Platform Provides
- Networking & mTLS
- Identity & SSO
- Logging
- Monitoring
- Runtime Security
- Backup & Restore
- Policy & Compliance
Platform vs Application Layer
UDS Core provides a shared platform layer — networking, identity, observability, security, and backup — so application teams can focus on mission logic rather than infrastructure plumbing. This page clarifies the ownership boundary between the two layers. See our interactive architecture diagram for a visual overview.
Capability Ownership
Section titled “Capability Ownership”Application Teams Own
- Workload packaging
- Package CR declarations
- Application configuration
- Data management & migrations
- Scaling & resource requests
How the Two Layers Interact
Section titled “How the Two Layers Interact”The Package CR is the contract between layers:
- App teams declare what they need — ingress routes, SSO clients, monitoring endpoints, network policy exceptions
- The platform fulfills how — Istio routing, Keycloak clients, UDS policies are all handled automatically
When an app needs a policy exception, the team creates an Exemption CR — keeping exceptions explicit, auditable, and separate from the Package CR.
See Core CRDs for details on both CRs.
Why This Separation Matters
Section titled “Why This Separation Matters”Consistency
Same security, networking, and observability baseline for every application.
Compliance
Platform-wide controls enforced uniformly, simplifying authorization.
Speed
Teams declare intent, not infrastructure details — ship faster.
Upgradability
Platform and app workloads upgrade independently.