DOCSEARCHbyAlgolia
Submit Docs

Panfactum Stack Documentation

website·Indexed 31 days ago

https://panfactum.com

Documentation for the Panfactum stack, featuring guides on infrastructure-as-code using OpenTofu (Terraform), developer environment setup, and workload deployment. Includes reference material for AWS, Kubernetes, Vault, and BuildKit configuration, as well as versioning and upgrade procedures for stable-25-04 releases.

Tokens
465.9K
Snippets
1.7K
Records
3.6K
Agent score
58%

What's inside Panfactum

  1. Overview of the wf_spec submodule

    The wf_spec submodule creates a workflow_spec output compatible with Panfactum's Argo Workflows deployment. It automates several infrastructure requirements:

    • Permissions: Assigns AWS permissions for S3 artifact/log storage and Kubernetes permissions for the Argo Workflow controller.
    • Pod Defaults: Configures affinities, tolerations, volumes, security contexts, and scheduler settings for pods created by the workflow.
    • Reliability: Sets up basic parallelism, timeouts, and retry configurations, and disables pod disruptions by default (overridable).
    • Container Defaults: Provides a container_defaults output for recommended container settings.

    Users are responsible for defining the core workflow logic via templates, arguments, and entrypoint.

  2. Overview of the Panfactum framework architecture

    The Panfactum framework is a unified architecture designed for deploying secure, cost-effective, and production-ready cloud workloads on hyperscalers like AWS. It consists of two primary toolsets:

    1. Panfactum Kubernetes Clusters: Infrastructure and tools that operate within the organization's cloud computing environment.
    2. Panfactum devShell: A local toolset that runs on a developer's machine to interface with the cloud installation.

  3. Overview of the kube_daemon_set submodule

    The kube_daemon_set submodule is a production-hardened implementation of a Kubernetes DaemonSet. It includes several built-in enhancements over a standard DaemonSet, including:

    • Standardized resource labels and Pod/container security hardening.
    • Temporary directory mounting and integration with ConfigMaps, Secrets, and the Downward-API.
    • Default service account configuration and readiness/liveness probe support.
    • Automatic reloading via Reloader and support for Vertical Pod Autoscaling (VPA).
    • Pod Disruption Budget (PDB) configuration.
    • Toleration switches specifically for Panfactum node classes.

  4. Overview of Panfactum Infrastructure-as-Code stack

    The Panfactum framework utilizes OpenTofu (an open-source fork of Terraform) to define infrastructure modules and Terragrunt as a configuration-as-code manager to deploy those modules. The stack follows a highly opinionated set of practices aligned with OpenTofu and Gruntwork recommendations to standardize infrastructure deployment.

  5. Overview of Panfactum Infrastructure-as-Code Tooling

    The Panfactum framework utilizes OpenTofu (an open-source fork of Terraform) to define infrastructure modules and Terragrunt as a configuration-as-code manager to deploy those modules. The framework provides an opinionated set of practices and CLI tooling to standardize deployment and avoid common errors associated with unopinionated IaC tools.

  6. Overview of the Panfactum Framework Architecture

    The Panfactum framework is a unified architecture designed for deploying cloud workloads on hyperscalers like AWS. It consists of two primary components: Panfactum Kubernetes Clusters, which are tools that run within an organization's cloud computing environment, and Panfactum devShell, which provides local tooling on a developer's machine to connect to and manage those clusters.

  10. Overview of Kubernetes Autoscaling types in Panfactum

    The Panfactum stack utilizes three types of autoscaling to optimize cluster resources:

    1. Horizontal Pod Autoscaling (HPA): Adjusts the number of pods for Deployments or StatefulSets (can be extended via KEDA).
    2. Vertical Pod Autoscaling (VPA): Adjusts resource requests and limits for pods based on historical usage.
    3. Cluster Autoscaling: Adjusts the number of nodes in the cluster, typically using the Cluster Autoscaler or Karpenter.

  11. Overview of Federated Authentication architecture

    Federated authentication in the Panfactum stack is split into two distinct parts to accommodate different deployment environments:

    1. Authentication Provider: Configured in Authentik and deployed in the same environment as the Authentik instance.
    2. Authentication Receiver: Configured in the service provider (e.g., AWS, Vault) and deployed in the service provider's environment.

  12. Overview of workload permission management

    Workloads requiring interaction with control plane APIs must be granted permissions via Kubernetes Service Accounts. Controller submodules automatically create a dedicated service account for managed pods and expose the account name via the service_account_name output. Depending on the target system, different submodules are used to assign permissions:
    Control Plane SystemSubmoduleDescription
    Kubernetes APINoneUse standard Kubernetes RBAC resources
    AWSkube_sa_auth_awsSets up IAM roles for service accounts (IRSA)
    Vaultkube_sa_auth_vaultSets up Kubernetes auth method with Hashicorp Vault
    Argokube_sa_auth_workflowGrants permissions for Argo workflow pods