Upstream Templates
Summary
Konstruct ships upstream provisioning templates that define the complete set of platform applications installed on each cluster type. Templates use Argo CD sync waves to orchestrate deployment order, ensuring dependencies are satisfied before dependent apps are installed.
All templates are maintained in the konstruct-templates repository on the main branch, under the cluster-templates/ directory. The repository root is organized by template kind: cluster-templates/ (cluster provisioning), helm-templates/ (application Helm charts), and pipeline-templates/ (CI workflows).
Cluster Hierarchy
Control Plane Cluster (1 per platform)
├── Management Clusters (1 per organization, aka "project clusters")
│ ├── Workload Clusters (physical clusters for applications)
│ ├── Theme Clusters (workload clusters that host platform theme workloads)
│ └── Virtual Clusters (lightweight vcluster-based environments)
Template Types
Every template is a Helm chart that declares a top-level clusterType in its values.yaml. Konstruct reads that key to decide how to treat the template.
| Template | Cloud Providers | clusterType | Description |
|---|---|---|---|
| Control Plane | Cloud-agnostic | control-plane | Seed template for the Konstruct control plane itself — no infrastructure layer; hydrated during bootstrap |
| Management Cluster | AWS, Civo | management | Per-organization management cluster running the org's Argo CD root and provisioning workload clusters |
| Workload Cluster | AWS, Civo, GCP | physical | Application workload clusters with core platform services |
| Theme Cluster | AWS, Civo | physical | Workload clusters that host platform theme workloads and join the app target pool |
| Virtual Cluster | AWS | virtual | Lightweight vcluster-based environments sharing a host workload cluster |
Template Paths
| Template | Path |
|---|---|
| Control Plane | cluster-templates/control-plane/ |
| Management — AWS | cluster-templates/aws/project-cluster/ |
| Management — Civo | cluster-templates/civo/project-cluster/ |
| Workload — AWS | cluster-templates/aws/workload-cluster/ |
| Workload — Civo | cluster-templates/civo/workload-cluster/ |
| Workload — GCP | cluster-templates/google/workload-cluster/ |
| Theme — AWS | cluster-templates/aws/theme-cluster/ |
| Theme — Civo | cluster-templates/civo/theme-cluster/ |
| Virtual — AWS | cluster-templates/aws/workload-vcluster/ |
Two further directories under cluster-templates/ are system pieces, not user-selectable templates: mgmt/ holds the Argo CD AppProject and cluster-registration components that management clusters install for their children, and shared/ holds resources reused across templates (such as the environment Application).
How Sync Waves Work
Each Argo CD Application in a template has a sync-wave annotation that controls deployment order:
metadata:
annotations:
argocd.argoproj.io/sync-wave: '30'
Lower wave numbers deploy first. Apps within the same wave deploy concurrently. Argo CD waits for all apps in a wave to become healthy before proceeding to the next wave.
Platform Component Versions by Template
| Component | Control Plane | AWS Mgmt | Civo Mgmt | AWS Workload | Civo Workload | GCP Workload | AWS vCluster | Theme (Civo) |
|---|---|---|---|---|---|---|---|---|
cert-manager | GitOps | v1.14.4 | v1.20.1 | v1.14.4 | v1.16.5 | v1.14.4 | v1.14.4 | v1.16.5 |
ingress-nginx | — | 4.12.1 | — | 4.12.1 | — | 4.10.0 | 4.10.0 | — |
| envoy-gateway | GitOps | — | v1.7.0 | — | v1.7.0 | — | — | v1.7.0 |
external-dns | GitOps | 1.14.4 | 1.20.0 | 1.14.4 | — | — | 1.14.4 | 1.20.0 |
| external-secrets | GitOps | 0.19.2 | 0.19.2 | 0.19.2 | — | — | 0.19.2 | — |
reloader | GitOps | v1.0.10 | 2.2.8 | v1.0.10 | v1.0.10 | v1.0.10 | v1.0.10 | v1.0.10 |
| crossplane | GitOps | 1.17.0 | 1.17.0 | — | — | — | — | — |
| kube-prometheus-stack | — | 68.3.0 | — | — | — | — | — | 68.3.0 |
atlantis | — | 6.9.3 | — | — | — | — | — | — |
| actions-runner | GitOps | GitOps | — | — | — | — | — | — |
Civo templates use Envoy Gateway instead of NGINX ingress, and newer component versions. AWS templates include more infrastructure tooling (external-dns, external-secrets, RBAC) at the workload cluster level. The AWS theme variant matches the Civo column and additionally pins external-secrets 0.19.2 with a ClusterSecretStore. Components marked "GitOps" are sourced from the platform GitOps repository rather than pinned in the template.