl/oc API mutations
Direct imperative API calls create configuration drift and bypass audit trails. Generating a Git commit ensures every self-service action is versioned, auditable, and recoverable.
Adds a brief 30–60 second GitOps sync interval compared to direct API mutation, which is well worth the auditability and zero-drift guarantee.
DECISION 02
Embed automated governance guardrails directly into the golden-path templates
Developers should not have to write complex NetworkPolicies, SCC bindings, or ExternalSecret CRDs from scratch.
Requires maintaining versioned platform chart/kustomize templates as cluster capabilities evolve.
Zero-Trust Security Guardrails
- Every self-service namespace automatically provisions default-deny ingress/egress NetworkPolicies and least-privilege group RoleBindings.
- Pre-configured External Secrets Operator (ESO) SecretStore bindings ensure new services consume dynamic credentials from HashiCorp Vault from day one.
- ResourceQuotas and LimitRanges are mandatory parameters in every tenant blueprint to prevent cluster resource exhaustion.
SRE & Reliability Engineering
- Port Scorecards continuously evaluate workload manifests for liveness/readiness probes, PodDisruptionBudgets, and Veeam Kasten backup policy labels.
- Eliminated manual copy-paste configuration errors across Dev, QA, Staging, and Production environments.
Engineering Problem
In many enterprise organizations, adopting Kubernetes or OpenShift shifts the bottleneck from hardware provisioning to platform ticket queues. Application developers open tickets to request a namespace, wait for security teams to approve RBAC groups, wait again for firewall/NetworkPolicy rules, and manually copy YAML manifests between environments.
Our objective was to treat the platform as a product by building an Internal Developer Platform (IDP) using Port that gives developers immediate self-service autonomy while guaranteeing enterprise compliance by construction.
Solution Architecture & Golden Paths
1. Software Catalog & Entity Modeling in Port
We modeled the enterprise platform topology inside Port across four core blueprints:
- System / Application: Business service metadata, owning squad, Git repository, and criticality tier.
- Cluster & Environment: Production and non-production OpenShift clusters (SNO staging, multi-node HA prod).
- Tenant Namespace: Mapped live from OpenShift with real-time CPU/memory quota utilization, active SCC profile, and Argo CD sync status.
- Production Readiness Scorecard: Automated rule evaluation tracking whether workloads define health probes, non-root security contexts, Vault ExternalSecrets, and Kasten backup labels.
2. GitOps-Backed Self-Service Workflows
When an engineer triggers “Provision Application Environment” or “Request Quota Expansion” in Port:
- Port validates the payload against team ownership and tier policies.
- A webhook triggers our automation pipeline, which scaffolds or updates a standardized Kustomize overlay / Helm values set in the GitOps repository.
- OpenShift GitOps (Argo CD) reconciles the target cluster, provisioning the
Namespace,ResourceQuota,LimitRange,NetworkPolicy,RoleBinding, andSecretStoreatomically. - Status updates stream back to Port so the developer sees their live environment URL and health status within seconds.