Architecture overview
How the services fit together behind Discover → Plan → Enforce → Verify.
telark is a control plane for protection plans over Kubernetes workloads: discover applications, bind policy templates to a scope and a window, decide what may change them at admission, and verify the running state against the cluster.
Everything below runs inside your cluster, from one Helm release.
Services
| Service | Responsibility |
|---|---|
exporter | Owns the CRDs and storage; seeds built-in resources; snapshots cluster state. The single writer of telark custom resources, and the only stateful service. |
discovery | Groups workloads into applications; runs the leader-elected reconcile loop; drives the protection-plan lifecycle; dispatches enrichment jobs. |
enrichment | Generates optional AI insights for applications. Provider-pluggable; never blocks discovery. |
auth | Passkey (WebAuthn) and Google OIDC sign-in; session and role reconciliation. Holds no database of its own. |
notifier | Subscribes to the internal application event stream and persists each event through the exporter's API. |
ui | The dashboard, deployed by default. |
Alongside them the chart installs the admission-policy engine that enforces plans, a coordination layer for leader election, queues and caches, and an internal event stream. All three are bundled with defaults the chart owns.
The single-writer rule
Only the exporter writes telark custom resources. Discovery, auth, and notifier all go through its REST API. That keeps one mutation path, lets the exporter serialise writes per resource, and means the CRD store is never a race between services.
Data flow
- Discover. The exporter watches the cluster and materialises telark custom resources. Discovery's leader groups raw workloads into applications, diffs each against its last stored spec, classifies the change, and snapshots the manifests.
- Plan. You bind policy templates to a scope and a window. The
plan is persisted as a
ProtectionPlancustom resource. - Enforce. When the plan's window opens, the controller renders its templates into admission policies and deploys them, labelled with the plan ID.
- Verify. On every tick the controller reads those policies back
from the cluster and recomputes plan health — present, ready, and
using the failure action the plan's
modedemands. Drift and tampering surface instead of passing silently.
Insights ride alongside: discovery's leader dispatches application signals to enrichment on a tick, enrichment calls the configured provider and caches typed insights, and the dashboard polls a windowed read.
Storage
- Custom resources — the system of record, in the cluster's etcd.
- Snapshot PVC — captured manifest blobs, mounted by the exporter. The only volume telark owns.
- Coordination layer — leader locks, event coalescing, job queues, session cache, notification state. Treat as ephemeral.