System Architecture¶
Auto-generated
Rendered from docs/architecture/calm/architecture.json by the CALM
CLI (calm template). Do not edit this file by hand — edit the
architecture JSON or the Handlebars template at
docs/architecture/calm/templates/mermaid/system.md.hbs and regenerate
with make calm-diagrams.
A single Mermaid flowchart LR of every node in the CALM architecture
and the connections between them. connects and interacts
relationships become arrows (the protocol, when defined, labels the
arrow); deployed-in / composed-of containers become subgraphs.
Note: nodes whose name includes "(planned, Phase 1B/C/D)" are not yet
implemented in the repo — the diagram shows the target architecture so
contributors and users have one canonical picture.
flowchart LR
actor-vm-consumer["VM Consumer"]
actor-platform-operator["Platform Operator"]
service-kubernetes-api["Kubernetes API Server"]
service-banlieue-controller["banlieue-controller"]
service-banlieue-operator["banlieue-operator"]
service-provider-vsphere["banlieue-provider-vsphere"]
service-provider-proxmox["banlieue-provider-proxmox"]
service-provider-libvirt["banlieue-provider-libvirt"]
service-banlieue-imagebuilder["banlieue-imagebuilder"]
service-kairos-operator["kairos-operator (external, not shipped by banlieue)"]
system-banlieue-binary["banlieue (single binary)"]
network-vsphere-backend["vSphere / vCenter Backend"]
network-proxmox-backend["Proxmox VE Backend"]
network-libvirt-backend["libvirt / KVM Host"]
network-vault-backend["HashiCorp Vault (KV secrets)"]
data-asset-virtualmachine-cr["VirtualMachine Custom Resource"]
data-asset-virtualmachinepool-cr["VirtualMachinePool Custom Resource"]
data-asset-virtualmachineclaim-cr["VirtualMachineClaim Custom Resource"]
data-asset-provider-cr["Provider Custom Resource"]
data-asset-providerclass-cr["ProviderClass Custom Resource"]
data-asset-vmclass-cr["VMClass Custom Resource"]
data-asset-vmimage-cr["VMImage Custom Resource"]
data-asset-osartifact-cr["OSArtifact Custom Resource (external, kairos-operator)"]
data-asset-infra-machine-cr["Infrastructure Machine CR (VSphereMachine, etc.)"]
data-asset-infra-cluster-cr["Infrastructure Cluster CR (VSphereCluster)"]
data-asset-capi-cluster-cr["CAPI Cluster / MachineDeployment (external)"]
service-capi-core["Cluster API core + control-plane provider (k0smotron)"]
system-k0s-bootstrap["k0s Bootstrap Script"]
service-k0s-bootstrap-ch-node["Management-cluster node on Cloud Hypervisor"]
database-kine-datastore["kine datastore (external SQL, operator-provided)"]
network-oidc-issuer["OIDC Token Issuer (JWKS / discovery)"]
service-sandbox-broker["Sandbox Broker (planned, roadmap phase C — not shipped by banlieue)"]
service-in-guest-agent["In-guest agent (mediatore, separate repository)"]
service-provider-cloud-hypervisor["banlieue-provider-cloud-hypervisor"]
service-cloud-hypervisor-vmm["Cloud Hypervisor VMM (one per guest)"]
network-cloud-hypervisor-host["Cloud Hypervisor KVM Host"]
service-oci-registry["OCI Registry (operator-provided, external)"]
service-swtpm["swtpm (one per tpmEnabled Cloud Hypervisor guest)"]
service-banlieue-host-installer["banlieue host cloud-hypervisor (installer)"]
service-vmm-release-source["Cloud Hypervisor release source (github.com or operator mirror, external)"]
network-control-plane-vip["Management cluster control plane VIP"]
service-metrics-scraper["Metrics scraper (Prometheus)"]
service-otel-collector["OpenTelemetry collector (optional)"]
actor-rust-api-consumer["Rust API consumer"]
service-crates-io["crates.io (external)"]
network-sandbox-segment["Sandbox segment (layer 2, no router)"]
service-egress-gateway["Egress gateway VM (mediatore image)"]
subgraph sg_system-banlieue-binary [System Banlieue Binary]
service-banlieue-controller
service-banlieue-operator
service-provider-vsphere
service-provider-proxmox
service-provider-libvirt
service-banlieue-imagebuilder
end
subgraph sg_ecosystem-management-cluster [Ecosystem Management Cluster]
service-banlieue-controller
service-banlieue-operator
service-kubernetes-api
service-capi-core
service-provider-vsphere
service-provider-proxmox
service-provider-libvirt
service-banlieue-imagebuilder
service-kairos-operator
end
subgraph sg_service-kubernetes-api [Service Kubernetes Api]
