Platform vs Application Layer

UDS Core provides a shared platform layer — networking, identity, observability, security, and backup — so application teams can focus on mission logic rather than infrastructure plumbing. This page clarifies the ownership boundary between the two layers.

Capability Ownership

Platform Provides

• Networking & mTLS
• Identity & SSO
• Logging
• Monitoring
• Runtime Security
• Backup & Restore
• Policy & Compliance

Application Teams Own

• Workload packaging
• Package CR declarations
• Application configuration
• Data management & migrations
• Scaling & resource requests

How the Two Layers Interact

The Package CR is the contract between layers:

• App teams declare what they need — ingress routes, SSO clients, monitoring endpoints, network policy exceptions
• The platform fulfills how — Istio routing, Keycloak clients, UDS policies are all handled automatically

When an app needs a policy exception, the team creates an Exemption CR — keeping exceptions explicit, auditable, and separate from the Package CR.

See Core CRDs for details on both CRs.

Why This Separation Matters

Consistency

Same security, networking, and observability baseline for every application.

Compliance

Platform-wide controls enforced uniformly, simplifying accreditation.

Speed

Teams declare intent, not infrastructure details — ship faster.

Upgradability

Platform and app workloads upgrade independently.