data-asset-virtualmachine-cr
data-asset-provider-cr
data-asset-providerclass-cr
data-asset-vmclass-cr
data-asset-vmimage-cr
data-asset-osartifact-cr
data-asset-infra-machine-cr
data-asset-infra-cluster-cr
data-asset-capi-cluster-cr
end
actor-vm-consumer --> data-asset-virtualmachine-cr
actor-vm-consumer --> data-asset-vmclass-cr
actor-vm-consumer --> data-asset-vmimage-cr
actor-platform-operator --> data-asset-provider-cr
actor-platform-operator --> data-asset-providerclass-cr
actor-platform-operator --> data-asset-capi-cluster-cr
actor-platform-operator --> data-asset-infra-cluster-cr
actor-vm-consumer -->|HTTPS| service-kubernetes-api
actor-platform-operator -->|HTTPS| service-kubernetes-api
service-banlieue-controller -->|HTTPS| service-kubernetes-api
service-banlieue-operator -->|HTTPS| service-kubernetes-api
service-provider-vsphere -->|HTTPS| service-kubernetes-api
service-provider-proxmox -->|HTTPS| service-kubernetes-api
service-provider-libvirt -->|HTTPS| service-kubernetes-api
service-capi-core -->|HTTPS| service-kubernetes-api
service-banlieue-imagebuilder -->|HTTPS| service-kubernetes-api
service-kairos-operator -->|HTTPS| service-kubernetes-api
service-provider-vsphere -->|HTTPS| network-vsphere-backend
service-provider-proxmox -->|HTTPS| network-proxmox-backend
service-provider-libvirt -->|TLS| network-libvirt-backend
system-k0s-bootstrap --> network-vsphere-backend
system-k0s-bootstrap --> network-libvirt-backend
system-k0s-bootstrap --> service-k0s-bootstrap-ch-node
system-k0s-bootstrap --> ecosystem-management-cluster
service-kubernetes-api -->|TLS| database-kine-datastore
system-k0s-bootstrap --> network-vault-backend
service-banlieue-controller --> data-asset-virtualmachinepool-cr
service-banlieue-controller --> data-asset-virtualmachine-cr
service-banlieue-controller --> data-asset-virtualmachineclaim-cr
service-banlieue-controller --> data-asset-virtualmachinepool-cr
service-banlieue-controller --> data-asset-virtualmachine-cr
actor-vm-consumer -->|HTTPS| network-oidc-issuer
service-kubernetes-api -->|HTTPS| network-oidc-issuer
service-sandbox-broker --> data-asset-virtualmachineclaim-cr
service-sandbox-broker -->|HTTPS| service-in-guest-agent
service-in-guest-agent -->|HTTPS| network-oidc-issuer
service-provider-cloud-hypervisor -->|HTTPS| service-kubernetes-api
service-provider-cloud-hypervisor -->|HTTP| service-cloud-hypervisor-vmm
subgraph sg_network-cloud-hypervisor-host [Network Cloud Hypervisor Host]
service-provider-cloud-hypervisor
service-cloud-hypervisor-vmm
service-swtpm
end
service-banlieue-imagebuilder -->|HTTPS| service-oci-registry
service-provider-cloud-hypervisor -->|HTTPS| service-oci-registry
service-cloud-hypervisor-vmm -->|TCP| service-swtpm
service-cloud-hypervisor-vmm --> service-provider-cloud-hypervisor
subgraph sg_network-cloud-hypervisor-host [Network Cloud Hypervisor Host]
service-banlieue-host-installer
end
service-banlieue-host-installer -->|HTTPS| service-vmm-release-source
network-control-plane-vip -->|TCP| service-kubernetes-api
service-metrics-scraper -->|HTTP| service-banlieue-controller
service-banlieue-controller -->|HTTPS| service-otel-collector
service-metrics-scraper -->|HTTP| service-banlieue-operator
service-banlieue-operator -->|HTTPS| service-otel-collector
service-metrics-scraper -->|HTTP| service-banlieue-imagebuilder
service-banlieue-imagebuilder -->|HTTPS| service-otel-collector
service-metrics-scraper -->|HTTP| service-provider-vsphere
service-provider-vsphere -->|HTTPS| service-otel-collector
service-metrics-scraper -->|HTTP| service-provider-proxmox
service-provider-proxmox -->|HTTPS| service-otel-collector
service-metrics-scraper -->|HTTP| service-provider-libvirt
service-provider-libvirt -->|HTTPS| service-otel-collector
service-metrics-scraper -->|HTTP| service-provider-cloud-hypervisor
service-provider-cloud-hypervisor -->|HTTPS| service-otel-collector
actor-rust-api-consumer -->|HTTPS| service-crates-io
actor-rust-api-consumer -->|HTTPS| service-kubernetes-api
service-in-guest-agent -->|HTTPS| service-egress-gateway
subgraph sg_network-sandbox-segment [Network Sandbox Segment]
service-in-guest-agent
service-egress-gateway
end
Source: nodes and relationships in architecture.json.